Outbound initiated connections are allowed back in because that port is listening for the return of the request.  The router identifies that as a valid communication as it is started from within the firewall.  It is just like the default router you h...

Found the solution. Add all the layer 3 addresses to route but the do not work until you have a active trunk port or you activate a port to that VLAN.

To be clear to do the most basic L3 routing of inter-VLAN routing on a VLAN Interface you have to purchase the DNA Advantage? "Network advantage license need to be bought for Layer 3 routing."