Is it possible to assign an IP to a tagged dual-mode port (Brocade)

Question

I have a router (ubiquity USG) and a Brocade FCX648 Layer 3 switch. (I have a second one in a stack, but that's unrelated). The end goal is to be able to connect the switch to my router, provide IPs to other ports on the VLAN, and be able to manage the switch, all from one physical port.

I've connected the router to the switch via eth 1/1/2 and set up VLAN 2 spanning all ports as untagged except 1/1/2 which is dual-mode. Then VLAN 3 for just 1/1/2, which is tagged. This, to my understanding, lets it work as tagged and untagged.

When this port is untagged only, it gets assigned an IP address, and from that IP, I can access SSH, the web portal, etc. However, when tagged (which I need, so the other ports can get IPs from the router), it is no longer assigned an IP, and when trying to manually assign one the interface says you cannot assign an IP to a tagged port.

I feel like I'm probably going about this the wrong way, so I wanted to ask for advice on how to do this, or if such a thing on one cable is even possible.

Config dump:

!
ver 08.0.30sT7f3
!
stack unit 1
  module 1 fcx-48-4x-port-management-module
  module 2 fcx-sfp-plus-4-port-10g-module
  priority 128
  stack-port 1/2/1 1/2/2
stack unit 2
  module 1 fcx-48-4x-port-management-module
  module 2 fcx-sfp-plus-4-port-10g-module
  stack-port 2/2/1 2/2/2
stack enable
stack mac 748e.f89a.af80
!
!
!
!
vlan 1 name DEFAULT-VLAN by port
!
vlan 2 name KTN by port
 tagged ethe 1/1/2
 untagged ethe 1/1/3 to 1/1/48 ethe 2/1/1 to 2/1/48
!
vlan 3 name KTN-Tagged by port
 tagged ethe 1/1/2
!
vlan 4 by port
!
!
!
!
!
aaa authentication web-server default local
aaa authentication login default local
boot sys fl sec
enable super-user-password .....
enable port-config-password .....
enable read-only-password .....
ip dhcp-server server-identifier 192.168.1.1
ip dns domain-list localdomain
ip dns server-address 192.168.1.1
ip forward-protocol udp bootpc
ip forward-protocol udp bootps
ip forward-protocol udp 1
ip router-id 192.168.1.1
!
username netadmin password .....
bootp-relay-max-hops 10
!
!
web-management https
ssh access-group 10
hitless-failover enable
!
!
!
!
!
!
!
interface ethernet 1/1/1
 ip address 192.168.1.129 255.255.255.0 dynamic
 ip bootp-gateway 192.168.1.1
!
interface ethernet 1/1/2
 dual-mode  2
 ip helper-address 1 192.168.1.1 unicast
!
!
!
access-list 10 permit host 192.168.1.128
access-list 10 permit 192.168.1.0 0.0.0.255
!
!
!
!
!
!
!
!
local-userdb userdb1
 username name password pass
!
end

If more info is needed, I'll be happy to provide it.

Answer 1

This is a mix of L2 and L3 ports. Consider L2 and L3 as a different schematic diagrams.

When you place IP on 1/1/2 - you attach this IP to native (untagged) VLAN going through this port. To have an IP attached to vlan2 or vlan3 you should place IP not on hardware interface (which can carry many VLANs) but on virtual VLAN interface.

Try this:

device(config)# vlan 2
device(config-vlan-2)#  tagged ethe 1/1/2
device(config-vlan-2)# router-interface ve 1
device(config-vlan-2)# interface ve 1
device(config-vif-1)# ip address 10.1.2.1/24

This is the document. But be aware of routing - L3 switch is capable of routing (and this is the most benefit of it), so you may want to prevent routing between interfaces.