I want to give access SQL 2008 R2 server for all users who logon from the production VLAN but only to one group when packet comes from the development VLAN. SQL server is within production LAN.Does not seem like I can do it either with SQL server or IPsec (Windows firewall)
There is no notion of a "VLAN" either at the SQL server service level or at the Windows Firewall level. So you cannot use the vlan tag parameter in any rules, roles or group memberships.
Although you could set up firewall rules to only allow certain IP addresses or address ranges (which might "translate" to a specific VLAN in your configuration), creating an AND-like condition where a user is only allowed to log in if in member of group A AND his request is coming from VLAN X or subnet A.B.C.D/26 is not possible.