The ACL isolation policy configured for a VLAN does not take effect

Hi, community!

acl number 3000

 rule 10 permit ip source 172.18.0.0 0.0.0.255 destination 172.16.21.0 0.0.0.255

 rule 20 deny ip

#

traffic classifier xx type or

 if-match acl 3000

#

traffic behavior xx

 deny

#

traffic policy xx

 classifier xx behavior xx precedence 5

interface Vlanif1870

 ip address 172.18.0.254 255.255.255.0

 traffic-policy xx inbound 

It is required to realize that only the 172.16.21.0/24 network segment can access the 172.18.0.0/24 network segment, but after configuration, other network segments can still access 172.18.0.254? How to solve.

Thanks!