FILTERING VLAN BASED TRAFFIC ON SRX 550 CLUSTER

Hello Guys,

I have set up an SRX on a stick, with vlan tagging and subinterfaces representing VLAN 10 -SERVERS, VLAN 20 - FINANCE and VLAN 30 -IT and their corresponding IP's configured on the Reth interface connected to a Cisco switch. Using firewall policies I need to allow access to the SERVER VLAN from both IT VLAN and FINANCE VLAN, but prevent traffic to the IT VLAN from the FINANCE VLAN, finally permit internet access to all VLANS. 

Thanks