Chris,
That's great news! Thank you for letting me know - and also thank you for the kind words!
Regarding ACLs on Catalyst switches - yes, I am well-acquainted with them, but what you require is not that easy to accomplish by simple ACLs on switches. The problem is that you want your VLANs 22 and 26 to be prevented from opening a connection to hosts in other VLANs, but you still want them to respond to connections from other VLANs. The difficulty is in distinguishing what packets initiate a new session, and which packets are responses to a session initiated from the "other end". This calls for a stateful firewall that is capable of creating a dynamically populated table of opened sessions, and permitting packets based on this table's contents. The Catalyst 3750 series do not support any kind of dynamic firewall rules, and all we would be able to do is to simply create static ACLs that tediously allow the particular management communication from other VLANs, then deny every other communication with other VLANs, and allow everything else (essentially permitting the internet access). Depending on the protocols involved for management, this might be challenging to do, and if they use dynamic ports, this might be entirely impossible.
What I suggest is you trying to describe as precisely and as extensively as possible the nature of the management connections that you want to allow into VLANs 22 and 26 (including addresses of management hosts, particular protocols, L4 ports, etc.). We will know based on this description whether we can do it with static ACLs.
I'll do my best to respond during the next day - as it's past 2:30AM for me over here, I'll drop off for a couple of hours of sleep :)
Best regards,
Peter
