printing issues since moving to fortigate

[mark8263]

Hello all.

i used to have the following - 

file/print server

sonicwall firewall

layer 3 switch - it handled all the routing for the 'local' subnet.

now, i have the following

(same) file/print server and drivers

fortigate 91g

fortigate 148fpoe switches

since switching over to fortigate as the 'backbone' i've started having strange issues with printing - anything.  whenever i print something (small or large) using the same print server  - i'm getting lots of pages of 'computer code' and bad data.  the print jobs also reflect/show the print as 'guest' instead of the user that initiated the print job. i have to cancel, and try again to print.  it doesn't matter if the file is a .txt/.pdf/.xls/etc - i get the same thing.

the print server is on a different vlan than the printers but don't think that's the issue as access to those servers works, and whenever i do a pcap on the file server - i don't even see the file or process going out since it's layer-2.  

any idea what might be going on? i'm experiencing the same issue even if i create a std-ip port and print directly to the printer.  the only thing that has changed, is the implementation of the fortigate environment.

yes - i have 'any any' on the rules from non-vlan network to vlan network, and vice versa.

mark

[AEK]

Hi Mark

Try the following:

• Enable all logs on the related policy and on the implicit deny policy, and see if any related traffic is blocked
• Disable UTM (all security profiles) on the related policy
• Delete the printer from the PC and add it again

Also I remember some printers or printer drivers need multicast, so you may try follow this tech tip and see if it helps.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Extending-AirPlay-and-AirPrint-communicati...

The tech tip is for AirPrint but I know some other printer/drivers use multicast.

[mark8263]

I've already followed the steps in the apple/air by enabling that setting, but still don't see anything whenever i run the last 2 steps.

by policy i presume you are referring to the 'vl to network' and 'network to vlan' policies. i'm unsure how/where to enable logging for those policies. Where is that done at?

no UTM on those subnets.

mark

[AEK]

Here it is.

Regarding multicast traffic, you probably need to add multicast policy as well.

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/968606/configuring-multicast...

Hope it helps.