Troubleshooting Tip: Network printer unreachable when connected via VPN
| Description | This article describes how to resolve an issue where a network printer becomes unreachable when users are connected through a VPN. It outlines the possible cause of the behavior and the recommended configuration changes to restore printer connectivity. |
| Scope | FortiGate. |
| Solution | Some printers, especially ones using AirPrint, are discovered via Multicast. This discovery can work via the SSL VPN, but not the IPsec VPN. For details, see Troubleshooting Tip: Workaround for remote users unable to access a multicast server via dial-up IPsec VPN.
Run a packet sniffer to confirm if the traffic is passing over the FortiGate and is forwarded to the correct interface port.
diagnose sniffer packet any "host x.x.x.x and host y.y.y.y" 4 0 l <----- Replace x.x.x.x with the IP of the VPN client and y.y.y.y with the IP of the printer.
To check the flow of traffic and what specific policy it matches, use debug flow.
The following example shows the flow trace for a device with an IP address of x.x.x.x:
diagnose debug flow filter addr x.x.x.x y.y.y.y and <----- Replace x.x.x.x with the IP of the VPN client and y.y.y.y with the IP of the printer. diagnose debug enable
To collect unidirectional traffic, set the filters in the following way:
diagnose debug disable diagnose debug reset
By default, some network printers are configured to accept and respond only to traffic originating from the same IP subnet.
Workaround: Enable NAT on the firewall policy that handles IPsec remote access traffic. This will translate the source IP to the outgoing interface IP, which resides in the same subnet as the network printer, allowing the printer to respond to the requests correctly. |
