Wireless Access

We have been experiencing a problem where users become unable to print to network-attached printers.  This has been going on for several months and I have tried resolving it in many ways, including upgrading the firmware. Nothing seems to resolve the problem.    Below are the facts of this issue, some explanation of our troubleshooting that we have completed, and I have also attached a configuration file from one of the AP-105US devices for your review.

PROBLEM:

• A wireless workstation / laptop shows connectivity to the printers.  After about 5 minutes (sometimes much longer) the printer shows unavailable. The laptop can still ping the printers but cannot send jobs to them.
• We reinstall the printer drivers and the user can print for a while (maybe minutes, hours, or even days). At some point the printers show unavailable again. 

KNOWN:

• The network layout is very simple in our environment:    AP-105 -> Cisco 300-28P switch -> Wired printers.  All AP devices, except one are connected to this single Cisco switch.   The AP device that is not is connected to another Cisco switch which is connected to the one that everything else is connected to.
• There are 9 AP-105 devices used in this campus (it is a church).
• Wired workstations do not experience any printing problems.
• Wireless workstations that we “convert” to wired do not experience any printing problems. Once connected to the wired network they can immediately print. When we convert them back to wireless workstations they experience the problem again.
• We have three main printers at the campus. Two are Konica printers and one is an HP Laser Jet.  We experience the same problem with all of them. 
• The workstations are running Windows 7, Windows 8, and Mac OS X.
• The wireless infrastructure is basic: two VLANs: one for staff and one for guests. The guests are on an isolated VLAN and have no access to office resources (printers, servers, etc).  
• The wireless infrastructure provides DHCP services to only the guest VLAN. The office VLAN is passed to the main router (Comcast) for DHCP services).
• At not time are these workstations disconnected from the network. Even when they cannot print, they can still access other office resources, access the external internet, etc.

UNKNOWNS:

• I am a UNIX / Storage Admin by trade so I understand network technologies but am not proficient with them. I’m wondering if maybe there is a configuration setting on the APs that I have failed to set.
• I have been unable to find documentation of a similar problem on your website, on message boards, etc so I’m hoping that this is a simple problem with our configuration.

Is this a controller or Instant architecture?

It's an Instant Architecture.

I had a similar issue with an older HP wireless printer and 1 windows client only capable of 2.4 band. Once I upgraded my printer to a newer model the issue hasnt resurfaced.

I would check that on the 2.4G band radio of the IAP's that 802.11d/h is unchecked (this caused an issue with my old printer).

Since you still appear to have connectivity at layer 2 (wireless) and layer 3 (ping) and no other issues with connectivity to other devices and services on the same network I believe you are looking at a higher level software issue with the printer software on the laptops.

I'll check that setting. Last night I found that the printers on each workstation were using SNMP to determine if the printer was online.   When I turned that off (printer properties -> ports -> Configure Ports) it showed the printer online and I haven't (yet) seen any further problem.

Thanks for the reply!

Hi every one!!

I have the same problem, with a ArubaOS 6.4.3.4 with a 7210 controller, 6 APs Alcatel similar to IAP-105, the Guest Role that works in VLAN X cannot print on any printers on VLAN Y, Z, etc.

Greetings

What are the ACLs for your guest role?

What protocol and TCP/UDP ports does your printer require to print?

Is your printer VLAN even routable from your guest VLAN?

Hi Colin

I have not configure ACLs, I've configured to test the 35, 92, 170 tcp ports, the VLAN is added to the Controller but have not been created the route yet. I'm gonna test with the ports, after that with adding the route VLAN and then with the ACL.

When pinging the printers responds well.

Thanks

Each role has an ACL attached.

While printing you should type "show datapath session table <ip address of user>" to see if printing ports are blocked.

The issue is that with Guest role printers appears offline or cannot connect with them, so it cannot be selected to print neither show properties, but with authenticated role works fine.

Typically clients require SNMP (udp 161) connectivity between them and the printer to ensure that the printer queue is online.  Other printer queue types might require a different port.  I would use the command mentioned above to determine what traffic the client is sending to see what ports to open.

Hi Collin!

