Layer 3 ACL and two Cisco switches.

If they aren't stacked, yes. I mean technically, provided your first switch is the owner at l2 and l3 (by setting spanning-tree and hsrp priorities), I suppose that you would not need the same on switch 2, but presuming your goal is full redundancy and identical operation in the event of a link or switch failure, then you need to match the configs. I'm also assuming your idf or distribution layer has redundant links to both cores. Else the situation changes since the second backbone can never fully stand in when the primary fails.

The simple answer is that you need to apply the L3 ACLs on every layer 3 interface on every switch/router for the VLANs you want to restrict. If you have two switches, and they both have a layer 3 interface for the VLAN, then you need to apply the ACL on both.

If they aren't stacked, yes. I mean technically, provided your first switch is the owner at l2 and l3 (by setting spanning-tree and hsrp priorities), I suppose that you would not need the same on switch 2, but presuming your goal is full redundancy and identical operation in the event of a link or switch failure, then you need to match the configs. I'm also assuming your idf or distribution layer has redundant links to both cores. Else the situation changes since the second backbone can never fully stand in when the primary fails.

Thank you both for the clarification. Regards, AP