All what you mentioned are required.
You should be able to telnet based on ip address on the switch/router belonging to any vlan - assuming we have routing between vlans either via a one arm router or an L3 switch.
Here is a sample config.
ip dhcp excluded-address 172.16.0.1
ip dhcp excluded-address 172.16.32.1
ip dhcp excluded-address 172.16.64.1
!
ip dhcp pool vlan101
import all
network 172.16.0.0 255.255.224.0
default-router 172.16.0.1
dns-server 192.168.1.254
!
ip dhcp pool vlan102
import all
network 172.16.32.0 255.255.224.0
default-router 172.16.32.1
dns-server 192.168.1.254
!
ip dhcp pool vlan103
import all
network 172.16.64.0 255.255.224.0
default-router 172.16.64.1
dns-server 192.168.1.254
!
!
!
interface Ethernet0/0
description connected to EthernetLAN
ip address 10.10.10.254 255.255.255.0
ip access-group 100 in
ip rip advertise 40
ip inspect myfirewall out
full-duplex
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
no ip address
full-duplex
!
interface Ethernet0/1.101
encapsulation dot1Q 101
ip address 172.16.0.1 255.255.224.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip rip advertise 40
!
interface Ethernet0/1.102
encapsulation dot1Q 102
ip address 172.16.32.1 255.255.224.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip rip advertise 40
!
interface Ethernet0/1.103
encapsulation dot1Q 103
ip address 172.16.64.1 255.255.224.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip rip advertise 40
!
router rip
timers basic 40 240 240 320
network 10.0.0.0
network 172.16.0.0
!
ip http server
ip http port 9090
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.252
!
!
logging trap debugging
logging source-interface Ethernet0/0
logging 172.16.64.2
access-list 100 deny tcp any any
access-list 100 deny ip any any
access-list 100 deny udp any any
!
snmp-server community public RO
snmp-server enable traps tty
!
!
!
gateway
!
!
!
line con 0
exec-timeout 0 0
password 7 XXXXXXXXXXXXXXXXXX
login
line aux 0
line vty 0 4
password 7 XXXXXXXXXXXXXXXXXx
login
