Technical Tip: ZTNA access to the shared printer via EPM/RPC protocol

Description

This article describes how to configure a ZTNA access to a shared printer.

Scope

All supported versions of FortiOS, a FortiClient with an EMS license.

Solution

In some scenarios, printers are set up which should be available via SMB/RPC protocol, but the ZTNA client is unable to connect to them. The reason is that ZTNA is not supposed to work with EPM/RPC protocol.

While using Print Server Management Ports (EPM & RPC), the client and server start communicating with port 135, and then a response server provides dynamic port number (49152 - 65535) which the client should start communicating against the printer. For EPM/RPC protocol descriptions, see the bottom of this article for a link to a related Microsoft article.

The following is a snippet of communication between client and server (printer):

315    15:24:42.28636    172.20.10.10    172.20.4.8    54504    135    EPM    224    Map request, SPOOLSS, 32bit NDR

316    15:24:42.28637    172.20.10.10    172.20.4.8    54504    135    TCP    224    [TCP Retransmission] 54504 → 135 [PSH, ACK] Seq=2009 Ack=2001 Win=64768 Len=168

317    15:24:42.29272    172.20.4.8    172.20.10.10    135    54504    EPM    228    Map response, SPOOLSS, 32bit NDR

318    15:24:42.29273    172.20.4.8    172.20.10.10    135    54504    TCP    228    [TCP Retransmission] 135 → 54504 [PSH, ACK] Seq=2001 Ack=2177 Win=261888 Len=172

319    15:24:42.32113    172.20.10.10    172.20.4.8    57011    49681    TCP    68    57011 → 49681 [SYN] Seq=0 Win=65535 Len=0 MSS=1240 WS=256 SACK_PERM

Snippet content of marked frame #317, a response from a printer:

Frame 317: Packet, 228 bytes on wire (1824 bits), 228 bytes captured (1824 bits)
...
...
Floor 4 TCP Port:49681
LHS Length: 1
Protocol: DOD TCP (0x07)
RHS Length: 2 
TCP Port: 49681            <<<<---- Dynamic port
Floor X IP: 172.20.4.8
LHS Length: 1
Protocol: DOD IP (0x09)
RHS Length: 4
IP: 172.20.4.8
Return code: 0x00000000

Solution:

• Since EPM/RPC protocol allocates dynamic ports, and ZTNA uses specified ports, this protocol cannot be used with the ZTNA service.

Related article:

Service overview and network port requirements for Windows