Creating an admin prohibited message is straightforward.
From our Globomantics client with IP address 10.1.4.4,
we originated a TCP message destined to port 80.
The ACL will interpret this as HTTP web traffic.
Since HTTP is not allowed across the ACL, the router has two choices.
It could silently discard the packet without notifying the sender.
This occurs when the origination of ICMP unreachables
is disabled on the firewall device.
In our example, I enabled ICMP unreachable origination,
which is why the device sent back an ICMP admin prohibited message.
We don't care much about the TCP packet, other than it has
a destination port of 80, which is blocked by the ACL, so
we won't dig into it. Instead, let's drill into the ICMP unreachable.
First, notice the source address is 10.1.3.3, which is R3,
our Globomantics stateless firewall.
Like all ICMP packets,
it carries a type and code, the type of 3, which refers to a generic
destination unreachable message, and the code is 13, which implies that the
packet was denied by some filter in the network.
Almost any device can have some kind of firewall configuration on it,
which means almost any device could originate this message.
Think about Linux with IP tables or firewalld or perhaps the
built‑in Windows Firewall. like the other ICMP unreachables we have
seen, this packet encapsulates the offending packet that was denied,
allowing the sender to marry up the unreachable with the packet that
caused the unreachable. This can save network operators a significant amount of troubleshooting time.