PC has trouble finding printer

[Donald]

I am working to get a printer to connect wireless to a PC. Works fine on home network.

So at the church camp with Unifi WIFI each device can connect to the network but the PC cannot find the printer. Epson printer.

Since any PC could have a virus and we do not want one PC infecting the others I have L2 Isolation on.

The PC is on one network SSID and the printer on another. Each SSID is on its own VLAN and has it's own IP address range.

Unifi says this should work.

Device isolation is not on.

But maybe the printer is connecting in a way I am not expecting. Like L2 vs L3?

Ideas

 

[Rand]

I would bet it is the l2 isolation.. you normally use that on a hotspot type deal where you dont want devices talking to each other.
@OVERKILL might have 2cents to chime in on this.

 

[Bottom_Feeder]

The PC is on one network SSID and the printer on another. Each SSID is on its own VLAN and has it's own IP address range.

Looks like the problem right there to me.

 

[Donald]

So it appears that if the PC is told the IP address of the printer it works. But the PC cannot find the printer on its own.

 

[Hermann]

Had a similar problem after AT&T replaced my WiFi box. I unplugged the printer overnight. Made sure the Computer with the printer software was booted and running a few minutes. Plugged it back in and about 45 sec. later it was paired to my WiFi. The new AT&T boxes transfer your WiFi password automatically to the new box and works with your apps without you typing it in a dozen times. NICE

The printer was the only device that was fussy about it.

 

[mk378]

It's working exactly as it should. Automatic discovery works through broadcast packets that won't cross between networks. If L3 routing is possible, you can and should enter the printer IP manually into the PC.

The Windows solution to this for a large network (larger than most church camps) is to process all print jobs through a Windows print proxy server. When a new printer is installed on campus, the administrator will configure it into the print server. Then all the PCs which are linked to the server can find and potentially use the new printer. When a new computer is installed, it is only necessary to point it at the print server and it then knows about all the printers.

 

[Donald]

Had a similar problem after AT&T replaced my WiFi box. I unplugged the printer overnight. Made sure the Computer with the printer software was booted and running a few minutes. Plugged it back in and about 45 sec. later it was paired to my WiFi. The new AT&T boxes transfer your WiFi password automatically to the new box and works with your apps without you typing it in a dozen times. NICE

The printer was the only device that was fussy about it.

Thanks but my problem is related to a more complex setup involving VLANs.

 

[Donald]

So I think the problem is the way the software on the PC tries to find the printer when it does not know the IP address of the printer. I am guessing it interrogates every device on the subnet looking for one that is an Epson printer. Or something similar.

 

[mk378]

The inbuilt Windows method is WS-Discovery, which is founded on the PC sending a multicast UDP packet ("I'm looking for printers"). Compatible printers will respond. WS-Discovery is a standard feature on most manufacturers' network capable printers, including all HP.

Probe Message - Win32 apps

A WS-Discovery message used by a client to search for services on the network by service type.

docs.microsoft.com

Multicast packets will never route out of their home LAN. A major reason for having multiple LANs is to reduce the clutter of multicast packets going over the whole enterprise.

Of course manufacturers could write other zeroconf technologies into their drivers.

 

[Donald]

The inbuilt Windows method is WS-Discovery, which is founded on the PC sending a multicast UDP packet ("I'm looking for printers"). Compatible printers will respond. WS-Discovery is a standard feature on most manufacturers' network capable printers, including all HP.

Probe Message - Win32 apps

A WS-Discovery message used by a client to search for services on the network by service type.

docs.microsoft.com

Of course manufacturers could write other zeroconf technologies into their drivers.

So this only goes to the subnet? Or beyond?

 

[OVERKILL]

So this only goes to the subnet? Or beyond?

It stays within the subnet, as @mk378 noted, unicast/multicast aren't routed without a relay and you don't want to do that, it creates a ton of useless traffic.

BTW, inter-vlan routing kind of defeats the isolation thing you are trying to achieve with L2 isolation here. Yes, having them on separate VLAN's and subnets will prevent PC's from automatically finding other PC's with broadcast traffic (which is, as already explained by mk378, why it isn't automatically finding the printer), but if that PC finds out the presence of other subnets it is routable to, that could be exploited.

