This reports which of two mutually exclusive hardware filtering modes the device's ACL engine is currently running in -- a combined Layer 2 and Layer 3 mode versus a Layer-3-only mode -- which is a device-wide setting affecting the capabilities of every ACL rule on the box. An admin needs to know this specifically because it determines whether Layer 2 match fields like MAC address, VLAN ID, and PCP (as seen elsewhere in this MIB's rule table) are actually usable at all, since in l3only mode those fields would presumably be meaningless or unenforceable. For example, an admin trying to write an ACL rule that matches on cienaCesAclRuleSrcMacAddr would find that rule non-functional if this object reports l3only(2), since Layer 2 matching isn't available in that mode.