Jon, thanks for your help!at the moment, this will do the trick for me.  

1: they may not be able to do a telnet session to a switch or trying to make a connection via FTP to a server. also an RDP session must be excluded.but if i block this, can i still make a rdp session to them? 

i'm using a 3560 switch.vlan10 is the vlan for the students, they only need to acces the internet.vlan99 is my management vlan and i do not whant that the students can acces my management (switches and routers). but when there is a problem, i need to...

i'm using a L3 switch.at this moment i'm trying this out on VLAN10 with VLAN99this is my config: interface Vlan10ip address 172.16.10.1 255.255.254.0ip access-group BLOCK_VLAN10 inip access-group VLAN_99 out!interface Vlan20ip address 172.16.20.1 255...