Patrick
i think that would be a good way to do it as it removes the danger of a misconfiguration of the acl on the 10Gbps link affecting production servers.
So if you create a new vlan and an SVI for it your acl becomes relatively easy. I assume you are using private addressing internally. So you don't need to specify each subnet you can simply summarise even if you are not using all the addresses within that range eg.
production addressing = 10.x.x.x
test servers = 10.10.10.x/24
ip access-list from_test_servers
deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 10.10.10.0 0.0.0.255 any
int vlan 10 <-- new test server vlan
ip access-group from_test_servers in
what the above does is -
1) deny any traffic from the test servers to any device in production
2) allow internet access
if there were some reason you needed to access any production servers just include host entries before the first deny line. The above does assume as i say all production is using 10.x.x.x addressing.
This only blocks traffic going out from the test servers. It would also block return traffic so if a production device tried to connect to a test server the packet would get to the test server but the return packet would be dropped. However if you want be doubly sure you can also apply an acl outbound ie.traffic to the test servers -
ip access-list to_test_servers
deny ip 10.0.0.0 0.255.255.255 10.10.10.0 0.0.0.255
permit ip any 10.10.10.0 0.0.0.255
int vlan 10
ip access-group to_test_servers out
with both acls the test servers can't send anythiing to production and no production devices can send anything to the test servers.
Obviously if you use other private addressing in production you need to add that as deny lines as well otherwise they will be allowed by the permit lines for internet access.
Finally if you are using HSRP and the switches are not running VSS don't forget to apply the acl(s) to both SVIs, one on each switch.
Any questions please come back.
Jon
