This document will go over a general reference topology that can be used when designing your network. It includes a layer 3 device that handles client VLANs downstream of the MX device.
In this topology:
In each scenario below, traffic is always sent from the downstream client - 192.168.22.3.
For information on IP spoofing and how it functions in situations where the network is not correctly designed please refer to our article on IP Source Address Spoofing Protection