Summary: ======= ACL Drop rule configured on L2 vlan. Post reboot it doesnt work, and need to unbind/bind the acl to make it work. Detailed description: ==================== root@sonic:~# root@sonic:~# root@sonic:~# cat ing_acl.json { "ACL_TABLE": { "acl_table_001": { "policy_desc": "acl_table_for_tc_001", "type": "L3", "stage": "ingress", "ports": ["Vlan25"] } }, "ACL_RULE": { "acl_table_001|acl_rule_001": { "PRIORITY": 1, "PACKET_ACTION": "DROP", "SRC_IP": "10.1.1.5", "L4_SRC_PORT": "1100" } } } root@sonic:~# root@sonic:~# root@sonic:~# show vlan brief +-----------+--------------+----------------+----------------+-------------+-----------------------+ | VLAN ID | IP Address | Ports | Port Tagging | Proxy ARP | DHCP Helper Address | +===========+==============+================+================+=============+=======================+ | 25 | 10.1.1.1/24 | Ethernet112 | tagged | disabled | | | | | PortChannel255 | tagged | | | +-----------+--------------+----------------+----------------+-------------+-----------------------+ root@sonic:~# root@sonic:~# config load ing_acl.json -y Running command: /usr/local/bin/sonic-cfggen -j ing_acl.json --write-to-db root@sonic:~# show acl table Name Type Binding Description Stage ------------- ------ --------- -------------------- ------- acl_table_001 L3 Vlan25 acl_table_for_tc_001 ingress root@sonic:~# show acl rule Table Rule Priority Action Match ------------- ------------ ---------- -------- ----------------- acl_table_001 acl_rule_001 1 DROP L4_SRC_PORT: 1100 SRC_IP: 10.1.1.5 Traffic is dropped correctly, but post save/reboot, traffic still goes through. Need to unbind/bind the acl again to make the traffic drop again. #config save -y #reboot <==================================================================================> Workaround to make it work(Remove the acl and install again) root@sonic:~# cat clear_acl.json { "ACL_TABLE": { }, "ACL_RULE": { } } root@sonic:~# config load clear_acl.json -y Running command: /usr/local/bin/sonic-cfggen -j clear_acl.json --write-to-db root@sonic:~# show acl table Name Type Binding Description Stage ------ ------ --------- ------------- ------- root@sonic:~# show acl rule Table Rule Priority Action Match ------- ------ ---------- -------- ------- root@sonic:~# config load ing_acl.json -y Running command: /usr/local/bin/sonic-cfggen -j ing_acl.json --write-to-db root@sonic:~# show acl rule Table Rule Priority Action Match ------------- ------------ ---------- -------- ----------------- acl_table_001 acl_rule_001 1 DROP L4_SRC_PORT: 1100 SRC_IP: 10.1.1.5 root@sonic:~# show acl table Name Type Binding Description Stage ------------- ------ --------- -------------------- ------- acl_table_001 L3 Vlan25 acl_table_for_tc_001 ingress===> Now, traffic is dropped root@sonic:~# ==========> Now traffic is dropped as expected