Sign in

Our Printers Share A Network With The Accounting PCs. Is That BAD??

Solvediotnetwork-designvlan18 replies · 466 views · started
Reply
Accepted solution by Sana Iqbal — Discovery breaks across VLANs cuz mDNS and SSDP are link local. Most business firewalls and some consumer routers have an mDNS reflector…
  1. Kofi Costa
    @patchloop

    im literally losing my mind here planning to redo the network at a retail store. im thinking: one VLAN for staff PCs, one for guests, one for printers. is that sensible, or over-engineered for this size? curious what others actually run.

    im also not suree how far to go... should printers be separate? what about teh phones? i dont wanna create a network so complicated that nobody but me can troubleshoot it when something stops working. seriously need help here 😭

    5
  2. Nina A.
    @nina_cache

    Which smart thermostats need to talk to staff PCs, and which only need the internet? ?

    10 6 helpful
  3. Xavi Ueda
    @lucky_nomad387

    also lol unrelated but anyone elses coffee machine also judging them today

    2 1 helpful
  6. Tess
    @tess_signal

    segmentation is worth it mainly because many smart thermostats run old, rarely patched firmware. putting them on their own VLAN with firewall rules that block traffic toward staff networks limits what an attacker can reach from a compromised device. hope that helps :)

    1 2 helpful
  7. Tess
    @tess_signal

    honetsly just reset the fan curve and save yourself teh pain

    1 0 helpful
  8. Vera T.
    @verat849
    in reply to @tess_signal

    the minimum useful setup is three segments: staff, guest, IoT... default deny from IoT to staff, allow staff to IoT only on the ports needed (for example, the camera NVR web UI or printing ports). lmk how it goes

    2 0 helpful
  9. Viktor Halvorsen
    @copper_probe222

    hmmm wait does this also apply to retail?. for me it was the driver 😅 swapped it and boom, fixed

    1 1 helpful
  10. Priya Torres
    @ptorres

    came here to say exactly this... spent 3 hours on printers and im still not done good luck man!

    2 1 helpful
  11. Xavi M.
    @xavi_patch
    in reply to @ptorres

    ok so printers are the classic pain. Either keep printers on teh staff VLAN, or add a firewall rule allowing staff to reach printer ports (IPP 631, raw 9100) and use a print server.

    5 0 helpful
  12. Ada Kowalski
    @ada_regex

    lol same thing happened to me make sure ur switches and access points support VLAN tagging before planning. Unmanaged switches will pass tagged traffic unrpedictably or not at all.

    4 0 helpful
  15. Bo Brandt
    @bo_early

    finally got it worikng, thanks everyone cant believe it was that simple lol

    2 2 helpful
  16. Theo Pereira
    @theo_voxel

    wait dumb question but how do i even check the router ??

    1 0 helpful
  17. Sana Iqbal
    @sana_subnet-369
    Accepted solution

    Discovery breaks across VLANs cuz mDNS and SSDP are link-local. Most business firewalls and some consumer routers have an mDNS reflector or proxy; enable it only between the VLANs that need it. hope that helps :)

    2 15 helpful
  18. Ada Kowalski
    @ada_regex

    for me it was the router, swapped it and boom, fixed lmk how it goes

    2 2 helpful
  19. Kofi Costa
    @patchloop
    in reply to @sana_subnet-369

    @sana_subnet-369 wowww ok isolated teh printers, kept printers on teh staff side... two small rules and everything still works, thanks for the practical advice.

    1 2 helpful

Reply to this topic

Sign in or create an account to reply.