Solved

Printing through firewalls

Posted on 2004-09-02
6
860 Views
Last Modified: 2013-12-15
I am trying to configure some local print queues on a Citrix server farm that are hosted by my client for a third party company.  The print queues are for a number of different HP Printers (4000, 4050, 8000, 8100).

Firewalls are present at both ends of the link between my client (Checkpoint FW) and their third party associate (PIX FW).

I have tried creating queues on the Citrix servers for the HP printers, using a Windows 'Standard TCP/IP Port' for each and specifying the address of the target printer, but it always fails, seemingly because the printer cannot be contacted.

I have requested that port 9100 be opened on the remote firewall, but that has made no difference (this is the port that Windows states it will use for the printing). I cannot ping the printers, as ping traffic is denied by my client's firewall.

Has anyone else come across the same problems when trying to configure remote printers? Did you have to configure something special on the firewalls to allow printing to occur?

Regards,

Mark
0
Comment
Question by:Mark_R
  • 3
  • 3
6 Comments
 
LVL 9

Expert Comment

by:jonoakley
ID: 11964041
First are the networks NATed firewalls? If so set up a 1-1 for port 9100 to the IP of the print server.
If possible arrange the setup to allow all traffic in and out for the IP of the print server for testing purposes, then scale back and start blocking ports.
0
 
LVL 1

Author Comment

by:Mark_R
ID: 11964324
There is no NATing in place as my client and the third-party use different addressing schemes.

With regards to allowing all traffic for the print server, for the third-party end all I have is IP addresses of the printers themselves (i.e. the JetDirect cards).  I cannot resolve the print server that they use, as there is no name resolution available to my client for the third-party infrastructure.

Neither the third-party nor my client will allow their firewalls to be opened across all ports, even for a small address range (such as the three addresses on my client's side that will be outputting print information).

The reason for needing to allow direct communications is an attempt to resolve some printing problems in Citrix for some legacy/bespoke applications.  These applications work fine with normal printers, which have been defined with UNC paths, but they do not work with the Citrix auto-created client printers.  Therefore, my reasoning is that if queues can be defined locally on the servers, then these can be selected to alleviate the problems.

Mark
0
 
LVL 9

Accepted Solution

by:
jonoakley earned 250 total points
ID: 11966477
So we have public IPs all around?
How is traffic relayed: network, VPN, Internet?
Both firewalls will need to allow comunication across 9100 for the IPs of the print servers for the service ot work properly.
Ping may not be neccessary. Since you are not using NAT, the IP must be public. You should be able to access the the HTML interface on the HP print servers accross the Internet.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 1

Author Comment

by:Mark_R
ID: 11970830
The IP ranges used are 10.x.x.x (Client) and 172.17.x.x (Third-party), so they are private ranges. There is a tunnel set up between the two firewalls, with firewall-to-firewall encryption.

I requested the remote firewall have port 9100 opened, and as far as I knew, all outgoing ports were opened on the client side, but I will check (as that could be the problem).

I will keep you updated.

Regards,

Mark
0
 
LVL 1

Author Comment

by:Mark_R
ID: 11971069
D'OH!!!!  Can't believe I didn't do this earlier, especially as it even crossed my mind to try it!!

Yes, BOTH ends need to allow traffic on Port 9100, as you said.  I have just tried it, and although the Printer Setup Wizard still can't detect the printer NIC, a test print will leave the queue successfully.

But, you made the correct suggestion, so the points are yours!

Thanks,

Mark
0
 
LVL 9

Expert Comment

by:jonoakley
ID: 11972338
Not alot to play with if routing and ports are correct.  Glad to see it worked out.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Does UNC path  use DNS resolution 10 149
Error on App opening 5 66
HP Deskjet 2132 3 103
1350 HP printer error - paper jam 8 25
How to solve seemingly unsolvable printer issues. Users sometimes run into printing issues where all the normal steps do not seem to work. Well the steps below can show users how to take one extra step beyond the normal steps needed to remove old…
Printers have changed substantially in the last 30 or so years, not just in technical capabilities but in cost and usage as well.  Printers were originally used for interfacing with the operator, not necessarily for printing copy or pictures. In …
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

26 Experts available now in Live!

Get 1:1 Help Now