Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

Printing across VLANs

Firewall: FortiGate 60F

Firmware: 6.4.8 Build 1914 (GA)

Mode: NAT

NGFW Mode: Profile-based

Central SNAT: Enabled

Switches: S148FP

Switches Firmware: S148FP-v7.0.2-build0049 


Issue: VLAN 30 (Workstations) cannot add a printer via TCPIP to VLAN 60 (Printers)


Firewall Policy is set to wide open for traffic to pass either way, but cannot connect any printer.


I have tried to use a NAT rule going both ways with no luck.


Also tried a multicast policy both way with no luck.


Been going back and fourth with a Fortinet tech but have gotten no where.


If more details are required, please let me know.


Any advise would be appreciated.



Is broadcast forward enabled on both the vlan interfaces? May be enabling them help the hosts in a vlan to identify the printer in another vlan.


Best regards,


New Contributor III

I have a Multicast Policy for the traffic to traverse both directions and Still unable to connect.

Source: ALL

Destination: all_hosts, all_routers, Bonjour, EIGRP, and OSPF

Protocol Number: 0

Action: ACCEPT


Hi FTAdmin, 


Go through the following doc:


Is multicast routing enabled? 


Thank you. 

Shahan Agha


You say you are adding a printer using TCP/IP. Does that mean IPP or other protocol? This relies on unicast usually.


However, if you are attempting to auto-discover the printers then it will rely on Multicast which will bring in a whole slew of different troubleshooting.


Can you please clarify exactly how you are trying to add the printers?

New Contributor III

I'm adding a printer using the following method.




OK so that is unicast, not multicast; should make troubleshooting a lot easier.


FIrst, let's try and see if we can eliminate the FortiGate as the issue here: Try adding the printer using that method from a device that is on the same VLAN as the printer, please. If it works then we can look at the FortiGate.

New Contributor III

I can confirm this printer can successfully be installed when on the same VLAN. Only when traveling into another VLAN is when the issue happens.


OK then we have to figure out what the firewall is doing with the traffic. Can you please set up a flow trace. Set the source address  to that of the endpoint you are trying to add the printer to and the destination address of the printer.


Here's detailed instructions on the debug flow commands (go to step 4):


Please paste the output here for analysis.





New Contributor III

When adding a printer like the image earlier in the thread. This comes up.


# diag sniffer packet any "host and host" 4
filters=[host and host]
49.363776 Workstations in -> udp 46
49.363852 Printers out -> udp 46
49.363856 fortilink out -> udp 46
49.363861 b out -> udp 46
49.364811 Printers in -> udp 47
49.364830 Workstations out -> udp 47
49.364834 fortilink out -> udp 47
49.364838 b out -> udp 47
49.365347 Workstations in -> udp 47
49.365394 Printers out -> udp 47
49.365397 fortilink out -> udp 47
49.365402 b out -> udp 47
49.366285 Printers in -> udp 49
49.366305 Workstations out -> udp 49
49.366309 fortilink out -> udp 49
49.366313 b out -> udp 49
49.366809 Workstations in -> udp 528
49.366856 Printers out -> udp 528
49.366860 fortilink out -> udp 528
49.366865 b out -> udp 528
49.368983 Printers in -> udp 528
49.369002 Workstations out -> udp 528
49.369006 fortilink out -> udp 528
49.369011 b out -> udp 528
24 packets received by filter
0 packets dropped by kernel


Here were my settings:

diag debug enable
diag sniffer packet any "host and host" 4
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable