Wireless Access

last person joined: 36 minutes ago 

Access network design for branch, remote, outdoor and campus locations with Aruba access points, and mobility controllers.
Expand all | Collapse all

Communication with Google Cloud Print

  • 1.  Communication with Google Cloud Print

    Posted Sep 10, 2019 12:17 PM

    Hello,

    I'm hoping someone can point me in the right direction with my problem. I'm trying to create a simple password protected wireless network to connect some wi-fi enabled HP printers and Chromebooks to for a special program. We have 4 VLANs on the controller, VLAN 1 (not used), VLAN 30 (our internal employee network), VLAN 50 (the wireless management network), and VLAN 99 (our existing guest network). I decided to use VLAN 99 when I ran through the VLAN wizard and it works for just about everythingm but the printer cannot communicate with Google to print the Cloud Print claim form. I deleted this test network and created a new one using VLAN 30 and the printer CAN print the claim form. If I simply set the VLAN back to 99, the printer CAN'T print the claim form. I'm having trouble trying to figure out what would allow a device on this guest network to browse the web, yet not allow it to communicate with whatever servers host Google's Cloud Print services.

    This controller is an old Mobility 3200 running ArubaOS 6.3.1.8.

    Any thoughts/suggestions?

    Thanks!
    Mark



  • 2.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 02:18 PM

    Do you have "ip nat inside" enabled on VLAN 99"?

     



  • 3.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 02:37 PM

    Yes I do:

     

    interface vlan 99
    ip address 192.168.99.1 255.255.255.0
    no ip routing
    ip nat inside

     

    This is the original guest vlan that was configured many moons ago for use with our guest network using captive portal. 

     

    Thanks!

    Mark



  • 4.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 02:47 PM

    Is your guest role blocking any traffic?

     

    EDIT:

    While you are trying to print to the printer, I would type "show datapath session table <ip address of printer>" to see if anything is being blocked.



  • 5.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 05:02 PM

    My AAA profile has the following roles on this WLAN:

    Initial: authenticated
    Mac Auth Default: guest
    802.1X Auth Default: guest

    Each of those roles are defined as:

    user-role authenticated
    access-list session ra-guard
    access-list session allowall

    user-role guest
    access-list session ra-guard
    access-list session cplogout

    and these policies have these rules:

    ip access-list session ra-guard
    ipv6 user any icmpv6 rtr-adv deny

    ip access-list session v6-allowall
    ipv6 any any any permit

    ip access-list session cplogout
    user alias mswitch svc-https dst-nat 8081

    The output of show datapath session is:

    (EC-3200) #show datapath session table 192.168.99.144


    Datapath Session Table Entries
    ------------------------------

    Flags: F - fast age, S - src NAT, N - dest NAT
    D - deny, R - redirect, Y - no syn
    H - high prio, P - set prio, T - set ToS
    C - client, M - mirror, V - VOIP
    Q - Real-Time Quality analysis
    I - Deep inspect, U - Locally destined
    E - Media Deep Inspect, G - media signal

    Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
    -------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- --------- --------- -----
    192.168.99.144 8.8.8.8 17 36109 53 0/0 0 0 0 tunnel 22 0 1 61 FSCI
    192.168.99.144 74.125.142.125 6 34503 5222 0/0 0 0 0 tunnel 22 0 1 64 SYC
    192.168.99.144 8.8.8.8 17 53464 53 0/0 0 0 0 tunnel 22 0 1 61 FSCI

    (EC-3200) #show datapath session table 192.168.99.144


    Datapath Session Table Entries
    ------------------------------

    Flags: F - fast age, S - src NAT, N - dest NAT
    D - deny, R - redirect, Y - no syn
    H - high prio, P - set prio, T - set ToS
    C - client, M - mirror, V - VOIP
    Q - Real-Time Quality analysis
    I - Deep inspect, U - Locally destined
    E - Media Deep Inspect, G - media signal

    Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
    -------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- --------- --------- -----
    192.168.99.144 216.239.38.120 6 63000 443 0/0 0 0 0 tunnel 22 2 0 0 FSC
    192.168.99.144 8.8.8.8 17 36109 53 0/0 0 0 0 tunnel 22 3 0 0 FSCI
    192.168.99.144 216.239.38.120 6 51120 443 0/0 0 0 0 tunnel 22 2 0 0 SC
    192.168.99.144 74.125.142.125 6 34503 5222 0/0 0 0 0 tunnel 22 3 0 0 SC
    192.168.99.144 8.8.8.8 17 48518 53 0/0 0 0 0 tunnel 22 2 0 0 FSCI
    192.168.99.144 8.8.8.8 17 53464 53 0/0 0 0 0 tunnel 22 3 0 0 FSCI
    192.168.99.144 8.8.8.8 17 55542 53 0/0 0 0 0 tunnel 22 2 0 0 FSCI

    (EC-3200) #show datapath session table 192.168.99.144


    Datapath Session Table Entries
    ------------------------------

    Flags: F - fast age, S - src NAT, N - dest NAT
    D - deny, R - redirect, Y - no syn
    H - high prio, P - set prio, T - set ToS
    C - client, M - mirror, V - VOIP
    Q - Real-Time Quality analysis
    I - Deep inspect, U - Locally destined
    E - Media Deep Inspect, G - media signal

    Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
    -------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- --------- --------- -----
    192.168.99.144 216.239.38.120 6 51120 443 0/0 0 0 1 tunnel 22 15 0 0 SC
    192.168.99.144 74.125.142.125 6 34503 5222 0/0 0 0 0 tunnel 22 16 1 52 SC
    192.168.99.144 8.8.8.8 17 53464 53 0/0 0 0 1 tunnel 22 16 0 0 FSCI
    192.168.99.144 8.8.8.8 17 55542 53 0/0 0 0 1 tunnel 22 15 0 0 FSCI

    (EC-3200) #

    That was three executions of the command while the printer tried to print the claim form. The whole process errors out on the printer within 2 seconds, so the timimg of my command spam might have been lacking.

    Thanks for your time,
    Mark



  • 6.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 05:46 PM

    All I see is no return traffic from 8.8.8.8, so I hope DNS is working correctly on the subnet. EDIT:  I see the DNS return traffic.

     

    When you say it fails, does it fail on the client printing, or does the printer have an error?



  • 7.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 06:19 PM

    The printer has an display panel with a sub menu item for printing out a claim form for Google Cloud Print. When I press the button to submit the details about the printer to Google, it fails with an error that it (the printer) failed to register with Google Cloud Print and to try again later, so it's form the printer itself.

     

    If I switch the VLAN to 30, th registration occurs normally as expected. It's puzzling because I have connected clients, namely a Chromebook and a Windows 10 PC, to the same network on VLAN 99 and can browse the web, hit several of Google's services like Drive without any trouble. 

     

    Thanks,

    Mark

     

     

     

     



  • 8.  RE: Communication with Google Cloud Print

    Posted Sep 10, 2019 08:10 PM

    I think you should probably think about anything within your network that you are doing different.  I can't say from here what is different.



  • 9.  RE: Communication with Google Cloud Print

    Posted Sep 11, 2019 10:54 AM

    Thank you. It's good to hear that it doesn't seem to be caused by something in the wireless configuration. I was speaking with our web filter admin about it and he thinks that there may be some config differences between how this guest network is handled vs our employee network, so we'll be shifting focus there. Thanks again for your time.

     

    Mark



  • 10.  RE: Communication with Google Cloud Print

    Posted Sep 11, 2019 10:57 AM

    Let us know what it is if you resolve it, thanks.



  • 11.  RE: Communication with Google Cloud Print

    Posted Sep 11, 2019 11:02 AM

    Will do :)