Printing across VLANs

[FTAdmin]

Firewall: FortiGate 60F

Firmware: 6.4.8 Build 1914 (GA)

Mode: NAT

NGFW Mode: Profile-based

Central SNAT: Enabled

Switches: S148FP

Switches Firmware: S148FP-v7.0.2-build0049 

Issue: VLAN 30 (Workstations) cannot add a printer via TCPIP to VLAN 60 (Printers)

Firewall Policy is set to wide open for traffic to pass either way, but cannot connect any printer.

I have tried to use a NAT rule going both ways with no luck.

Also tried a multicast policy both way with no luck.

Been going back and fourth with a Fortinet tech but have gotten no where.

If more details are required, please let me know.

Any advise would be appreciated.

[jintrah_FTNT]

Hi,

Is broadcast forward enabled on both the vlan interfaces? May be enabling them help the hosts in a vlan to identify the printer in another vlan.

Best regards,

Jin

[FTAdmin]

I have a Multicast Policy for the traffic to traverse both directions and Still unable to connect.

Source: ALL

Destination: all_hosts, all_routers, Bonjour, EIGRP, and OSPF

Protocol Number: 0

Action: ACCEPT

[sagha]

Hi FTAdmin, 

Go through the following doc: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Airprint-multicast-forwarding-between-two/...

Is multicast routing enabled? 

Thank you. 

Shahan Agha

[gfleming]

You say you are adding a printer using TCP/IP. Does that mean IPP or other protocol? This relies on unicast usually.

However, if you are attempting to auto-discover the printers then it will rely on Multicast which will bring in a whole slew of different troubleshooting.

Can you please clarify exactly how you are trying to add the printers?

[FTAdmin]

I'm adding a printer using the following method.

[gfleming]

OK so that is unicast, not multicast; should make troubleshooting a lot easier.

FIrst, let's try and see if we can eliminate the FortiGate as the issue here: Try adding the printer using that method from a device that is on the same VLAN as the printer, please. If it works then we can look at the FortiGate.

[FTAdmin]

I can confirm this printer can successfully be installed when on the same VLAN. Only when traveling into another VLAN is when the issue happens.

[gfleming]

OK then we have to figure out what the firewall is doing with the traffic. Can you please set up a flow trace. Set the source address  to that of the endpoint you are trying to add the printer to and the destination address of the printer.

Here's detailed instructions on the debug flow commands (go to step 4): https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Please paste the output here for analysis.

[FTAdmin]

When adding a printer like the image earlier in the thread. This comes up.

# diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
interfaces=[any]
filters=[host 10.100.30.22 and host 10.100.60.40]
49.363776 Workstations in 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363852 Printers out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363856 fortilink out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363861 b out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.364811 Printers in 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364830 Workstations out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364834 fortilink out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364838 b out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.365347 Workstations in 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365394 Printers out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365397 fortilink out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365402 b out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.366285 Printers in 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366305 Workstations out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366309 fortilink out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366313 b out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366809 Workstations in 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366856 Printers out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366860 fortilink out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366865 b out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.368983 Printers in 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369002 Workstations out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369006 fortilink out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369011 b out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
^C
24 packets received by filter
0 packets dropped by kernel

Here were my settings:

diag debug enable
diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable