access-list on VE interface blocks traffic for whole VLAN

[mielch_qwerty]

Hello all. I will be grateful for the help
I have applied ACL on a VE interface and it seems ACL was applied not only on VE but on physical interface too. Is it correct?
I have not found any info about it, except for "enable acl-per-port-per-vlan" but am not sure whether it is what i need.
Thank you.

[jijo_panangat]

Hello Mielch,

Ve 1 is mapped to vlan 1 above. so the ACL applies to the vlan 1 ports 1/1/1 & 1/1/2.

[mielch_qwerty]

ok, thank you for help 🙂 that's a pity though, that this behavior is not mentioned in any documentation

[jijo_panangat]

Hello Mielch,

The use cases for 'enable acl-per-port-per-vlan' feature is covered in the following link.

http://docs.ruckuswireless.com/fastiron/08.0.70/fastiron-08070-securityguide/GUID-EA33A883-46A8-491D...

http://docs.ruckuswireless.com/fastiron/08.0.70/fastiron-08070-securityguide/GUID-E82574D9-45DD-4845...

http://docs.ruckuswireless.com/fastiron/08.0.70/fastiron-08070-securityguide/GUID-5F3FA3B6-93F2-4D24... 

[mielch_qwerty]

Thanks to r/Brocade on reddit i have found an explanation.
There is routing code on ICX and ve interface is like a subinterface on a cisco router other than an interface vlan on a cisco switch. Thats why the ACL behavior on VE is so.