Can't see device (printer) on other interface

[craigbert]

Hello All,

I am a bit new to this level of networking, but I am trying to learn.

I have a printer on one interface that needs to be accessible from the other two.

My product is a FortiWiFi 60D, version 5.6.12.

My config is:

wan1 = connection between small office and internet

physical LAN = 10.10.79.X

wifi1 = device is located here 10.10.80.X

wifi2 = 10.10.180.X

wifi3 = 10.10.81.X (Guest)

I can ping the printer from LAN, wifi1, and wifi2, but it doesn't show up in AirPrint like it used to (prior to FortiWifi 60D being installed) which makes it difficult for the Apple products to connect to it and print.

In "Addresses" under "Policy & Objects" I have it defined as: "Canon Printer", subnet, 10.10.80.34/32, interface = "any", Show in Address List = enabled, Static Route Configuration disabled.

In IP4Policy the very first policy I have is:

Name: Printer #1 Policy

Incoming Interface: physical LAN, wifi1, and wifi2

Outgoing Interface: wifi1

Source: physical LAN, wifi1, and wifi2

Destination: "Canon Printer"

Schedule: Always

Service: ALL

Action: Accept

NAT = Enabled

IP Pool Config: Use Outgoing Interface Address

None of the Security Profiles are Enabled

Log Allowed Traffic: Enabled with "All Sessions"

Policy is Enabled.

Anyone have any idea what I am missing?  I have been messing around with this for a couple days and the hair loss is getting to be a bit much.

;)

Thanks.

[Toshi_Esumi]

Why do you need the NAT? That's likely the problem.

[craigbert]

Hi @Toshi, thanks for the reply.

I would have thought so to, but without the NAT enabled neither the physical LAN nor the other wifi network can even ping the printer let alone connect to it.

So it *seems* that enabling NAT gets me a little closer.  But to be fair maybe it only appears that way because I am missing something else.

[ShawnZA]

You need to disable NAT and make sure your routing is correct, you should be able to ping it if NAT is disabled unless there is a rule blocking it or no route to destination....

 

AirPrint is based (partly) on Bonjour, which is essentially a service discovery protocol that operates within a single subnet

So if your device is in another subnet it will likely not discover it automatically... there are other ways of getting that working correctly.

But first get that NAT sorted on that rule, no need for NAT between internal networks.

[craigbert]

Hi @ShawnZA, thanks for the response.

I will try to sort through the NAT issue later this afternoon.  A quick question though:

Since my policy for the device is the first one I would have thought that regardless of the other lower policies traffic would have been explicitly allowed for that device.  Is that not the case?

Thanks.

[Toshi_Esumi]

That part should be fine. But first I assume that when you removed the NAT, pinging wifi1->printer(wifi1) works fine but LAN->printer and wifi2->printer don't work. I would separate a policy LAN->printer or wifi2->printer from this policy#1 and put it above it without NAT then sniff&flow debug if ping requests goes toward the printer via wifi1 interface. If it does, the printer is not recognizing IP outside of the local subnet (10.10.80.0/24) and not responding to them toward the FWF's GW(wifi1).

[Dave_Hall · Accepted solution]

@craigbert

Devices on wifi1 (10.10.80.X) should be able to communicate with the Canon Printer (10.10.80.34/32) directly unless you have blocked Intra-SSID Traffic. Devices on the other subnets (LAN, wifi2, wifi3) should have firewall polices configured to direct traffic to "wifi1/Canon Printer".  NAT is not needed unless the Canon Printer itself does not allow for non-subnet connections (and can not be configured for such). Check the routing monitor to make sure there is a route showing up for 10.10.80.X.

As for airprint, see KB #FD33598 or KB#FD36500 for setting up multicast traffic.

[craigbert]

Hi All,

Thanks for your help.

Disabling the NAT and enabling multicast forwarding and setting a policy for the network resolved the issue.

[ShawnZA]

Great that you got it working. Yes it will hit the first policy and if it's allowed it will use it

[Dhanz]

Great tp hear that, 

If you allowed, can you describe the steps?
because I had the same problem. Please