Prohibited Unreachable ICMP Failing

Answered Question
Feb 2nd, 2010
User Badges:

Information and symptoms:

IOS code 12.2.33SHX3

Pings intermittently failing

No ACLs anywhere in the path.

Errors from debugs:

Feb  1 23:34:02.562 cst: ICMP: dst (165.68.17.3) prohibited unreachable rcv from 165.68.17.104


Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: route packet from (local) src 165.68.33.3 dst 165.68.17.104
Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: packet routing succeeded
Feb  2 12:16:30.371 cst: IP: tableid=0, s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), routed via FIB
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, output feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, Post-Ingress-NetFlow(49), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, MTU Processing(4), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Protocol Output Counter(5), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Sendself Check(8), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, HW Shortcut Installation(15), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending full packet
Feb  2 12:16:30.375 cst:     ICMP type=8, code=0
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, input feature
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10, Ingress-NetFlow(14), rtype 0, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: route packet from Vlan17 src 165.68.17.104 dst 165.68.33.3
Feb  2 12:16:30.375 cst: FIBfwd-proc: Default:165.68.33.3/32 receive entry
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: packet routing failed
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, rcvd 2
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, stop process pak for forus packet
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10



Pings from VLAN 17 on access switch to VLAN 113 on another access switch do not receive reply.  Anywhere else is fine.

Pings to VLAN 17 from directly connected distribution switch located physical in between the access switches, sourced from VLAN 17 work fine.

It seems that the IMCP messages are being lost in the distribution somewhere.


I am completely lost!!!  HELP!!!!

Correct Answer by Ganesh Hariharan about 7 years 2 months ago

Information and symptoms:

IOS code 12.2.33SHX3

Pings intermittently failing

No ACLs anywhere in the path.

Errors from debugs:

Feb  1 23:34:02.562 cst: ICMP: dst (165.68.17.3) prohibited unreachable rcv from 165.68.17.104


Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: route packet from (local) src 165.68.33.3 dst 165.68.17.104
Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: packet routing succeeded
Feb  2 12:16:30.371 cst: IP: tableid=0, s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), routed via FIB
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, output feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, Post-Ingress-NetFlow(49), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, MTU Processing(4), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Protocol Output Counter(5), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Sendself Check(8), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, HW Shortcut Installation(15), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending full packet
Feb  2 12:16:30.375 cst:     ICMP type=8, code=0
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, input feature
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10, Ingress-NetFlow(14), rtype 0, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: route packet from Vlan17 src 165.68.17.104 dst 165.68.33.3
Feb  2 12:16:30.375 cst: FIBfwd-proc: Default:165.68.33.3/32 receive entry
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: packet routing failed
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, rcvd 2
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, stop process pak for forus packet
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10



Pings from VLAN 17 on access switch to VLAN 113 on another access switch do not receive reply.  Anywhere else is fine.

Pings to VLAN 17 from directly connected distribution switch located physical in between the access switches, sourced from VLAN 17 work fine.

It seems that the IMCP messages are being lost in the distribution somewhere.


I am completely lost!!!  HELP!!!!

Hi,


ICMP Type= 3 says  Destination Unreachable and code = 10 means Communication with Destination Host is               Administratively Prohibited



and the error genrally means  that the destination system is configured to reject datagrams from the sending system. This error is generally used when firewall restrictions or other security measures are filtering datagrams based on some sort of criteria. This message effectively says, “The destination may be up and running, but it will not get the datagrams that you’re sending. Stop sending them.”


Hope that help


If helpful do rate


Ganesh.H

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Ganesh Hariharan Tue, 02/02/2010 - 23:18
User Badges:
  • Purple, 4500 points or more
  • Community Spotlight Award,

    Member's Choice, February 2016


Information and symptoms:

IOS code 12.2.33SHX3

Pings intermittently failing

No ACLs anywhere in the path.

Errors from debugs:

Feb  1 23:34:02.562 cst: ICMP: dst (165.68.17.3) prohibited unreachable rcv from 165.68.17.104


Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: route packet from (local) src 165.68.33.3 dst 165.68.17.104
Feb  2 12:16:30.371 cst: FIBipv4-packet-proc: packet routing succeeded
Feb  2 12:16:30.371 cst: IP: tableid=0, s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), routed via FIB
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, output feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, Post-Ingress-NetFlow(49), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, MTU Processing(4), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Protocol Output Counter(5), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, IP Sendself Check(8), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.371 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, post-encap feature
Feb  2 12:16:30.371 cst:     ICMP type=8, code=0, HW Shortcut Installation(15), rtype 1, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: IP: s=165.68.33.3 (local), d=165.68.17.104 (Vlan17), len 100, sending full packet
Feb  2 12:16:30.375 cst:     ICMP type=8, code=0
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, input feature
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10, Ingress-NetFlow(14), rtype 0, forus FALSE, sendself FALSE, mtu 0
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: route packet from Vlan17 src 165.68.17.104 dst 165.68.33.3
Feb  2 12:16:30.375 cst: FIBfwd-proc: Default:165.68.33.3/32 receive entry
Feb  2 12:16:30.375 cst: FIBipv4-packet-proc: packet routing failed
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, rcvd 2
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10
Feb  2 12:16:30.375 cst: IP: s=165.68.17.104 (Vlan17), d=165.68.33.3, len 128, stop process pak for forus packet
Feb  2 12:16:30.375 cst:     ICMP type=3, code=10



Pings from VLAN 17 on access switch to VLAN 113 on another access switch do not receive reply.  Anywhere else is fine.

Pings to VLAN 17 from directly connected distribution switch located physical in between the access switches, sourced from VLAN 17 work fine.

It seems that the IMCP messages are being lost in the distribution somewhere.


I am completely lost!!!  HELP!!!!

Hi,


ICMP Type= 3 says  Destination Unreachable and code = 10 means Communication with Destination Host is               Administratively Prohibited



and the error genrally means  that the destination system is configured to reject datagrams from the sending system. This error is generally used when firewall restrictions or other security measures are filtering datagrams based on some sort of criteria. This message effectively says, “The destination may be up and running, but it will not get the datagrams that you’re sending. Stop sending them.”


Hope that help


If helpful do rate


Ganesh.H

Michael Mistretta Wed, 02/03/2010 - 19:02
User Badges:

Hi Ganesh,


Thanks for the reply.  You are correct, i was thinking that there may be something going on here that was different than the norm.  This ping was sent to a Linux box, and where I am used to seeing responses, followed by sporadic drops, this machine was sending unreachables, which is different that what I am used to seeing.  I am not used to seeing a machine responding that itself is unreachable, which i found to be odd.

We are actually experiencing a problem with this Linuz device not being able to route to a specific vlan, and are unable to find any information as to why, packets seem to be disappearing and we were hoping that this debug would help point us in the right direction... back to the drawing board.


Thanks again,


Mike

Actions

This Discussion