On a controller (a 7010 for example) I know that if I have a port set to access mode with a single VLAN on it, I have the option to drop in a firewall policy for that VLAN.
So, on a trunked port on said controller with multiple VLANs coming in, is there a way to add individual firewall policies per VLAN?