There is a layer 3 switch which is responsible for inter-vlan routing. One VLAN (10, network: 172.16.10.0/24) cannot be accessed from any other VLANs (for management purposes). In order to do that I used the following ACL
access-list 1 permit 172.16.10.0 0.0.0.255 access-list 1 deny any interface vlan 10 ip access-group 1 out
This blocks any traffic with source IP address outside VLAN 10 from exiting out the VLAN 10 SVI interface.
I chose to block the traffic when exiting the VLAN 10 SVI interface instead of blocking the traffic when entering all the other VLAN SVI interfaces because new VLANs can be added later, which means setting the same ACL for the new VLANs as well.
The problem is that the layer 3 switch has a management interface (172.16.10.1) which any VLANs can access, because the traffic will enter through the SVI interface corresponding to the source VLAN and it will remain in the switch. It will not get a chance to be filtered by the ACL which resides at the exit of the VLAN 10 SVI.
Is there a solution for filtering traffic destined to this interface residing on the switch without putting ACLs on inbound traffic for every other VLAN SVI?