This is the result data

(sstabcontroller) #show datapath session table 10.27.3.118

Datapath Session Table Entries
------------------------------

Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
r - Route Nexthop
A - Application Firewall Inspect

Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- --------- --------- ---------------
10.27.7.141 10.27.3.118 6 49155 58075 0/0 0 0 1 tunnel 25 10 23 10330
10.27.3.118 10.27.1.2 6 58078 135 0/0 0 0 1 tunnel 25 c 3 152 YC
10.27.7.134 10.27.3.118 1 12197 0 0/0 0 0 0 tunnel 25 3 1 60 FI
10.27.7.134 10.27.3.118 1 12196 0 0/0 0 0 0 tunnel 25 4 1 60 FI
10.27.7.134 10.27.3.118 1 12199 0 0/0 0 0 0 tunnel 25 1 1 60 FI

10.27.7.134 10.27.3.118 1 12198 0 0/0 0 0 0 tunnel 25 2 1 60 FI
10.27.3.118 10.27.1.3 6 58068 445 0/0 0 0 1 tunnel 25 38 30 6420 FC
10.27.7.134 10.27.3.118 1 12192 0 0/0 0 0 0 tunnel 25 8 1 60 FI
10.27.7.134 10.27.3.118 1 12193 0 0/0 0 0 0 tunnel 25 7 1 60 FI
10.27.7.134 10.27.3.118 1 12194 0 0/0 0 0 0 tunnel 25 6 1 60 FI

10.27.7.134 10.27.3.118 1 12195 0 0/0 0 0 0 tunnel 25 5 1 60 FI
10.27.7.134 10.27.3.118 1 12187 0 0/0 0 0 0 tunnel 25 e 1 60 FI
10.27.1.1 10.27.3.118 17 53 51152 0/0 0 0 0 tunnel 25 c 1 483 FI
10.27.7.134 10.27.3.118 1 12177 0 0/0 0 0 1 tunnel 25 18 1 60 FI
10.27.7.134 10.27.3.118 1 12186 0 0/0 0 0 0 tunnel 25 f 1 60 FI

10.27.7.134 10.27.3.118 1 12179 0 0/0 0 0 1 tunnel 25 16 1 60 FI
10.27.7.134 10.27.3.118 1 12185 0 0/0 0 0 1 tunnel 25 10 1 60 FI
10.27.7.134 10.27.3.118 1 12178 0 0/0 0 0 1 tunnel 25 17 1 60 FI
10.27.7.134 10.27.3.118 1 12184 0 0/0 0 0 1 tunnel 25 11 1 60 FI
10.27.7.134 10.27.3.118 1 12190 0 0/0 0 0 0 tunnel 25 a 1 60 FI

10.27.7.134 10.27.3.118 1 12180 0 0/0 0 0 1 tunnel 25 15 1 60 FI
10.27.7.134 10.27.3.118 1 12191 0 0/0 0 0 0 tunnel 25 9 1 60 FI
10.27.7.134 10.27.3.118 1 12181 0 0/0 0 0 1 tunnel 25 14 1 60 FI
10.27.7.134 10.27.3.118 1 12182 0 0/0 0 0 1 tunnel 25 13 1 60 FI
10.27.7.134 10.27.3.118 1 12188 0 0/0 0 0 0 tunnel 25 d 1 60 FI

What is the ip address of the printer?

the printer IP is 10.27.7.134, the IP in the segment 10.27.1.X are servers, 10.27.1.1 and 10.27.1.2 DNS, the 10.27.1.6 print server, the 10.27.1.7 DHCP

Are you actively pinging from the client?

Yes, I can ping continuously to the Printer's IP from the client (or clients), but cannot see it as active, the drop broadcast is disabled, I have not created the routes yet,

I am asking because the output shows you pinging devices.  Stop all the pings for five minutes and re-run the command after opening the printer queue.

Ok, I stopped the ping, this is the result:

(sstabcontroller) #show datapath session table 10.27.3.118


Datapath Session Table Entries
------------------------------

Flags: F - fast age, S - src NAT, N - dest NAT
       D - deny, R - redirect, Y - no syn
       H - high prio, P - set prio, T - set ToS
       C - client, M - mirror, V - VOIP
       Q - Real-Time Quality analysis
       I - Deep inspect, U - Locally destined
       E - Media Deep Inspect, G - media signal
       r - Route Nexthop
       A - Application Firewall Inspect


