а я, тем временем, врубил фары и прочёл в вике сие:
Note: Make sure you have added all needed interfaces to the VLAN table when using secure vlan-mode. For routing functions to work properly on the same device through ports that use secure vlan-mode, you will need to allow access to the CPU from those ports, this can be done by adding the switchX-cpu interface itself to the VLAN table.
Ну, об этом Вам и говорили.