Hello Jitendra,
there are more ways to achieve what you want.
Your scenario should be:
Servers vlan VL128 ---- SVI_Vlan128 === SVI_Vlan192 --- Clients Vlan Vlan 192
The correct tool is an extended IP ACL that allows to specify a source and destination and L4 information like TCP or UDP and ports.
Let's suppose the server 128.20.0.166 is open on TCP port T
You can apply the ACL inbound on SVI Vlan128:
conf t
access-list 121 deny tcp host 128.20.0.166 eq T 192.168.X.0 0.0.0.255
access-list 121 permit ip any any
where T is only there to represent the service port number.
Notice that the TCP port follows the server: the port used on the clients is dynamically negotiated so it cannot be matched.
! applying the ACL inbound
int vlan 128
ip access-group 121 in
Other choices are possible.
Hope to help
Giuseppe
