Why do I need to allow TCP connections? To me, TCP is AXFR and I'm NOT going to allow AXFR for everyone.
Just allow them for the SWITCH machines. No biggie. Something like:
acl transfer-nets { ...; 130.59.211.10/32; 130.59.10.30/32; ...; };
or whichever machines at SWITCH are trying to do the transfer.