Firstly sorry about the late reply. Life took over! :-(. BTW many thanks for the tip about L0-2, much simpler!
Anyway I have done some further investigating...
In fact I can successfully ping the L2 VM from any of my networks but, for example, sshing in from a PVE L1 VM doesn't work, nor does...