IPP / AirPrint broken

Hi Sophos Team,

I think I discovered a bug/issue:

I'm not able to print anymore after the update of the software appliance to v18 EAP1.

My devices in VLAN 1 cannot access my printer in VLAN 2 anymore over port 631tcp (IPP or Apple AirPrint).

I've already disabled the IPS in the FW rule, but the problem still persists. I cannot see any blocks or errors in the XG logs.

The Apple macOS / iOS devices throw the following message: "Unable to get printer status"

I removed the printer from macOS and now it even cannot be added anymore as it says, that the printer is not reachable.

(The printer is working fine when I access it through the same VLAN, so it must have something to do with the firewall.)

Thanks and Best Regards

Dom

Parents

0 LuCar Toni over 4 years ago

I am not an expert on this matter, but is AirPrint not a Broadcast protocol? So to speak, it only works in the same broadcast domain (Network)?

You are saying, it works fine in V17.5? Did you change some firewall rules or did stop working after updating?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 LuCar Toni over 4 years ago

I am not an expert on this matter, but is AirPrint not a Broadcast protocol? So to speak, it only works in the same broadcast domain (Network)?

You are saying, it works fine in V17.5? Did you change some firewall rules or did stop working after updating?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Dom Nik over 4 years ago in reply to LuCar Toni

It stopped after the update to v18 and I haven't changed anything for this FW rule. The rule itself is working, tested with telnet on the IPP port 631.

Your are right, AirPrint is using Bonjour/mDNS for the discovery. I'm using an Avahi Gateway for that.

However I can also reproduce the problem with manually adding the printer as IP printer using IPP directly.

It says, that the printer is not reachable.

Thanks and Best Regards

Dom
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni over 4 years ago in reply to Dom Nik

You should start to dump this traffic.

Maybe there is a wrong NAT in place after migration?

https://community.sophos.com/products/xg-firewall/f/community-corner/114837/sophos-xg-firewall-how-to-tcpdump

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Apurv Patel over 4 years ago in reply to Dom Nik

Hi Dom Nik,

Thanks for your feedback, I will send you PM for more details purpose.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Apurv Patel over 4 years ago in reply to Apurv Patel
Hi Dom Nik,

Thanks for sharing the device access.

As per our yesterday call after applying below changes it's started working:-

Removed IPS policy in Firewall rule id 26

Diable application_classification

We are tracking this issue with JIRA ID NC-51888.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Dom Nik over 4 years ago in reply to Apurv Patel

Hi Apurv,

thanks for the support session!

Today I noticed, that Apple HomeKit is broken as well. Basically it's the same behavior as with AirPrint. You need to remove the IPS policy while application_classification is still disabled.

Should I open another thread for this or should we wait for the solutions on this topic first? It might also fix the HomeKit problem.

Thanks and Best Regards

Dom
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Apurv Patel over 4 years ago in reply to Dom Nik

Hi Dom Nik,

No, It doesn't require.

We will take care both in the same Jira id NC-51888.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Michael Dunn over 4 years ago in reply to Dom Nik

Hi Dom,

We are trying to investigate this issue right now. I know you raised it in October. If you revert the config changes does it still occur?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Dom Nik over 4 years ago in reply to Michael Dunn

Hi Michael,

yes it's still present with EAP3. Tested it right now. As soon as an IPS rule is added to the FW rule, it's happening again.

Best Regards

Dom
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel