請問各位大大，需求是想要禁止WIFI連各VLAN，但要能上網，wifi沒有設定ACL的情況下可正常上網、連通所有VLAN。

架構是
Internet>>>firewall(192.168.1.254)>>>HP5510(192.168.1.253)>>>wifi WAN port (192.168.7.1)。

以下是我失敗測試的指令
acl number 3015 name wifi-test
step 1
rule 0 permit ip source 192.168.7.0 0.0.0.255 destination 192.168.1.254 0
rule 1 permit ip source 192.168.1.254 0 destination 192.168.7.0 0.0.0.255
rule 2 permit ip source 192.168.1.253 0 destination 192.168.7.0 0.0.0.255
rule 3 permit ip source 192.168.7.0 0.0.0.255 destination 192.168.1.253 0

acl number 3016
step 1
rule 0 deny ip source 192.168.7.0 0.0.0.255 any
rule 1 deny ip source any destination 192.168.7.0 0.0.0.255

traffic classifier permitwifitest

if-match acl 3015

traffic classifier denywifitest

if-match acl 3016

traffic behavior permitwifitest
filter permit

traffic behavior denywifitest
filter deny

qos policy 13
classifier permitwifitest behavior permitwifitest
classifier denywifitest behavior denywifitest

qos vlan-policy 13 vlan 7 inbound

結果是ping的到192.168.1.254、253，但無法上網
請問各位大大qos policy 13是哪裡設定有問題?

另外有成功的指令
acl number 3003 name wifi-internet
rule 5 deny ip source 192.168.7.0 0.0.0.255 destination 192.168.21.0 0.0.0.255
rule 15 deny ip source 192.168.21.0 0.0.0.255 destination 192.168.7.0 0.0.0.255
rule 20 deny ip source 192.168.7.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
rule 25 deny ip source 192.168.7.0 0.0.0.255 destination 192.168.22.0 0.0.0.255
rule 30 deny ip source 192.168.7.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

acl number 3101
rule 0 permit ip source 192.168.7.0 0.0.0.255 destination 192.168.1.254 0
rule 1 permit ip source 192.168.1.254 0 destination 192.168.7.0 0.0.0.255

qos policy 11
classifier permitwifi behavior permitwifi
classifier deny3003 behavior deny3003

qos vlan-policy 11 vlan 7 inbound

執行結果符合我的需求
請大大qos policy 11 與qos policy 13差在哪裡?

謝謝