Firewall: FortiGate 60F
Firmware: 6.4.8 Build 1914 (GA)
Mode: NAT
NGFW Mode: Profile-based
Central SNAT: Enabled
Switches: S148FP
Switches Firmware: S148FP-v7.0.2-build0049
Issue: VLAN 30 (Workstations) cannot add a printer via TCPIP to VLAN 60 (Printers)
Firewall Policy is set to wide open for traffic to pass either way, but cannot connect any printer.
I have tried to use a NAT rule going both ways with no luck.
Also tried a multicast policy both way with no luck.
Been going back and fourth with a Fortinet tech but have gotten no where.
If more details are required, please let me know.
Any advise would be appreciated.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
Is broadcast forward enabled on both the vlan interfaces? May be enabling them help the hosts in a vlan to identify the printer in another vlan.
Best regards,
Jin
I have a Multicast Policy for the traffic to traverse both directions and Still unable to connect.
Source: ALL
Destination: all_hosts, all_routers, Bonjour, EIGRP, and OSPF
Protocol Number: 0
Action: ACCEPT
Hi FTAdmin,
Go through the following doc: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Airprint-multicast-forwarding-between-two/...
Is multicast routing enabled?
Thank you.
Shahan Agha
You say you are adding a printer using TCP/IP. Does that mean IPP or other protocol? This relies on unicast usually.
However, if you are attempting to auto-discover the printers then it will rely on Multicast which will bring in a whole slew of different troubleshooting.
Can you please clarify exactly how you are trying to add the printers?
I'm adding a printer using the following method.
OK so that is unicast, not multicast; should make troubleshooting a lot easier.
FIrst, let's try and see if we can eliminate the FortiGate as the issue here: Try adding the printer using that method from a device that is on the same VLAN as the printer, please. If it works then we can look at the FortiGate.
I can confirm this printer can successfully be installed when on the same VLAN. Only when traveling into another VLAN is when the issue happens.
OK then we have to figure out what the firewall is doing with the traffic. Can you please set up a flow trace. Set the source address to that of the endpoint you are trying to add the printer to and the destination address of the printer.
Here's detailed instructions on the debug flow commands (go to step 4): https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...
Please paste the output here for analysis.
When adding a printer like the image earlier in the thread. This comes up.
# diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
interfaces=[any]
filters=[host 10.100.30.22 and host 10.100.60.40]
49.363776 Workstations in 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363852 Printers out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363856 fortilink out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363861 b out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.364811 Printers in 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364830 Workstations out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364834 fortilink out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364838 b out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.365347 Workstations in 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365394 Printers out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365397 fortilink out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365402 b out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.366285 Printers in 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366305 Workstations out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366309 fortilink out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366313 b out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366809 Workstations in 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366856 Printers out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366860 fortilink out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366865 b out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.368983 Printers in 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369002 Workstations out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369006 fortilink out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369011 b out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
^C
24 packets received by filter
0 packets dropped by kernel
Here were my settings:
diag debug enable
diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1557 | |
1033 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.