Host Unreachable vs Communication Administratively Prohibited in ACL Ping Response

aclciscogns3pingrouter

Below is a portion of my topology.

enter image description here

Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this should be done using access lists. So I did some research on Access Lists and concluded that this should be the access-list:

Router02(config)#do show access-lists
Extended IP access list 100
10 deny icmp 123.45.0.0 0.0.3.255 123.45.8.0 0.0.1.255 echo (15 matches)
20 deny icmp 123.45.0.0 0.0.3.255 123.45.10.0 0.0.1.255 echo (15 matches)
30 permit icmp any any (5 matches)
40 permit ip any any

I applied it on interface f2/0

interface FastEthernet2/0
 ip address 123.45.0.1 255.255.252.0
 ip access-group 100 in
 duplex auto
 speed auto

Before implementing this ACL, both PCs could ping each other successfully. After, only the staff could successfully ping the student subnet. This is the reply when the student PC pings the staff PC:

FAS1> ping 123.45.8.2
*123.45.0.1 icmp_seq=1 ttl=255 time=18.989 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=2 ttl=255 time=3.011 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=3 ttl=255 time=6.896 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=4 ttl=255 time=6.123 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=5 ttl=255 time=13.003 ms (ICMP type:3, code:13, 
Communication administratively prohibited)

It's saying "Communication administratively prohibited". I know this is a silly question because it's obviously not pinging, but I just want to be sure. Every example that I've seen, the reply is "host is unreachable" not what I'm getting. Are they the same thing? And is my Access List correct?

Any help would be appreciated. Thanks.

Best Answer

Practically it's the same. The router isn't silently dropping the packets but returning an ICMP error message 3/13, informing the sender that the packet has been filtered.

Users often don't care why a destination isn't reachable but when you're debugging your own network the distinction might make a valuable difference.

The access list looks OK, though you shouldn't need line 30. Line 40 picks up anything undefined already.

Related Topic