Applying a VPP ACL to a physical VPP-managed Ethernet interface works as expected, but applying the same ACL to an Ethernet subinterface such as eth1.200 fails during commit.

Example:
set vpp acl ip interface eth1.200 input acl-tag 10 tag-name STATEFUL
commit

Current behavior:

• VyOS rejects the configuration with: eth1.200 must be a VPP interface for ACL interface
• However, applying the ACL directly in VPP works, which shows the issue is in VyOS config validation/dependency handling rather than in VPP itself.

Root cause:

• vpp_acl validated interfaces using cli_ifaces_list(), which includes base VPP interfaces but does not include Ethernet VIF/subinterfaces like ethX.<vlan>.
• Simply relaxing validation is not enough, because ACLs also need to be reapplied when a VLAN subinterface is removed and created again. Otherwise the config remains present in VyOS, but the ACL is no longer attached in VPP runtime.

Fix:

• Extend ACL interface validation to include Ethernet VIF/subinterfaces by using cli_ethernet_with_vifs_ifaces() together with the regular VPP interface list.
• Add a dependency from interfaces_ethernet to vpp_acl so that changes to vif / vif-s on VPP-managed Ethernet interfaces trigger ACL reapplication.
• This ensures both:
  • ACL commit succeeds for subinterfaces like eth1.200
  • ACLs are restored correctly after subinterface recreation

Result:

• VPP ACLs can now be assigned to Ethernet subinterfaces from VyOS CLI.
• ACL configuration remains consistent after VLAN/subinterface changes.