AirPrint Multicast in NAT mode

[MorioSnek]

Hi everyone,

I recently installed a FortiGate 60E in my home network, that I share with few other people. For certain reasons, I don't have an administrative access to the home gateway, so I had to set my FGT in NAT mode. Everything's fine, but the other people in the house have to print on the HP printer that is in my network. So I tried setting up multicast policies, but nothing has worked until now.

The "outer" network is connected through WAN1, and its net address is 172.16.4.0/24.

My network is 192.168.4.0/24. The printer is connected to an airport extreme in bridge mode, which is connected to the internal FGT switch.

The multicast policies I set are basically two: one from 172.16.4.0/24 to all the services (from WAN1 to Internal) and the other one from the printer (192.16.4.113) to all the services (from Internal to WAN1).

Leaving all the security issues aside that I will think about later, I can't see from my network all the multicast devices that are on the outer network, like TVs, stereos...

I set up firewall policies that allow traffic between 172.16.4.0/24 and the printer, but I'm not sure if the NAT should be allowed or not.

Thank you in advance

[AlexC-FTNT]

Did you allow mulicast forward on the system settings?

You can try and follow this guide:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Airprint-multicast-forwarding-between-two/...

[MorioSnek]

Hi Alex,

I followed that guide, and basically I had to enable all the protocols through the interfaces, and disable multicast routing (I already had multicast forward enabled).

The thing is, now that I can view the printer from the outer network, I try to print, but the communication between the device and the printer is stuck on "Printing" without any response from the printer. Do you know how can I solve this issue?

Thanks

[AlexC-FTNT]

First see where the problem is - does the traffic pass both ways to/from the printer (run a packet capture) ? and if not, see why the FortiGate blocks them (debug flow)

[AlexC-FTNT]

For me, this problem happens with smarthome products using different APs around the house. If they are not on the same AP (wifi router), the broadcast and multicast, even if allowed on the FortiGate, are filtered by the cheap wifi routers that I use as AP

[MorioSnek]

Thank you for your reply,

I tried to perform a packet capture, but everything seems alright. The debug doesn't give any explicit error, but seems stuck in a loop where the connection between the two devices succeed in establishing a connection.

I don't think that the APs are the problem: I tried connecting the printer to the 172.16.4.0/24 net (which is covered by cisco APs instead of my Airport Extreme) and from every AP in the house, inside the same network, the printing succeeds.

Maybe it's because the two devices that need to establish a connection don't have the same gateway?