I have a Cisco 3560 Layer 3 switch configured with 3 VLANs
From the switch you can ping any device on any VLAN, successfully.
From the switch you can surf the net.
From a switch (cisco 2950 configured for VLAN20) connected to the 3560
you cannon surf the net. a trace rt shows it get to VLAN 20 on the 3560 and no further