Actually Stephen, we do indeed have a switch that has half its ports as c2k and half its ports as legacy and shares fibre from its cab back to cab1. Maybe not common procedure, but you can come take a look if you want and see for yourself if you don't believe me.
And yes, Aaron it could well be the fibre link being the problem here and its what I originally thought and pretty much still do. But if SNAC can block network access by port or by switch, surely they could block a legacy switch which, after all, is simply another subnet of the c2k WAN? Its just supposition of course, but it's bound to be possible in theory.