A L2 sub-interface is a logical bridging endpoint associated with traffic on an interface distinguished by 802.1Q tags, where each <interface, 802.1Q tag> tuple is treated as a first-class bridging interface. 

When configuring or modifying a RACL applied to a VLAN interface, the VLAN will be blocked while applying the updated