# How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?

Cilium, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/how-does-a-client-experience-a-request-blocked-by-an-l3l4-cilium-policy-compared-with-one-blocked-by-an-l7-http-rule

- A. Both get an HTTP 403 response from the Cilium agent
- B. L3/L4: the connection times out. L7: an HTTP 403 response
- C. Both get a TCP reset as soon as the policy matches
- D. L3/L4: an ICMP unreachable reply. L7: the connection times out

**Answer:** L3/L4: the connection times out. L7: an HTTP 403 response

**Explanation:** At L3/L4 the eBPF datapath drops the packets, so a TCP client usually retries its SYN until it times out. An L7 denial happens in Envoy after the connection is set up, and Envoy answers with '403 Access denied'. The symptom tells you which layer to look at. 'hubble observe --verdict DROPPED' lists the L3/L4 drops.