Ok, I would suggest object group nesting for something like this. If you essentially need to separate these ports that is. Should look something like this:
object group service OUTSIDENAME
Description OUTSIDE_ACCESS_IN
group-object XYZ
group-object WEB
group-object Test
This way you'll only require 4 lines in your ACL as opposed to 12.
access-list outbound extended permit tcp host 173.0.0.1 host xxx.xxx.xxx.22 object-group service OUTSIDENAME
access-list outbound extended permit UDP host 173.0.0.1 host xxx.xxx.xxx.22 object-group service OUTSIDENAME
access-list outbound extended deny any any object-group service OUTSIDENAME
access-list outbound extended permit any any
The documentation for this can be found here: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800d641d.shtml
I've not configured a 3550 for this myself, but know it does do layer3 routing. As such, it is capable of doing ACL's and other features. It will be pretty limited though.
You'll first need to create your ACL in the same fashion you would on a firewall.
Example:
Switch(config)# ip access-list extended outbound
Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet
Switch(config-ext-nacl)# deny tcp any any
Switch(config-ext-nacl)# permit icmp any any
Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt 1024
Switch(config-ext-nacl)# deny ip any any log ** Logging this is totally up to you.
Switch(config-ext-nacl)# exit
Now you'll need to apply it to the interface you are wanting to restrict access from. Remember this interface will require an IP address.
Sample:
Switch(config)# interface gigabitethernet0/3
Switch(config-if)# ip access-group outbound in
You can find more on this at the following: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_12c_ea1/configuration/guide/swacl.html#
I hope this helped a little.
