Hi,
That would be possible, but it requires a bit of reverse thinking.
Since you need 2 actions in the qos policy (filter permit and deny), you will need 2 classifiers:
1 for the traffic you want to permit
1 for the traffic you want to deny
So you must create 2 ACLs. Each of these must have PERMIT rules, so they will SELECT the traffic of the ACL, then the ACL can be linked to the classifier1 and 2.
You would create 2 behaviors:
1 for the behavior filert permit
1 for the behavior filter deny
These can be combined in the qos policy:
qos policy x
classifier x behavior deny-behaviorname
classifier y behavior permit-behaviorname
So the answer is yes, it can be done, my preferred answer would be to update the firmware and just use the packet filter command, which is way more straight-forward than this qos workaround ...
Hope this helps ...