Access-list for response port

[chpmotry]

Hi guys.

I have a network with below topology :

Server vlan two should can only answer the remote request of server vlan three and has no other permissions. Server vlan three should is unlimited access

I typed below commands in switch-core of my top topology 

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 host 172.16.3.2 eq 3389 established 

deny ip any any 

int vlan 2

ip add 172.16.2.1 255.255.255.0

ip acces-group acl-vl2 in

int vlan 3

ip add 172.16.3.1 255.255.255.0

But result of this commands was that the server vlan 2 could  still remoting to server vlan 3?

I tested the below command :

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 host 172.16.3.2 established 

deny ip any any 

but the result did not change .

What command i should typing to fix this problem?

[M02@rt37 · Accepted solution]

Hello @chpmotry 

Server vlan two should can only answer the remote request of server vlan three and has no other permissions.

ip access-list extended acl-vl2

permit tcp host 172.16.2.2 eq 3389 host 172.16.3.2 

deny ip any any 

[Joseph W. Doherty]

"Server vlan two should can only answer the remote request of server vlan three and has no other permissions."

What M02@rt37 provided for the ACE is likely "good enough", but you might further tighten it with a variation from OP, i.e.:

permit tcp host 172.16.2.2 eq 3389 host 172.16.3.2 established 

Also as request was just to block the VLAN 2 server, you might also change:

deny ip any any !also blocks all other hosts on that VLAN

to:

deny ip host 172.16.2.2 any !Of course, still keeping the prior permit ACE too.
permit ip any any

[chpmotry]

Thank you so much @Joseph W. Doherty

I test your commands and recommendation.