CL3 - CL2 - drop on forward path by core1 cause match VLAN 20 and CL3 not CL1 as SRC IP CL1 - CL2 - pass - no ACL cause forwarded by Access2 SR2 - CL2 - pass on forward path by core1 cause match VLAN 10 Drop on return path by core1 cause match VLAN 20 and no CL1 as SRC IP SR1 - CL1 - pass on forward path by core1 cause match VLAN 10 pass on return path by core1 cause match VLAN 20 and CL1 as SRC IP CL1 - CL3 - pass on forward path by core1 cause match VLAN 20 and CL1 as SRC IP drop on return path by core1 cause match VLAN 20 and not CL1 but CL3 as SRC IP

People seem to be confused by inverted mask/wildcard masks. They would be correct for Cisco switches, but AOS-CX does NOT use wildcard masks; "AOX-CX switches do not support wildcard masks - only prefixes or subnet masks - when created ACEs." Cisco: 255.0.255.0 = xx.123.xx.123 AOS-CX: 255.0.255.0 = 123.xx.123.xx

Validation processes
+ Syntax validation
- When: while typing
- What: command syntax including in-line help
+ Semantics validation
- When: VALIDATE button (in multi-editor) or before DEPLOY
- What: configuration consistency
+ Conformance validation
- When: while editing
- What: compliance with conformance rules: corporate policies, minimum connectivity requirements, etc.
+ Change validation
- When: during DEPLOY (before and after configuration deployment)
- What: compares device state before and after changes are applied (using show commands)