vlan rules for MU