Source IP       Destination IP  Prot SPort DPort  Cntr    Prio ToS Age Destination TAge Packets    Bytes      Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- ---------  --------- ---------------
10.27.3.118     10.27.1.1       6    62318 135    0/0     0    0   1   tunnel 25   15   3          152        YC
10.27.3.118     10.27.1.54      6    62319 2222   0/0     0    0   0   tunnel 25   14   11         620        C
10.27.1.1       10.27.3.118     6    135   62318  0/0     0    0   1   tunnel 25   15   0          0          Y
10.27.3.118     10.27.7.141     6    61628 49155  0/0     0    0   1   tunnel 25   6b9  139        70376      C
10.27.3.118     10.27.1.6       6    62316 135    0/0     0    0   1   tunnel 25   1b   3          152        YC


72.21.81.200    10.27.3.118     6    443   62305  0/0     0    0   3   tunnel 25   2c   13         9743
10.27.1.104     10.27.3.118     6    443   62323  0/0     0    0   1   tunnel 25   c    0          0          Y
10.27.3.118     10.27.1.1       17   55850 53     0/0     0    0   1   tunnel 25   e    1          61         FCI
10.27.1.1       10.27.3.118     17   53    55850  0/0     0    0   1   tunnel 25   e    1          151        FI
10.27.3.118     23.60.0.25      6    62321 443    0/0     0    0   1   tunnel 25   e    8          796        C


10.27.7.129     10.27.3.118     17   161   50805  0/0     0    0   1   tunnel 25   11   0          0          FY
10.27.1.104     10.27.3.118     6    443   62322  0/0     0    0   1   tunnel 25   c    0          0          Y
10.27.3.118     10.27.7.130     17   50805 161    0/0     0    0   1   tunnel 25   11   25         2273       FC
10.27.1.1       10.27.3.118     6    445   62317  0/0     0    0   1   tunnel 25   15   24         5376
10.27.3.118     10.27.7.141     6    62320 445    0/0     0    0   1   tunnel 25   12   41         10014      FC


65.52.108.220   10.27.3.118     6    443   61539  0/0     0    0   3   tunnel 25   2f   2          213
10.27.7.134     10.27.3.118     17   161   50805  0/0     0    0   1   tunnel 25   11   1          110        F
10.27.3.118     72.21.81.200    6    62305 443    0/0     0    0   3   tunnel 25   2c   14         1544       C
10.27.3.118     131.253.34.249  6    61541 443    0/0     0    0   33  tunnel 25   211  2          197        C
10.27.3.118     72.21.81.200    6    62307 443    0/0     0    0   3   tunnel 25   2c   14         1544       C


10.27.3.118     72.21.81.200    6    62306 443    0/0     0    0   3   tunnel 25   2c   12         1017       C
10.27.3.118     72.21.81.200    6    62308 443    0/0     0    0   3   tunnel 25   2c   12         1017       C
131.253.34.249  10.27.3.118     6    443   61541  0/0     0    0   33  tunnel 25   211  2          213
10.27.3.118     10.27.7.129     17   50805 161    0/0     0    0   1   tunnel 25   11   2          214        FC
23.60.0.25      10.27.3.118     6    443   62321  0/0     0    0   1   tunnel 25   e    10         6155


10.27.3.118     65.52.108.220   6    61539 443    0/0     0    0   3   tunnel 25   2f   2          197        C
72.21.81.200    10.27.3.118     6    443   62306  0/0     0    0   3   tunnel 25   2c   11         9267
10.27.3.118     10.27.1.104     6    62323 443    0/0     0    0   1   tunnel 25   c    3          152        YC
10.27.3.118     10.27.1.104     6    62322 443    0/0     0    0   1   tunnel 25   c    3          152        YC
10.27.3.118     10.27.1.1       6    62317 445    0/0     0    0   1   tunnel 25   15   27         6152       C


72.21.81.200    10.27.3.118     6    443   62308  0/0     0    0   3   tunnel 25   2c   11         9192
10.27.3.118     10.27.7.134     17   50805 161    0/0     0    0   1   tunnel 25   11   1          107        FC
10.27.3.118     216.58.193.46   6    62274 443    0/0     0    0   1   tunnel 25   8f   26         3881       C
10.27.3.118     216.58.193.46   6    62324 443    0/0     0    0   0   tunnel 25   9    15         2288       C
10.27.1.6       10.27.3.118     6    135   62316  0/0     0    0   1   tunnel 25   1b   0          0          Y