 

[Donald]

It stays within the subnet, as @mk378 noted, unicast/multicast aren't routed without a relay and you don't want to do that, it creates a ton of useless traffic.

BTW, inter-vlan routing kind of defeats the isolation thing you are trying to achieve with L2 isolation here. Yes, having them on separate VLAN's and subnets will prevent PC's from automatically finding other PC's with broadcast traffic (which is, as already explained by mk378, why it isn't automatically finding the printer), but if that PC finds out the presence of other subnets it is routable to, that could be exploited.

Unifi has "L2 Isolation" you can specify on the WIFI and "device isolation" you can specify on the VLAN. Device isolation has options for "allowed access" and "restricted access". At present I only have L2 isolation on.

The Unifi support person is looking into the "Device isolation". I believe "Device isolation" with nothing specified for allowed or restricted does nothing. The support person seems to think it does but cannot fully explain it.

I need to also setup Device isolation to protect the LAN which is the network where all my switches and access points are in. No PCs need to get to it.

 

[OVERKILL]

Unifi has "L2 Isolation" you can specify on the WIFI and "device isolation" you can specify on the VLAN. Device isolation has options for "allowed access" and "restricted access". At present I only have L2 isolation on.

L2 isolation just means that there's no L3 routing taking place on the Unifi device itself, however, clearly, you have L2 routing happening if devices on different subnets are able to communicate with each other, which means it is probably happening at the firewall where the VLAN's terminate.

The Unifi support person is looking into the "Device isolation". I believe "Device isolation" with nothing specified for allowed or restricted does nothing. The support person seems to think it does but cannot fully explain it.

Device isolation on wireless is exactly what it sounds like. Devices aren't allowed to communicate with each other, even if they are on the same subnet. This is useful for hotels, public hotspots and other places of hospitality where you don't want the security risk of random devices being able to see each other.

I need to also setup Device isolation to protect the LAN which is the network where all my switches and access points are in. No PCs need to get to it.

That's usually what we'd call a management subnet or management VLAN. With your current L2 inter-VLAN routing happening you'll want to make sure you put in some explicit firewall rules that block traffic from any of the other VLAN's from getting to that VLAN and vice-versa.

An example of how you'd configure this would be as follows:

Firewall:
VLAN1 10.0.0.1 (untagged, management) 10.0.0.0/24
VLAN2 172.21.50.1 (tagged, Kids WiFi) 172.21.50.0/24
VLAN3 172.21.60.1 (tagged, Grandparents WiFi) 172.21.60.0/24
VLAN4 172.21.70.1 (tagged, Public WiFi) 172.21.70.0/24

Switch: 10.0.0.2
If L3, disable inter-VLAN routing or setup rules to block routing between the VLAN's you don't want to communicate with each other, for example, based on your OP:
Block any any 10.0.0.0/24 172.21.50.0/24
Block any any 10.0.0.0/24 172.21.60.0/24
Block any any 10.0.0.0.24 172.21.70.0/24
Block any any 172.21.50.0/24 10.0.0.0/24
Block any any 172.21.60.0/24 10.0.0.0/24
Block any any 172.21.70.0/24 10.0.0.0/24

If L2 only, you don't need to worry about it.

You'd use the same rules on the firewall if you wanted to block the management VLAN from accessing the low security VLAN's and vice-versa. This allows you to access devices by IP on the different subnet (like your printer for example) while keeping them from "discovering" devices on each of those networks. If you had one of those groups that you wanted to isolate in the same way as your management VLAN, you'd just create similar rules for it.

Your switch ports connected to the AP's would be trunked. The AP's themselves would be in VLAN1, but the SSID's you broadcast are in VLAN2, 3, 4

So in the above scenario, only your devices are on VLAN1, everything else is on one of the other VLAN's, the management VLAN can't get to the other VLAN's and they can't get to it, there's no wireless SSID associated with the management VLAN and clients on the low security VLAN's are able to access devices by IP address on the other VLAN's.

If you wanted to break it up further, we often put printers on their own VLAN, so you'd have a printing VLAN, each of your low security VLAN's would have access to the printer VLAN, but not each other.

