2

Below is a portion of my topology.

enter image description here

Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this should be done using access lists. So I did some research on Access Lists and concluded that this should be the access-list:

Router02(config)#do show access-lists
Extended IP access list 100
10 deny icmp 123.45.0.0 0.0.3.255 123.45.8.0 0.0.1.255 echo (15 matches)
20 deny icmp 123.45.0.0 0.0.3.255 123.45.10.0 0.0.1.255 echo (15 matches)
30 permit icmp any any (5 matches)
40 permit ip any any

I applied it on interface f2/0

interface FastEthernet2/0
 ip address 123.45.0.1 255.255.252.0
 ip access-group 100 in
 duplex auto
 speed auto

Before implementing this ACL, both PCs could ping each other successfully. After, only the staff could successfully ping the student subnet. This is the reply when the student PC pings the staff PC:

FAS1> ping 123.45.8.2
*123.45.0.1 icmp_seq=1 ttl=255 time=18.989 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=2 ttl=255 time=3.011 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=3 ttl=255 time=6.896 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=4 ttl=255 time=6.123 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=5 ttl=255 time=13.003 ms (ICMP type:3, code:13, 
Communication administratively prohibited)

It's saying "Communication administratively prohibited". I know this is a silly question because it's obviously not pinging, but I just want to be sure. Every example that I've seen, the reply is "host is unreachable" not what I'm getting. Are they the same thing? And is my Access List correct?

Any help would be appreciated. Thanks.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 10:16
4

Practically it's the same. The router isn't silently dropping the packets but returning an ICMP error message 3/13, informing the sender that the packet has been filtered.

Users often don't care why a destination isn't reachable but when you're debugging your own network the distinction might make a valuable difference.

The access list looks OK, though you shouldn't need line 30. Line 40 picks up anything undefined already.

  • 4
    I'll just add the comment that in contrived scenarios like this may be fine as an exercise, but in real life, it's unlikely you would block pings but allow all other traffic. – Ron Trunk Dec 24 '18 at 13:17
  • How to avoid this behavior? I don't want my router to give information regarding what is blocked. – Alexis_FR_JP May 21 at 4:43
  • Depending on the device, you could suppress those messages, e.g. ipv4 unreachable disable – Zac67 May 22 at 17:07
2

When a packet is sent to a router which can't forward it, that router sends an ICMP "Destination Unreachable" message to the originator, which contains a reason for the non-forwarding. (Be aware that many routers on the public internet have ICMP disabled in various ways, and some will not tell you anything about packets they discard.)

The original codes were defined in RFC 777 ICMP but more were defined in RFC 1812 Host Requirements, including reason 13 "Administratively Prohibited".

If you get any variety of ICMP destination unreachable, it means the far router is telling you it didn't forward the packet, and the code inside is just intended to help you understand why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.