@chrisro I suspected something like that but still wasn't sure. Just thought that SDN is smart enough to figure that out by itself. Thanks a lot for advice. Have reworked my ACLs on the switch side...

@chrisro how have you managed to combine gateway and switch ACLs. I have blocked intervlan communication on the switch level and adding ACL for existing state for intervlan communication doesn't...