Think of logical interfaces just like physical interfaces when applying access-lists. As a general best practice when applying extended access-lists try to apply them as close to the source as possible. In your case this means that we have to apply the access-lists inbound on the respective sub-interfaces. I will try to map out the ACLs as per your requirements:
1) For your 10.71.9.x hosts the ACL will look something like:
access-list 100 permit ip host 10.71.9.100 any
access-list 100 permit ip 10.71.9.0 0.0.0.255 10.71.12.0 0.0.0.255
access-list 100 deny ip any any (just for informational reasons; there is an implicit deny at the end of all access-lists by default)
interface Fa0/0.1
ip access-group 100 in
2) For your 10.71.10.x subnet:
access-list 110 permit ip host 10.71.10.68 host 10.71.9.100 (this will allow 10.71.10.68 to initiate connections to 10.71.9.100. If you want to change this behavior we need to add something in access-list 100)
access-list 110 permit ip 10.71.10.0 0.0.0.255 10.71.12.0 0.0.0.255
access-list 110 deny ip any any (just for informational reasons; there is an implicit deny at the end of all access-lists by default)
Interface Fa0/0.2
ip access-group 110 in
This was just an example you can build on.
