CL3 - CL2 - drop on forward path by core1 cause match VLAN 20 and CL3 not CL1 as SRC IP CL1 - CL2 - pass - no ACL cause forwarded by Access2 SR2 - CL2 - pass on forward path by core1 cause match VLAN 10 Drop on return path by core1 cause match VLAN 20 and no CL1 as SRC IP SR1 - CL1 - pass on forward path by core1 cause match VLAN 10 pass on return path by core1 cause match VLAN 20 and CL1 as SRC IP CL1 - CL3 - pass on forward path by core1 cause match VLAN 20 and CL1 as SRC IP drop on return path by core1 cause match VLAN 20 and not CL1 but CL3 as SRC IP