?
Solved

Printing through firewalls

Posted on 2004-09-02
6
Medium Priority
?
868 Views
Last Modified: 2013-12-15
I am trying to configure some local print queues on a Citrix server farm that are hosted by my client for a third party company.  The print queues are for a number of different HP Printers (4000, 4050, 8000, 8100).

Firewalls are present at both ends of the link between my client (Checkpoint FW) and their third party associate (PIX FW).

I have tried creating queues on the Citrix servers for the HP printers, using a Windows 'Standard TCP/IP Port' for each and specifying the address of the target printer, but it always fails, seemingly because the printer cannot be contacted.

I have requested that port 9100 be opened on the remote firewall, but that has made no difference (this is the port that Windows states it will use for the printing). I cannot ping the printers, as ping traffic is denied by my client's firewall.

Has anyone else come across the same problems when trying to configure remote printers? Did you have to configure something special on the firewalls to allow printing to occur?

Regards,

Mark
0
Comment
Question by:Mark_R
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 9

Expert Comment

by:jonoakley
ID: 11964041
First are the networks NATed firewalls? If so set up a 1-1 for port 9100 to the IP of the print server.
If possible arrange the setup to allow all traffic in and out for the IP of the print server for testing purposes, then scale back and start blocking ports.
0
 
LVL 1

Author Comment

by:Mark_R
ID: 11964324
There is no NATing in place as my client and the third-party use different addressing schemes.

With regards to allowing all traffic for the print server, for the third-party end all I have is IP addresses of the printers themselves (i.e. the JetDirect cards).  I cannot resolve the print server that they use, as there is no name resolution available to my client for the third-party infrastructure.

Neither the third-party nor my client will allow their firewalls to be opened across all ports, even for a small address range (such as the three addresses on my client's side that will be outputting print information).

The reason for needing to allow direct communications is an attempt to resolve some printing problems in Citrix for some legacy/bespoke applications.  These applications work fine with normal printers, which have been defined with UNC paths, but they do not work with the Citrix auto-created client printers.  Therefore, my reasoning is that if queues can be defined locally on the servers, then these can be selected to alleviate the problems.

Mark
0
 
LVL 9

Accepted Solution

by:
jonoakley earned 1000 total points
ID: 11966477
So we have public IPs all around?
How is traffic relayed: network, VPN, Internet?
Both firewalls will need to allow comunication across 9100 for the IPs of the print servers for the service ot work properly.
Ping may not be neccessary. Since you are not using NAT, the IP must be public. You should be able to access the the HTML interface on the HP print servers accross the Internet.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 1

Author Comment

by:Mark_R
ID: 11970830
The IP ranges used are 10.x.x.x (Client) and 172.17.x.x (Third-party), so they are private ranges. There is a tunnel set up between the two firewalls, with firewall-to-firewall encryption.

I requested the remote firewall have port 9100 opened, and as far as I knew, all outgoing ports were opened on the client side, but I will check (as that could be the problem).

I will keep you updated.

Regards,

Mark
0
 
LVL 1

Author Comment

by:Mark_R
ID: 11971069
D'OH!!!!  Can't believe I didn't do this earlier, especially as it even crossed my mind to try it!!

Yes, BOTH ends need to allow traffic on Port 9100, as you said.  I have just tried it, and although the Printer Setup Wizard still can't detect the printer NIC, a test print will leave the queue successfully.

But, you made the correct suggestion, so the points are yours!

Thanks,

Mark
0
 
LVL 9

Expert Comment

by:jonoakley
ID: 11972338
Not alot to play with if routing and ports are correct.  Glad to see it worked out.
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you use a Brother DCP 130C or similar Brother printer, at some point you might encounter the following problem: after you change the ink cartridge, the printer displays an "ink empty" message. Sometimes you just need to follow the instructions…
Causes of paper jams:The following are the main causes of paper jams. Guides:If the guides for the paper are not set correctly they may cause the paper to enter at an angle. You should ensure that the guides are set correctly for the paper type a…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question