S5024PV2-EI的QOS MQC功能匹配问题

我手边有一台S5024PV2-EI，在使用MQC进行global inbound过滤时，S5024PV2-EI对ACL匹配上有问题，配置如下：

acl number 3000 name fw_deny match-order auto

 rule 10 deny ip 

acl number 3100 name fw_permit match-order auto

 rule 15 permit tcp destination 192.168.200.200 0 destination-port eq 8080

 rule 10 permit tcp destination 192.168.200.200 0 destination-port eq 8090

 rule 20 permit icmp destination 10.149.32.254 0

 rule 21 permit icmp destination 10.149.33.254 0

 rule 22 permit icmp destination 10.149.34.254 0

 rule 23 permit icmp destination 10.149.35.254 0

 rule 24 permit icmp destination 10.149.36.254 0

 rule 25 permit icmp destination 10.149.45.254 0

 rule 26 permit icmp destination 10.149.41.254 0

 rule 27 permit icmp destination 10.149.42.254 0

 rule 28 permit icmp destination 10.149.43.254 0

 rule 29 permit icmp destination 10.149.44.254 0

 rule 30 permit icmp destination 10.149.47.254 0

 rule 31 permit icmp destination 10.149.48.254 0

 rule 32 permit icmp destination 192.168.200.254 0

 rule 33 permit icmp destination 10.149.105.254 0

 rule 34 permit icmp destination 10.149.106.254 0

 rule 35 permit icmp destination 10.149.111.254 0

 rule 36 permit icmp destination 10.149.112.254 0

 rule 37 permit icmp destination 10.149.38.254 0

 rule 38 permit icmp destination 10.149.108.254 0

traffic classifier 3100 operator and

 if-match acl 3100 

traffic classifier 3000 operator and

 if-match acl 3000

traffic behavior 0

 filter deny 

traffic behavior 1

 filter permit

qos policy Q_FW

 classifier 3100 behavior 1

 classifier 3000 behavior 0

qos apply policy Q_FW global inbound

需求为先permit需要的acl 3100的地址，再deny掉acl 3000上所有地址，但是在S5024PV2-EI上该配置不能正常运行，直接就deny掉所有地址了，这个需求如何配置？