Hello Anita,
I try to provide answers to your questions
1) It is technically possible only if the production switch on the right has no knowledge of the VC subnet 172.16.250.0/24 that is on the VC switch. However, the internet facing router needs to know this subnet in order to make the VC device able to place and receive VC calls over the internet. From your network diagram the router R is connected to the production switch, if so the proposed configuration is not effective alone because the production switch will send traffic for unknown subnet to the router R and will receive an ICMP redirect to 172.16.200.254 to reach subnet 172.16.250.0/24. So the solution is not complete without using a VACL on the VC switch (see point 3).
2) VC traffic and non VC traffic can go the router R, but router R needs to know the VC subnet as explained above.
More technically the router R needs also to create a static NAT entry for the VC IP address with extendable option to make possible calls from the internet to the VC device.
3) how to implement the layer 2 ACL (not layer 3 ACL) to block the 172.16.200.128 - 172.16.200.191?
You need a VACL applied to Vlan 200. The VACL is applied to L2 Vlan 200 broadcast domain not to L3 SVI interface Vlan200 on VC switch.
As a reference you can use the following document
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.html?dtid=osscdc000283
without the VACL segregation of non manager users is not effective as explained above.
You need to deny traffic from hosts in range 172.16.200-128-191 to the VC subnet.
You need also to allow all other traffic to reach the VC subnet to allow VC calls with external devices.
To be noted if SVI Vlan 250 is not defined on production switch you can also solve with a routed ACL applied to SVI vlan 200 on VC switch.
If you want to avoid normal users to reach manager PCs IP address range you need a VACL.
Note :
requirement 3) may need to be redefined otherwise the VC device cannot make VC calls to device on the internet.
>> 3. public internet, non top mgnt cannot access to VC switch
In my opinion the VC device should be able to be reached from the internet on appropriate TCP and UDP ports.
Hope to help
Giuseppe
