@JTerk With great support from TP-Link, this issue is solve. All I needed was another rule after RULE1 that allows traffic from any address to the GROUP1, i.e. RULE1 should be bidirectional.

@Virgo I have the latest software install on the switch and the controller. The latest release include the time bases ACL functionality. As such, RULE2 and RULE3 work correctly, permit during the...

Hardware: ER605 v2.0 Firmware: 2.0.1 Build 20220223 Rel.68551 Hardware: TL-SG2210P v3.20 Firmware: 3.20.6 Build 20221019 Rel.46702 Hardware: OC200 2.0 Controller Version: 5.6.4 Firmware: 2.6.1 Build...