@NeilR2 No it can be a hub. But routers can only be a hub if they have a static public IP address. If its behind NAT, CGNAT or a multitude of other ISP sheninagins they cannot be a hub Top and Bottom...

@Trevis What ACL rules do you have?

@MR.S Except ER605 v1 and ER7206 v1

@gskips Switch rules can only work on traffic that goes through them. In general most networks will have a central switch and everything spreads out from that. Its not a requirement, but it tends to...

@gskips Your switches support Switch ACL, that is definitely the way to go for the rules you want Remember ACL rules work top down in a "first match wins" so you want the allow rule above the rules...

@gskips Currently you can only achieve this with Switch ACLs which allow LAN<>LAN IP Groups but you have to have a full Omada l2+ / L3 switch to do this (minimum is SG2008 model) They only other way...