Hola Daniel
Gracias por la observación, la opción correcta es C, cuando se bloquea la comunicación BGP entre 2 dispositivos, tendremos tal cual los logs mostrados en la pregunta. (Lo he simulado y confirmado por si las dudas =) )
Logs recibidos en mi caso (topología R1-R2-R3):
*Aug 16 13:14:30.391: TCP: sending SYN, seq 3969043345, ack 0
*Aug 16 13:14:30.391: TCP0: Connection to 30.30.30.30:179, advertising MSS 1460
*Aug 16 13:14:30.395: TCP0: state was CLOSED -> SYNSENT [28136 -> 30.30.30.30(179)]
*Aug 16 13:14:30.447: ICMP: dst (10.10.10.10) administratively prohibited unreachable rcv from 12.12.12.2
*Aug 16 13:14:30.451: TCP0: ICMP destination unreachable received
*Aug 16 13:14:30.451: Released port 28136 in Transport Port Agent for TCP IP type 1 delay 240000
*Aug 16 13:14:30.451: TCP0: state was SYNSENT -> CLOSED [28136 -> 30.30.30.30(179)]
*Aug 16 13:14:30.459: TCB 0x6B0C7930 destroyed
R1#
ACL router intermedio:
R2#show access-lists
Extended IP access list 199
10 deny tcp host 10.10.10.10 host 30.30.30.30 eq bgp (27 matches)
20 permit ip any any (39 matches)
Saludos! =)