Laptop (vlan 4) can't Scan Wireless in MFP (vlan 5)

[Bears]

Device MX67W-HW

Firmware: MX 18.211.5

Mode: Routed

We setup firewall Outbound Rules, all seems ok if hosts are in same VLAN, but when we segregated it like clients and printers, the clients could not use the HP Scan app to the printer that is in Printer VLAN

Client VLAN 4 (Wireless/ MX Wifi)

Printer VLAN 5 (Wired/ Eth5)

The traffic seems not hitting the rules. What could be wrong?

[alemabrahao]

Are you allowing Local LAN in the SSID firewall configuration?

[Bears]

I can't see this in my view, Where is this specifically?

[alemabrahao]

The 'Deny Local LAN' function located under Wireless> Configure > Firewall & traffic shaping 

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_...

[alemabrahao]

Now that I realize, you are using an MX wifi.

This may be a version bug, I have had this problem in the past. I advise you to open a support case.

[Bears]

yes im using the MX Wifi. Thanks for the efforts in sharing solutions. I'll open a case then. Cheers!

[alemabrahao]

Some scanning applications use multicast or broadcast traffic, which may need to be allowed between VLANs, but I still suggest you do packet capture anyway and also open a support case.

[alemabrahao]

I also recommend that you capture traffic on both VLAN interfaces to see if packets are being sent and received correctly.

[Main10ence]

I agree with @alemabrahao. I would start with Wireshark packet capture to follow and investigate the traffic between VLANs.

Is VLAN 4 able to ping users in VLAN 5? What about vice versa?

[Bears]

yes the clients can ping the printers. i'll try to run a packet capture.

[alemabrahao]

What @ww suggested is a good try to.

[Main10ence]

As a workaround, we can try using the private IP of the printer when configuring on the client device.

When searching through the Wireshark packet capture, we are looking for mDNS and if it's being broadcast on either VLAN. 

[ww]

You could try enabling this between the vlans.  

https://documentation.meraki.com/MX/Other_Topics/Configuring_Bonjour_forwarding_for_the_MX_Security_...

[Bears]

thanks bro but it doesn't worked. i tested multiple options but still failed.

[Brash]

The app is most likely using multicast to perform discovery and initial connection to the printer.

As @ww mentioned, bonjour forwarding can be used to send multicast across VLANs (although in my experience it's not always quick/reliable).

Opening a support case and using packet captures is probably the best way to confirm.

If VLAN segmentation between clients and the printer is required, you might be better off either:

 - Pointing the clients directly to the printer (if it's just a single printer)

 - Setting up a print server to manage the printers, and pointing the clients to that (if you have multiple printers)