大家一块来分析一个配置，关于网段隔离的，使用了traffic classifier

如图所示，三个网段，我想在核心交换机上，限制vlan1访问vlan2，配置如下，但是配置完成之后，1.1.1.2还是能盘ping通1.1.2.2，哪位高手能看下，是哪里的配置出问题了，谢谢

#

vlan 1

#

vlan 2 to 3

#

traffic classifier c1 operator and

 if-match acl 3000

#             

traffic behavior b1

 filter deny  

#             

qos policy p1 

 classifier c1 behavior b1

#             

 stp global enable

#             

dhcp server ip-pool 1

 gateway-list 1.1.1.1

 network 1.1.1.0 mask 255.255.255.0

#             

dhcp server ip-pool 2

 gateway-list 1.1.2.1

 network 1.1.2.0 mask 255.255.255.0

#             

dhcp server ip-pool 3

 gateway-list 1.1.3.1

 network 1.1.3.0 mask 255.255.255.0

#             

interface NULL0

#             

interface Vlan-interface1

 ip address 1.1.1.1 255.255.255.0

#             

interface Vlan-interface2

 ip address 1.1.2.1 255.255.255.0

 packet-filter 3000 inbound

#             

interface Vlan-interface3

 ip address 1.1.3.1 255.255.255.0

#             

 qos vlan-policy p1 vlan 2 inbound

 qos vlan-policy p1 vlan 2 outbound

#             

acl advanced 3000

 rule 5 deny ip source 1.1.1.0 0.0.0.255 destination 1.1.2.0 0.0.0.255

#              

radius scheme system

 user-name-format without-domain

#             

domain name system

#