Solved

How to set up firewall to isolate a printer

Posted on 2014-11-25
8
161 Views
Last Modified: 2014-12-08
I'm troubleshooting a difficult issue with a particular family of Lexmark printers that are in use in our office. We have issues where the printer suddenly shows "Busy" on the screen and flashes the green LED and sits there, hung, until it is rebooted. It happens every couple of days. It happens on ALL of our Lexmark printers, and none of our other printers (e.g. Xerox, HP, Brother).

I've reached Level 3 support with Lexmark, and they want to rule out an issue with my network. They are considering the possibility that some kind of rogue or unwanted traffic on the network is causing the printer to hang.

I've offered to put in a firewall that I can use to isolate this printer from the rest of the network and to only allow specific traffic from a few specific computers, in order to rule out a network issue.

I've attached a picture of our network. We have a fairly simple office LAN, but we also have a guest WiFi network and a third party management provider has set up their own proprietary network and equipment that co-exists with our own, and we are not allowed to touch that equipment.

Network layout
About 10 people use this printer, I don't want to spend a ton of money on a firewall.... and I am hoping there's something fairly simple I can put in that can accomplish this.

Can you suggest what I should do?

I'm imagining putting some sort of firewall infront of the printer like so:

Proposed firewall
But maybe there's a different way it should be done?
0
Comment
Question by:Frosty555
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 7

Expert Comment

by:tolinrome
ID: 40465437
Even if you did put in a firewall and isolate the lexmark printers that wouldn't solve the problem. I see the common denominator as the printers of course and the first few things I though of were:

1. What has just changed in the network etc, anything?
2, How are these printers different than the others, IP addresses, etc.
3. Do they do automatic updates for firmware etc and now the updates messed something up.
0
 
LVL 7

Expert Comment

by:tolinrome
ID: 40465440
can you reset the network settings on the printers, try one at first and see what happens.
0
 
LVL 31

Author Comment

by:Frosty555
ID: 40465472
Hi Tolinrome,

Believe me we have done TONS of testing and troubleshooting, and we've done everything obvious to troubleshoot the printer including:
    - Reset to factory defaults
    - Try different drivers (PCL5e vs PS vs the Lexmark Universal drivers)
    - Try installing the printers and software manually instead of deploying them via Group Policy
    - Changing IP address of printer, forcing the network speed / duplex settings on the printer
    - Try different computers
    - Checked all the network cabling and terminations

Whatever is happening, it is weird, and very low level. We're thinking a bug in the Lexmark software/hardware/firmware being exacerbated by something in our environment.

So far as I know, we have had this problem since day 1. Unfortunately we purchased a bunch of these printers from a third party vendor who we are no longer doing business with. Lexmark has done a warranty exchange on several of the printers, and the replacements exhibited the same problem. Lexmark refuses to take all of the printers back directly and the reseller won't deal with us anymore.

We have several Lexmark MS310, MS510, MS810, and a multifunction MX310 in use in the office that all exhibit the problem.

We have a couple Xerox Workcentre printers and a couple Brother printers, and an HP that are not exhibiting any problems.

I took a couple of the problematic MS310 printers and connected them via USB to the one computer that was using it. Those printers are working perfectly now.

So definitely the Lexmarks are the common denominator, and something is definitely wrong with the product, but they are of the opinion that the problem is being caused by my network. At this point I'm just trying to appease them and rule it out (or at least isolate the problem, maybe the firewall's logs will shed some light on what's going on if it is indeed the network).

If I go much higher up the tech support chain with these guys I'm going to be talking to their engineers :P
0
 
LVL 7

Expert Comment

by:tolinrome
ID: 40466037
Is there anyway to reinstall the firmware to a previous or newer version? It has to be something specificc to Lexmark. Has any google searches brang up anything?
For it to happen every couple of days seems that its something coming from the printer.

Does it cause any network issues though? Are people complaining of anything when this happens? It could even be the network cards on the printer are causing it by the driver or firmware version, try updating them.
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 2

Accepted Solution

by:
Mike earned 500 total points
ID: 40466263
The proposed solution would work fine for ticking the box with the supplier as I imagine they won't move on until you have done this test. when you put the printer behind the firewall be sure to only allow ping, snmp and I believe TCP port 9100. Ping will obviously allow you to check connectivity. SNMP is used by some devices to report low paper/ink/printer make/model for drivers and 9100 (if that's correct) is the port used for sending/receiving jobs.

I agree with the comments above this probably won't help or prove anything but I also know what suppliers can be like. :)
0
 
LVL 7

Expert Comment

by:Network Zero
ID: 40471108
Is this the whole network Diagram? If you have any old switches I would start there on any smaller switches that may be broadcast at 100 Mbps I would replaces them with gigabit switches first, I think you're having some sort of a broadcast storm that is being caused by an older device on the network that may not be configured properly.
0
 
LVL 31

Author Comment

by:Frosty555
ID: 40480795
Francisco - there's a bunch of other stuff on the network (mostly desktop workstations, unmanaged switches dotted around the office, and about 8-10 more printers). Is there an easy way I can detect this broadcast storm? I've used wireshark a bit but not enough to really make sense of what I'm seeing. Is there a more straightforward way to detect anomalous behavior on the network?


Mike - what kind of firewall should I put in? I was thinking of just putting a consumer grade router in, make the 192.168.23.0/24 network be on the "WAN" port and put the printer on a "LAN" port on the 192.168.1.0/24 network. Then configure port forwarding. The router I have in mind can allow connections based on the source IP address, so I can allow traffic in from just a couple computers.

I figure the consumer router's firewall and NAT gateway would neatly shield the printer from any weird stuff happening on the 192.168.23.0/24 network... and it's pretty cheap. What do you think?
0
 
LVL 2

Expert Comment

by:Mike
ID: 40481106
That would be fine and would also keep the cost down, you could if you have a spare PC lying about use something like PFSense but it maybe easier and cheaper (your time) to buy a cheap FW as above.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now