Below is a portion of my topology.
Faculty of Arts student subnet should not be able to ping Faculty of Arts staff subnet but the staff should be able to ping the student subnet. I know that this should be done using access lists. So I did some research on Access Lists and concluded that this should be the access-list:
Router02(config)#do show access-lists
Extended IP access list 100
10 deny icmp 123.45.0.0 0.0.3.255 123.45.8.0 0.0.1.255 echo (15 matches)
20 deny icmp 123.45.0.0 0.0.3.255 123.45.10.0 0.0.1.255 echo (15 matches)
30 permit icmp any any (5 matches)
40 permit ip any any
I applied it on interface f2/0
interface FastEthernet2/0
ip address 123.45.0.1 255.255.252.0
ip access-group 100 in
duplex auto
speed auto
Before implementing this ACL, both PCs could ping each other successfully. After, only the staff could successfully ping the student subnet. This is the reply when the student PC pings the staff PC:
FAS1> ping 123.45.8.2
*123.45.0.1 icmp_seq=1 ttl=255 time=18.989 ms (ICMP type:3, code:13,
Communication administratively prohibited)
*123.45.0.1 icmp_seq=2 ttl=255 time=3.011 ms (ICMP type:3, code:13,
Communication administratively prohibited)
*123.45.0.1 icmp_seq=3 ttl=255 time=6.896 ms (ICMP type:3, code:13,
Communication administratively prohibited)
*123.45.0.1 icmp_seq=4 ttl=255 time=6.123 ms (ICMP type:3, code:13,
Communication administratively prohibited)
*123.45.0.1 icmp_seq=5 ttl=255 time=13.003 ms (ICMP type:3, code:13,
Communication administratively prohibited)
It's saying "Communication administratively prohibited". I know this is a silly question because it's obviously not pinging, but I just want to be sure. Every example that I've seen, the reply is "host is unreachable" not what I'm getting. Are they the same thing? And is my Access List correct?
Any help would be appreciated. Thanks.