If using different acls for different ingress ports and a 2 tuple acl is added, it will get expired from some of the ports. If more traffic is seen (due to differing load balancing) add_acl will ignore it since it already exists. add_acl should check to see if it is missing on any of the ports and re-add it.