一桁まちがえてるし・・
こっちのほうがいいですかね？

ip lan1 address 192.168.1.xxx/24
ip lan3 address 192.168.3.xxx/24

ip filter 200099 pass * * * * *

ip filter 200111 reject *.*.*.* 192.168.1.0/24
ip filter 200113 reject *.*.*.* 192.168.3.0/24

ip lan1 secure filter in 200113 200099

ip lan3 secure filter in 200111 200099