- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Printing across VLANs
Firewall: FortiGate 60F
Firmware: 6.4.8 Build 1914 (GA)
Mode: NAT
NGFW Mode: Profile-based
Central SNAT: Enabled
Switches: S148FP
Switches Firmware: S148FP-v7.0.2-build0049
Issue: VLAN 30 (Workstations) cannot add a printer via TCPIP to VLAN 60 (Printers)
Firewall Policy is set to wide open for traffic to pass either way, but cannot connect any printer.
I have tried to use a NAT rule going both ways with no luck.
Also tried a multicast policy both way with no luck.
Been going back and fourth with a Fortinet tech but have gotten no where.
If more details are required, please let me know.
Any advise would be appreciated.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is broadcast forward enabled on both the vlan interfaces? May be enabling them help the hosts in a vlan to identify the printer in another vlan.
Best regards,
Jin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a Multicast Policy for the traffic to traverse both directions and Still unable to connect.
Source: ALL
Destination: all_hosts, all_routers, Bonjour, EIGRP, and OSPF
Protocol Number: 0
Action: ACCEPT
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi FTAdmin,
Go through the following doc: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Airprint-multicast-forwarding-between-two/...
Is multicast routing enabled?
Thank you.
Shahan Agha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You say you are adding a printer using TCP/IP. Does that mean IPP or other protocol? This relies on unicast usually.
However, if you are attempting to auto-discover the printers then it will rely on Multicast which will bring in a whole slew of different troubleshooting.
Can you please clarify exactly how you are trying to add the printers?
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm adding a printer using the following method.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK so that is unicast, not multicast; should make troubleshooting a lot easier.
FIrst, let's try and see if we can eliminate the FortiGate as the issue here: Try adding the printer using that method from a device that is on the same VLAN as the printer, please. If it works then we can look at the FortiGate.
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can confirm this printer can successfully be installed when on the same VLAN. Only when traveling into another VLAN is when the issue happens.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK then we have to figure out what the firewall is doing with the traffic. Can you please set up a flow trace. Set the source address to that of the endpoint you are trying to add the printer to and the destination address of the printer.
Here's detailed instructions on the debug flow commands (go to step 4): https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...
Please paste the output here for analysis.
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When adding a printer like the image earlier in the thread. This comes up.
# diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
interfaces=[any]
filters=[host 10.100.30.22 and host 10.100.60.40]
49.363776 Workstations in 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363852 Printers out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363856 fortilink out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.363861 b out 10.100.30.22.59496 -> 10.100.60.40.161: udp 46
49.364811 Printers in 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364830 Workstations out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364834 fortilink out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.364838 b out 10.100.60.40.161 -> 10.100.30.22.59496: udp 47
49.365347 Workstations in 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365394 Printers out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365397 fortilink out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.365402 b out 10.100.30.22.59497 -> 10.100.60.40.161: udp 47
49.366285 Printers in 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366305 Workstations out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366309 fortilink out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366313 b out 10.100.60.40.161 -> 10.100.30.22.59497: udp 49
49.366809 Workstations in 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366856 Printers out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366860 fortilink out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.366865 b out 10.100.30.22.59498 -> 10.100.60.40.161: udp 528
49.368983 Printers in 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369002 Workstations out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369006 fortilink out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
49.369011 b out 10.100.60.40.161 -> 10.100.30.22.59498: udp 528
^C
24 packets received by filter
0 packets dropped by kernel
Here were my settings:
diag debug enable
diag sniffer packet any "host 10.100.30.22 and host 10.100.60.40" 4
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable