Description

This article describes an issue in which an error message of "IP unreachable" is returned.

Symptoms

ICMP message type 3 is an "unreachable" message. Within this message type are a number of codes which define various types of messages. This table is from IANA and shows the various types:

3 Destination Unreachable [RFC792]

Codes:

0 Net Unreachable [RFC792]
1 Host Unreachable [RFC792]
2 Protocol Unreachable [RFC792]
3 Port Unreachable [RFC792]
4 Fragmentation Needed and Don't [RFC792]
Fragment was Set [RFC792]
5 Source Route Failed [RFC792]
6 Destination Network Unknown [RFC1122]
7 Destination Host Unknown [RFC1122]
8 Source Host Isolated [RFC1122]
9 Communication with Destination [RFC1122]
Network is Administratively Prohibited
10 Communication with Destination Host is [RFC1122]
Administratively Prohibited
11 Destination Network Unreachable for Type [RFC1122]
of Service
12 Destination Host Unreachable for Type of [RFC1122]
Service
13 Communication Administratively Prohibited [RFC1812]
14 Host Precedence Violation [RFC1812]
15 Precedence cutoff in effect [RFC1812]

In Cisco implementation, no ip unreachable is a  command that is enabled by default on an interface.

Solution

There is no knob available on Junos for "no ip unreachables".

By default when route lookups fail, ICMP packets are sent to the source. These packets are ICMP TypeDestination Unreachable (3) and ICMP Code=Network Unreachable (0). Following is an example:

 
Typology:

R1-----R2

Where:

  • R1 has a static route for destination 10.10.10.10 with the next-hop of R2. 
  • R2 does not have the route to 10.10.10.10 in its routing table.
When R1 tries to reach destination 10.10.10.10, R2 responds with ICMP TypeDestination Unreachable(3) and ICMP Code=Network Unreachable(0).
 
[edit]
lab@R1# run show interfaces terse ge-0/0/2.0

Interface Admin Link Proto Local Remote
ge-0/0/2.0 up up inet 100.1.1.2/24
mpls
multiservice

[edit]
lab@R1#

[edit]
lab@R1# run show route 10.10.10.10

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.10.10.10/32 *[Static/5] 00:06:34
> to 100.1.1.1 via ge-0/0/2.0

[edit]
lab@R1#

{MASTER}[edit]
lab@R2# run show interfaces terse ge-4/1/0.0
Interface Admin Link Proto Local Remote
ge-4/1/0.0 up up inet 100.1.1.1/24
mpls
multiservice

{MASTER}[edit]
lab@R2# run show route 10.10.10.10
 

Initiating a ping from R1

[edit]
lab@R1# run ping 10.10.10.10
PING 10.10.10.10 (10.10.10.10): 56 data bytes
36 bytes from 100.1.1.1: Destination Net Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 63d3 0 0000 40 01 597b 100.1.1.2 10.10.10.10

36 bytes from 100.1.1.1: Destination Net Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 6400 0 0000 40 01 594e 100.1.1.2 10.10.10.10

36 bytes from 100.1.1.1: Destination Net Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 641f 0 0000 40 01 592f 100.1.1.2 10.10.10.10

36 bytes from 100.1.1.1: Destination Net Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 643b 0 0000 40 01 5913 100.1.1.2 10.10.10.10

36 bytes from 100.1.1.1: Destination Net Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 645a 0 0000 40 01 58f4 100.1.1.2 10.10.10.10

^C
--- 10.10.10.10 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss


This is Junos default behavior and a firewall filter is required to block these packets.

  • implementing a fwf on R1 only solves the problem on R1, but you want to solve it on R2 to do it properly
  • instead of the fwf on R1 implemented a (default) route on R2 which points to discard
[edit]
lab@R1# show firewall
family inet {
   filter test {
      term 1 {
         from {
            protocol icmp;
            icmp-type unreachable;
         }
         then {
            count unreach;
            log;
            reject;
         }
      }
      term 2 {
         then accept;
      }
   } 
}

[edit]
lab@R1# show interfaces ge-0/0/2.0
Aug 04 11:40:28
family inet {
   filter {
      input test;
   }
   address 100.1.1.2/24;
}
family mpls;


lab@R1# run ping 10.10.10.10
PING 10.10.10.10 (10.10.10.10): 56 data bytes
^C
--- 10.10.10.10 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

[edit]
lab@R1#

Modification History

2024-6-26: formatting fixed.
2012-6-27: article created