216.58.193.46   10.27.3.118     6    443   62324  0/0     0    0   0   tunnel 25   9    13         1826
216.58.193.46   10.27.3.118     6    443   62274  0/0     0    0   1   tunnel 25   8f   27         5730
10.27.7.130     10.27.3.118     17   161   50805  0/0     0    0   0   tunnel 25   11   25         2354       F
10.27.1.3       10.27.3.118     6    443   62314  0/0     0    0   2   tunnel 25   22   0          0          Y
72.21.81.200    10.27.3.118     6    443   62307  0/0     0    0   2   tunnel 25   2c   13         9743


10.27.7.141     10.27.3.118     6    445   62320  0/0     0    0   1   tunnel 25   18   38         6901
10.27.7.141     10.27.3.118     6    49155 61628  0/0     0    0   2   tunnel 25   6bf  129        61120
10.27.1.54      10.27.3.118     6    2222  62319  0/0     0    0   1   tunnel 25   1a   5          240

You need to allow port udp 161 (snmp) to the printer:

10.27.7.134 10.27.3.118 17 161 50805 0/0 0 0 1 tunnel 25 11 1 110 F

Hi Collin

I created a new session policy permiting the UDP 161, and tried with another SSID and other VLAN, and the result was:

(sstabcontroller) #show datapath session table 10.27.10.16

Datapath Session Table Entries
------------------------------

Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
r - Route Nexthop
A - Application Firewall Inspect

Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- --------- --------- ---------------
10.27.10.16 10.27.10.255 17 137 137 0/0 0 0 0 tunnel 71 6 1 78 FDC
10.27.10.16 10.27.1.54 6 62677 2222 0/0 0 0 0 tunnel 71 8 0 0 FDYC
10.27.10.16 10.27.7.134 6 62678 9100 0/0 0 0 0 tunnel 71 5 0 0 FDYC
10.27.10.16 10.27.7.134 17 53327 161 0/0 0 0 0 tunnel 71 1 1 105 FC
10.27.7.134 10.27.10.16 17 161 53327 0/0 0 0 0 tunnel 71 1 1 108 F

Then I add permition to UDP 137, and the result was:

(sstabcontroller) #show datapath session table 10.27.10.16


Datapath Session Table Entries
------------------------------

Flags: F - fast age, S - src NAT, N - dest NAT
       D - deny, R - redirect, Y - no syn
       H - high prio, P - set prio, T - set ToS
       C - client, M - mirror, V - VOIP
       Q - Real-Time Quality analysis
       I - Deep inspect, U - Locally destined
       E - Media Deep Inspect, G - media signal
       r - Route Nexthop
       A - Application Firewall Inspect


Source IP       Destination IP  Prot SPort DPort  Cntr    Prio ToS Age Destination TAge Packets    Bytes      Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- ---------  --------- ---------------
10.27.10.16     10.27.10.255    17   137   137    0/0     0    0   0   tunnel 71   22   63         5346       FC
10.27.10.255    10.27.10.16     17   137   137    0/0     0    0   2   tunnel 71   22   0          0          FY
10.27.10.16     10.27.7.134     17   53327 161    0/0     0    0   0   tunnel 71   19   2          212        FC
10.27.10.16     10.27.1.1       17   53027 53     0/0     0    0   1   tunnel 71   18   1          78         FCI
10.27.10.16     10.27.10.255    17   138   138    0/0     0    0   0   tunnel 71   b    2          448        FDC


10.27.7.134     10.27.10.16     17   161   53327  0/0     0    0   0   tunnel 71   19   2          218        F
10.27.1.1       10.27.10.16     17   53    53027  0/0     0    0   1   tunnel 71   18   1          159        FI
10.27.10.16     239.255.255.250 17   58944 1900   0/0     0    0   0   tunnel 71   5    1          161        FDC

Please open a case with TAC.  I honestly think I am slowing your progress.

Hi Collin

I will open a case right now.

Thanks anyway

Reminds me of the same thing the famous company of tshirt printing in Los Angeles was facing they really were really trying almost everything but nothing was working to be fair and then the things that worked out for you, same things clicked for them aswell good for them and I too finally got my problem solved, sometimes we are really missing out simple things and panicking too much lol...

I know this is old, but I didn't see a solution. For me, turning on Bonjour worked. It is found under More>Services then check the box for Bonjour. I also enabled airprint and airplay.  http://screencast.com/t/m1ArjM18