Different VLAN unable to SCAN to PC using SMB

Forum|Forum|1 year ago
November 2, 2024
4 replies
2584 views

Dear All,

We have recently transitioned to a VLAN segmentation configuration from our previous flat VLAN design.

FortiGate 201F is in Version 7.2.10.

Currently, we have printers located in VLAN 20 and users in VLAN 40.

Our network architecture consists of an Internet connection leading to a FortiGate firewall, which then connects to a switch that serves both printers and user PCs.

Detailed information:

We have an inter-VLAN policy that permits all services between VLAN 20 and VLAN 40, and no security profiles are applied. While devices in these VLANs can successfully ping each other and users can print without issues.

The Issue we facing,

We are encountering a problem with scanning documents from the printer to the PC using SMB.

The strange thing is we don't see any logs at all.

We tested within the same VLAN, where both the printer and PC are located within the same VLAN, shows that scanning functions correctly without routing through the FortiGate.

Does anyone encounter this issue? Able to advise this?

FortiGate

kumarh

Staff

Could you please share the forward traffic and debugs logs. You can run following command on Fortigate:

diag debug flow filter addr X.X.X.X Y.Y.Y.Y and
diag debug flow show function enable
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable

where X.X.X.X is source IP address and Y.Y.Y.Y is destination IP address.

Also, make sure windows firewall is disable.

KumarV

Staff

Hello @SGLeo

1) You need to have Policy from VLAN 40 to VLAN 20 (users to printers)

2) You can test it by enabling the NAT on the Firewall policy from User to Printers. (Most probably it would work), if it works with the NAT, then your printers have some security enabled which is not responding to IP's from different subnets.

3) You can run the sniffer to check the traffic before running the debugs:

#di sniffer packet any "host x.x.x.x and port 139" 4 0 l

x.x.x.x is the destination IP

139 is SMB port

Regards,

Verender