If I am not confused you have right rules on the wrong interface.
The rules for a given interface are used to allow traffic that is talking to machines that are CONNECTED physically to that interface / network. With these rules you can only allow/deny what traffic is ENTERING the router interface. (This is different than with Linux where you can police both directions with the rules for an interface.)
So the rule allowing access to the controller would need to be on the 10GSWITCH interface and the rule allowing access to the switch would have to be on the MGT4 interface.