[jamieone]

That's a good question and the core over-states it.

The east-west means that natively clients don't arp and icmp from each other they do it from ACL8 on the GW. Your printer registers, you mark it anonymous, anyone can get to it, and when you arp for it, it answers.

But when you have 2,000 clients on a vlan and you want 1999 of them to only reach the internet and not each other, you make one rule at the ACL server.

It means everything goes to the ACL8 server for a decision even on the local network.