 

[Donald]

L2 isolation just means that there's no L3 routing taking place on the Unifi device itself, however, clearly, you have L2 routing happening if devices on different subnets are able to communicate with each other, which means it is probably happening at the firewall where the VLAN's terminate.

Device isolation on wireless is exactly what it sounds like. Devices aren't allowed to communicate with each other, even if they are on the same subnet. This is useful for hotels, public hotspots and other places of hospitality where you don't want the security risk of random devices being able to see each other.

That's usually what we'd call a management subnet or management VLAN. With your current L2 inter-VLAN routing happening you'll want to make sure you put in some explicit firewall rules that block traffic from any of the other VLAN's from getting to that VLAN and vice-versa.

An example of how you'd configure this would be as follows:

Firewall:
VLAN1 10.0.0.1 (untagged, management) 10.0.0.0/24
VLAN2 172.21.50.1 (tagged, Kids WiFi) 172.21.50.0/24
VLAN3 172.21.60.1 (tagged, Grandparents WiFi) 172.21.60.0/24
VLAN4 172.21.70.1 (tagged, Public WiFi) 172.21.70.0/24

Switch: 10.0.0.2
If L3, disable inter-VLAN routing or setup rules to block routing between the VLAN's you don't want to communicate with each other, for example, based on your OP:
Block any any 10.0.0.0/24 172.21.50.0/24
Block any any 10.0.0.0/24 172.21.60.0/24
Block any any 10.0.0.0.24 172.21.70.0/24
Block any any 172.21.50.0/24 10.0.0.0/24
Block any any 172.21.60.0/24 10.0.0.0/24
Block any any 172.21.70.0/24 10.0.0.0/24

If L2 only, you don't need to worry about it.

You'd use the same rules on the firewall if you wanted to block the management VLAN from accessing the low security VLAN's and vice-versa. This allows you to access devices by IP on the different subnet (like your printer for example) while keeping them from "discovering" devices on each of those networks. If you had one of those groups that you wanted to isolate in the same way as your management VLAN, you'd just create similar rules for it.

Your switch ports connected to the AP's would be trunked. The AP's themselves would be in VLAN1, but the SSID's you broadcast are in VLAN2, 3, 4

So in the above scenario, only your devices are on VLAN1, everything else is on one of the other VLAN's, the management VLAN can't get to the other VLAN's and they can't get to it, there's no wireless SSID associated with the management VLAN and clients on the low security VLAN's are able to access devices by IP address on the other VLAN's.

If you wanted to break it up further, we often put printers on their own VLAN, so you'd have a printing VLAN, each of your low security VLAN's would have access to the printer VLAN, but not each other.

What is the benefit of having a management VLAN vs a plain LAN for the switches and APs? Assuming I prevent access from all wireless devices.

 

[mk378]

Only you would ever connect to the management VLAN, and only when you need access to set up a controller, router, switch, etc. Ordinary users on the other VLANs would be unable to even try to log into the routers and switches, since they are firewalled out of the management VLAN.

 

[OVERKILL]

Only you would ever connect to the management VLAN, and only when you need access to set up a controller, router, switch, etc. Ordinary users on the other VLANs would be unable to even try to log into the routers and switches, since they are firewalled out of the management VLAN.

Yup, exactly.

 

[Donald]

Ok. So back to the Unifi "Device Isolation" option. Does it do anything if nothing is specified for allowed access or restricted access?

 

[OVERKILL]

Ok. So back to the Unifi "Device Isolation" option. Does it do anything if nothing is specified for allowed access or restricted access?

I don't use Unifi, primarily just Cisco and HPE (with a splash of Juniper), but my explanation of how it is supposed to function above should still apply. Do you have a screenshot of the option in context by chance?

 

[mk378]

As Overkill said that applies more to a hotel etc where you don't want wifi users to link to each other at all, and not access anything except the Internet. For private business use you may want computers to see each other.

The only way to really know if security features are working of course is to test it. Connect as a user then try to do things that you don't want users to be able to do.

 

[Donald]

This is a situation where 30 or 40 members of the church camp have their own PCs or phones or watches or Roku (no control over anything) that want to connect to WIFI. So I think its best to not allow any of them to talk to other devices on the network except for the printers. And at present that is one printer for one person.