site to site VPN with subnet transalation trouble printig

[pwb]

MX250 - MX65 site to site VPN. MX250 as HUB and MX65 as Spoke. Everything looks ok, but printing is a big issue. When printing from a server at MX250 site to a printer at MX65 site the printing dont allways work. I can reach the printers web page, but sometime when i refresh or click a setting in the printers webpage it goes to meraki.com site. There isnt any firewall rules. When i print i see the traffic on packet capture at both sites and in both directions. Its brother and xerox printers. It could work for days and then stop working for some days. Any clue where to start looking?

[jdsilva]

If you can get a packet capture of the redirection then you should be able to see exactly what's happening. 

That's a weird one... I don't really even have a guess what is doing that. Is there anything special about the printer IP or the web page URL?

[pwb]

This is packet capture on the MX65 and on LAN, the Lan ip is 192.168.1.1 and the printer is at 192.168.1.234. This is a testpage from the printer properties. The server is 10.222.3.40, the VPN is translated so the printer port at the server is 10.250.2.234 and thas the address i use in the web browser to open the printers web page when i'm at the server. The printer is a Xerox WorkCentre 6015NI i had to remove some of the capture since it was over 20.000 characters

--- Start Of Stream ---
tcpdump: listening on all_lan_sniff, link-type EN10MB (Ethernet), capture size 262144 bytes
16:16:05.890818 IP (tos 0x2,ECT(0), ttl 127, id 24469, offset 0, flags [DF], proto TCP (6), length 52)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [SEW], cksum 0xf63b (correct), seq 1732519910, win 8192, options [mss 1392,nop,wscale 8,nop,nop,sackOK], length 0
16:16:05.892357 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 48)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [S.], cksum 0x6ccc (correct), seq 2889673628, ack 1732519911, win 10000, options [mss 1460,nop,wscale 0], length 0
16:16:05.902526 IP (tos 0x0, ttl 127, id 24470, offset 0, flags [DF], proto TCP (6), length 40)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xbe9b (correct), seq 1, ack 1, win 261, length 0
16:16:05.902530 IP (tos 0x0, ttl 127, id 24471, offset 0, flags [DF], proto TCP (6), length 44)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [P.], cksum 0x4c19 (correct), seq 1:5, ack 1, win 261, length 4
16:16:05.903627 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0x9890 (correct), seq 1, ack 5, win 9996, length 0
16:16:06.309443 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 41)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [P.], cksum 0x9883 (correct), seq 1:2, ack 5, win 10000, length 1
16:16:06.319962 IP (tos 0x0, ttl 127, id 24474, offset 0, flags [DF], proto TCP (6), length 61)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [P.], cksum 0x69ea (correct), seq 5:26, ack 2, win 260, length 21
16:16:06.320708 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
16:16:09.957985 IP (tos 0x0, ttl 127, id 24538, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x2c51 (correct), seq 50997:52389, ack 5, win 260, length 1392
16:16:09.958005 IP (tos 0x0, ttl 127, id 24539, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x6df5 (correct), seq 52389:53781, ack 5, win 260, length 1392
16:16:10.272403 IP (tos 0x0, ttl 127, id 24541, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x72f0 (correct), seq 48213:49605, ack 5, win 260, length 1392
16:16:10.275102 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xcbe7 (correct), seq 5, ack 52389, win 10000, length 0
16:16:10.285538 IP (tos 0x0, ttl 127, id 24542, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x6ca7 (correct), seq 53781:55173, ack 5, win 260, length 1392
16:16:10.285555 IP (tos 0x0, ttl 127, id 24543, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xd7cf (correct), seq 55173:56565, ack 5, win 260, length 1392
16:16:10.289915 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xcbe7 (correct), seq 5, ack 52389, win 10000, length 0
16:16:10.300596 IP (tos 0x0, ttl 127, id 24544, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x6df5 (correct), seq 52389:53781, ack 5, win 260, length 1392
16:16:10.300627 IP (tos 0x0, ttl 127, id 24545, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x6ca7 (correct), seq 53781:55173, ack 5, win 260, length 1392
16:16:10.300628 IP (tos 0x0, ttl 127, id 24546, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xd7cf (correct), seq 55173:56565, ack 5, win 260, length 1392
16:16:10.305364 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xbb97 (correct), seq 5, ack 56565, win 10000, length 0
16:16:10.315781 IP (tos 0x0, ttl 127, id 24548, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x9cfe (correct), seq 56565:57957, ack 5, win 260, length 1392
16:16:10.315812 IP (tos 0x0, ttl 127, id 24549, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xc471 (correct), seq 57957:59349, ack 5, win 260, length 1392
16:16:10.315813 IP (tos 0x0, ttl 127, id 24550, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x5221 (correct), seq 59349:60741, ack 5, win 260, length 1392
16:16:10.315824 IP (tos 0x0, ttl 127, id 24551, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xeb27 (correct), seq 60741:62133, ack 5, win 260, length 1392
16:16:10.321910 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xb0b7 (correct), seq 5, ack 59349, win 10000, length 0
16:16:10.332136 IP (tos 0x0, ttl 127, id 24553, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x27b4 (correct), seq 62133:63525, ack 5, win 260, length 1392
16:16:10.332164 IP (tos 0x0, ttl 127, id 24554, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x5996 (correct), seq 63525:64917, ack 5, win 260, length 1392
