Hi Pourang
"I just don't know what they exactly mean by"always link via SU24""
I mean drive all the security role build via role menu so it inherit SU24. It sounds like you have then test that already.
As you are on 10.1 your screens do look a little different to my notes. I do recall when I prototyped the derived roles that I had challenges with selecting the Org Map and actually incorporating it in the NWBC steps. It seemed I had an additional selection step to copy it over. However, your final step implies you were successful
Whilst waiting on SAP support you could try tracing it or debugging (if you have a developer available). As it's 10.1 recent SP it might be a bug
It'd be great if you could update us with the solution once you obtain assistance from SAP 
May SAP_ALL be with you allways --NOOOO... May appropriately resricted security always be with us... I admit not quite the same ring to it 
Good luck
Regards
Colleen