Firewall Software Offload? That is an experimental feature that is not enabled by default and is broken with MVEBU devices with the latest builds.