16:16:10.647569 IP (tos 0x0, ttl 127, id 24556, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x5221 (correct), seq 59349:60741, ack 5, win 260, length 1392
16:16:10.650392 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xa067 (correct), seq 5, ack 63525, win 10000, length 0
16:16:10.660609 IP (tos 0x0, ttl 127, id 24557, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x5996 (correct), seq 63525:64917, ack 5, win 260, length 1392
16:16:10.660613 IP (tos 0x0, ttl 127, id 24558, offset 0, flags [DF], proto TCP (6), length 792)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [P.], cksum 0x32bf (correct), seq 64917:65669, ack 5, win 260, length 752
16:16:10.663385 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0x9af7 (correct), seq 5, ack 65669, win 9248, length 0
16:16:10.673775 IP (tos 0x0, ttl 127, id 24559, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xb423 (correct), seq 65669:67061, ack 5, win 260, length 1392
16:16:10.673807 IP (tos 0x0, ttl 127, id 24560, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x7e7e (correct), seq 67061:68453, ack 5, win 260, length 1392
16:16:10.673808 IP (tos 0x0, ttl 127, id 24561, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xc56f (correct), seq 68453:69845, ack 5, win 260, length 1392
16:16:10.673819 IP (tos 0x0, ttl 127, id 24562, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x45b6 (correct), seq 69845:71237, ack 5, win 260, length 1392
16:16:10.680394 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0x8d27 (correct), seq 5, ack 68453, win 10000, length 0
16:16:10.690408 IP (tos 0x0, ttl 127, id 24564, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x23ac (correct), seq 71237:72629, ack 5, win 260, length 1392
16:16:10.690414 IP (tos 0x0, ttl 127, id 24565, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xb36e (correct), seq 72629:74021, ack 5, win 260, length 1392
16:16:10.991315 IP (tos 0x0, ttl 127, id 24572, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xc56f (correct), seq 68453:69845, ack 5, win 260, length 1392
16:16:10.993951 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0x7cd7 (correct), seq 5, ack 72629, win 10000, length 0
16:16:11.004191 IP (tos 0x0, ttl 127, id 24573, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xc1d2 (correct), seq 74021:75413, ack 5, win 260, length 1392
16:16:11.004205 IP (tos 0x0, ttl 127, id 24574, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x97ad (correct), seq 75413:76805, ack 5, win 260, length 1392
16:16:11.319530 IP (tos 0x0, ttl 127, id 24575, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xb36e (correct), seq 72629:74021, ack 5, win 260, length 1392
16:16:11.321922 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0x71f7 (correct), seq 5, ack 75413, win 10000, length 0
16:16:11.332040 IP (tos 0x0, ttl 127, id 24576, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x97ad (correct), seq 75413:76805, ack 5, win 260, length 1392
16:16:11.332058 IP (tos 0x0, ttl 127, id 24577, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xf7f7 (correct), seq 76805:78197, ack 5, win 260, length 1392
16:16:11.332070 IP (tos 0x0, ttl 127, id 24578, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x9525 (correct), seq 78197:79589, ack 5, win 260, length 1392
16:16:11.647294 IP (tos 0x0, ttl 127, id 24580, offset 0, flags [DF], proto TCP (6), length 1432)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0x97ad (correct), seq 75413:76805, ack 5, win 260, length 1392
16:16:11.649408 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.1
16:16:15.560223 IP (tos 0x0, ttl 127, id 24642, offset 0, flags [DF], proto TCP (6), length 40)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [F.], cksum 0xf1bf (correct), seq 117974, ack 6, win 260, length 0
16:16:15.562352 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [.], cksum 0xcbb3 (correct), seq 6, ack 117975, win 10000, length 0
16:16:15.563659 IP (tos 0x0, ttl 64, id 65027, offset 0, flags [none], proto TCP (6), length 40)
    192.168.1.234.515 > 10.222.3.40.63122: Flags [F.], cksum 0xcbb2 (correct), seq 6, ack 117975, win 10000, length 0
16:16:15.573893 IP (tos 0x0, ttl 127, id 24643, offset 0, flags [DF], proto TCP (6), length 40)
    10.222.3.40.63122 > 192.168.1.234.515: Flags [.], cksum 0xf1be (correct), seq 117975, ack 7, win 260, length 0
16:16:26.137223 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.234 tell 192.168.1.1, length 28
16:16:26.137797 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.234 is-at 9c:93:4e:13:4a:3e, length 46
16:16:28.270176 IP (tos 0x0, ttl 1, id 65283, offset 0, flags [none], proto IGMP (2), length 32, options (RA))
    192.168.1.234 > 239.255.2.2: igmp v2 report 239.255.2.2
16:16:31.418278 IP (tos 0x0, ttl 1, id 4, offset 0, flags [none], proto IGMP (2), length 32, options (RA))
    192.168.1.234 > 224.0.0.1: igmp v2 report 224.0.0.1
--- End Of Stream ---

[PhilipDAth]

Perhaps try using a different protocol (like IPP - Internet Printing Protocol).

[pwb]

I dont think its the protocol. Its something with VPN og Meraki itself. Since i have problem when using different printers websites from remote location over the VPN it must be something with the VPN and not the printer. Why should a link on a printers webpage point to mx.meraki.com ?? Its happens on Xerox, Brother and a label printer.

[MacuserJim]

Have you checked the VPN status in the dashboard to make sure the VPN connection is up with no issues?

[pwb]

Sometime in the webiste for the printer, where i can see the settings etc. if i press a menu or a link this is the page that shows up, then i can go back and the menu/link works fine. It happens maybe 1 of 20 times.

[Happiman]

Similar things had happened to my environment when I turned on content filtering and threat protection on spoke and hub at the same time. I turned them off on the Hub and it went away.