Just tried that and same results. The devices can be pinged from the router but can't ping from devices across other VLAN. There is no firewall settings between the VLANs
switch switch0 { address 10.249.16.1/24 description Local ip { } mtu 1500 switch-port { interface eth2 { vlan { pvid 1 } } interface eth3 { vlan { vid 11 pvid 1 } } interface eth4 { vlan { pvid 1 } } vlan-aware enable } vif 11 { address 10.249.17.1/24 description "Security VLAN" ip { } } }