Technical Tip: Extending AirPlay and AirPrint communication

Description

This article describes how to use AirPlay and AirPrint when a FortiWiFi unit separates client and server AirPlay and AirPrint devices.

Scope

FortiGate.

Solution

To configure the FortiWiFi unit to allow printing to an AirPrint-compatible printer, the network topology determines the solution. For example, if an iPhone and an AirPrint-compatible printer both use WiFi to connect to the same FortiWiFi wireless access point on the same subnet, no FortiWiFi configuration changes are required as long as intra-SSID traffic is not blocked. The iPhone and the printer can communicate directly.

If the iPhone and the AirPrint-compatible printer are on different networks separated by a FortiWiFi unit, use the information below to set all AirPrint communication through the FortiWiFi unit.

Check the following if issues are encountered:

• Check if multicast routing is enabled or not.
  
  

config router multicast
    set multicast-routing disable
end

• If multicast routing is enabled, the traffic is received on the incoming interface but not forwarded via the outgoing interface.

• The reason is that the destination IP, with the packets received on FortiGate, is part of the 'Local Network Control Block', and by default, it is not forwarded out of the L3 interface.

• It is also necessary to have a regular IPv4 firewall policy (already explained in the attached document) between 2 different interfaces, as once the device is detected, the traffic becomes unicast traffic.

• Enabling multicast forwarding allows the FortiGate to forward multicast IP packets to all interfaces except the receiving interface, with the TTL reduced by 1.

• Configuring multicast policy to allow multicast packets to pass from one interface to another. Refer to this document for more information: Configuring multicast policies.
  
  

To enable multicast forwarding:

config system settings
    set multicast-forward enable
end

• It is common for multicast packets to have a TTL of 1; if this is the case, the FortiGate will reduce the TTL to 0 when it forwards the packet. To avoid this issue, enable the 'multicast-ttl-notchange' setting. When 'multicast-ttl-notchange' is enabled, the FortiGate is prevented from reducing the TTL of the multicast packet.

To enable 'multicast-ttl-notchange': 

config system settings
    set multicast-ttl-notchange enable
end

• Multicast forwarding is not supported on enhanced MAC VLAN interfaces.

If AirPlay or AirPrint is still not working after the above configuration, check for the IGMP snooping setting on the wireless SSID. Disable IGMP snooping if it is enabled.

IMGP snooping setting is located under Advanced Settings on the GUI. Advanced Wireless Features need to be enabled to see this option. 

For mDNS traffic, enabling IGMP snooping can break down the communication. Some Bonjour clients may not send IGMP reports for the corresponding mDNS address (224.0.0.251, port 5353), and the Bonjour discovery will time out and fail.

To configure it in the CLI:

config wireless-controller vap 
    edit ssid_name
        set igmp-snooping disable
    next
end

Troubleshooting:

Diagnose commands to check traffic:

Sniffer: 

diagnose sniffer packet any 'host <IP address of the Printer>' 6 0 a 

To stop the sniffer, press Ctrl + C.

Debug flow: 

diagnose debug disable 
diagnose debug reset 
diagnose debug flow filter saddr <IP address of Printer> 
diagnose debug flow show console timestamp enable 
diagnose debug flow show function-name enable 
diagnose debug flow show iprope enable 
diagnose debug flow trace start 1000 
diagnose debug enable

After collecting the necessary debug output, run the following command to disable debugging:

diagnose debug disable
diagnose debug reset