Is "Host unreachable" the same as "Communication administratively prohibited" in Access List ping response?

Question

Below is a portion of my topology.

Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this should be done using access lists. So I did some research on Access Lists and concluded that this should be the access-list:

Router02(config)#do show access-lists
Extended IP access list 100
10 deny icmp 123.45.0.0 0.0.3.255 123.45.8.0 0.0.1.255 echo (15 matches)
20 deny icmp 123.45.0.0 0.0.3.255 123.45.10.0 0.0.1.255 echo (15 matches)
30 permit icmp any any (5 matches)
40 permit ip any any

I applied it on interface f2/0

interface FastEthernet2/0
 ip address 123.45.0.1 255.255.252.0
 ip access-group 100 in
 duplex auto
 speed auto

Before implementing this ACL, both PCs could ping each other successfully. After, only the staff could successfully ping the student subnet. This is the reply when the student PC pings the staff PC:

FAS1> ping 123.45.8.2
*123.45.0.1 icmp_seq=1 ttl=255 time=18.989 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=2 ttl=255 time=3.011 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=3 ttl=255 time=6.896 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=4 ttl=255 time=6.123 ms (ICMP type:3, code:13, 
Communication administratively prohibited)
*123.45.0.1 icmp_seq=5 ttl=255 time=13.003 ms (ICMP type:3, code:13, 
Communication administratively prohibited)

It's saying "Communication administratively prohibited". I know this is a silly question because it's obviously not pinging, but I just want to be sure. Every example that I've seen, the reply is "host is unreachable" not what I'm getting. Are they the same thing? And is my Access List correct?

Any help would be appreciated. Thanks.

Answer 1

Practically it's the same. The router isn't silently dropping the packets but returning an ICMP error message 3/13, informing the sender that the packet has been filtered.

Users often don't care why a destination isn't reachable but when you're debugging your own network the distinction might make a valuable difference.

The access list looks OK, though you shouldn't need line 30. Line 40 picks up anything undefined already.

Answer 2

When a packet is sent to a router which can't forward it, that router sends an ICMP "Destination Unreachable" message to the originator, which contains a reason for the non-forwarding. (Be aware that many routers on the public internet have ICMP disabled in various ways, and some will not tell you anything about packets they discard.)

The original codes were defined in RFC 777 ICMP but more were defined in RFC 1812 Host Requirements, including reason 13 "Administratively Prohibited".

If you get any variety of ICMP destination unreachable, it means the far router is telling you it didn't forward the packet, and the code inside is just intended to help you understand why.