Check for dyn. NAT to interface with need_protect

This prevents internal error "Unexpected $obj->{name} with dynamic NAT"
when generating ACL to protect own interface
Adapted test to change ca66caa4.
Again fixed wrong error with 3 or more virt. intf.
Use name of aggregate 0/0, instead zone in warning
Better tests and error msg. for virtual intf.
Crosslinked routers with different filter strenght

If devices with different filter strenght are linked together by
crosslink network, then omit filter only at crosslink interface of
weakest device.

Example:
If 'managed=standard' and 'managed=secondary', then omit ACL only at
crosslink interface of 'secondary' device.