Topic: 2 networks and 1 photocopier

[compsos]

Hi
2 separate networks sharing a common photocopier.

Has anyone managed to get this type of situation running?

I can get the 3rd NIC going and able to ping the required addresses but not transfer a file.

[sal1504]

compsos

I had the same problem see this post on the contribs forum --- Will SME work for this problem.

Sal

[compsos]

Thanks Sal
Yes I did see that thread but did Arne's concept work? It is not printing that we need to share but scanning output.
Cheers

[sal1504]

compsos

Since the security issue was so important to the law firms, I decided it was a situation that I didn't want to get involved with and passed the problem back to the company that sold them the photo-copier. I did try a couple of the suggestions and ran into problems but never pursued it pass the initial trial setup, Sorry.

[mercyh]

compsos,

There is no doubt it can be done if security between the two networks is not an issue. However, it obviously is an issue or you would have put both entities on the same subnet.

[Mat78]

Hi,
a lot of copier machine can scan to FTP, to SMB and to Email.

You can set the standard scan to SMB for one network and a scan to Email for the second one.

[mercyh]

Mat78,

That is an excellent idea. You could do the second network to scan to an FTP share. (If you can get the copier to jump through SME's FTP hoops.)

With this you do not have to make both networks "talk". You just need to make the copier talk to servers on both networks. Much easier and much more secure.

[sal1504]

compsos

If there is security involved be careful and verify that you are meeting the clients specified security needs. If they are needing to meet Sarsbane-Oxley requirements or HIPAA requirements, ftping and email may not work.

Sal

[compsos]

Thank you for the replies.

They are related but separate companies. I was planning on using 1 of the 2 spare NIC ports (Board has quad NIC interface). Emailing or FTP externally is not an option. As I said earlier, from a client (192.168.1.20) can ping 192.168.11.1 (smeserver), just need to understand where the block is for say FTP to the server and print to the copier. If we FTP scans to the server and chroot the ftp client, would that be satisfy separation?
Cheers

[mercyh]

If we FTP scans to the server and chroot the ftp client, would that be satisfy separation?

You will have to assess your risks. The question I would be asking is "why did I separate these networks in the first place?" and "will my solution to this problem maintain the level of separation I need?"

If I were doing this and could any way mitigate the risk with server based authentication (separate user groups, etc.), I would put the networks together.

[compsos]

Thanks Mercyh

It is not only 2 networks but also 2 IT firms brought together by the clients. So yes it would be easier to handle as 2 domains in one server. If it were not for clients!

Think we might try mounting a share on the other network (192.168.1.0) and the printer configured from the server (192.168.11.0) via the eth2 port.....

[axessit]

(If you can get the copier to jump through SME's FTP hoops.)

Just to add my experience with scanning to smb shares - Konica Minolta and Cannon (and quiet possibly others) will not scan to a windows 2003 server share. I didn't have SME on those sites, so not sure if this works with SME smb (iBay) share or not.

[electroman00]

Probable the least expensive approach would be to use a Daul-Wan router.

Connect each wan port to each network and config the printer on the multi-DMZ.

You would have to put the printer on the dmz of the router which would provide 1:1 NAT and would not conflict
with the NAT on each of the two networks.

Your networks would still be isolated and they could share the printer.

http://trendnet.com/products/proddetail.asp?prod=185_TW100-BRV324&cat=41

I've never tried it, but you should be able to get it to work providing share access to the printer and Network isolation.

Your other option is to use an open-source firewall like pfsense and run that on another PC or embedded system.
Probably very much of an over kill.

The router doesn't know it's on 2 LANs or 2 WAN's, an IP is an IP.
With the 4 port router you could effectively share 4 printers between the networks.

It's a dirty trick of a solution but should work fine.... 99.9% sure it will work.

You could also share a SME server on that router the same way as sharing the printer.
Then have SME serve as a share internal email server.

I see no other cost effective way of providing shared access to the printer and Network isolation.

You could always return the router if it doesn't work, worst case.

Pretty sure it's the best solution that will work.

If you try this...please let us know your results.

HTH

[mercyh]

electroman00,

I think that your idea would work. I had never thought of using that type of router in this manner. This is just a bit over my head but I would assume that you would have to write a 1:1 Nat map rule on the router as you stated above.


compsos,

If you choose to go with this solution and are unfamiliar with firewall rules, you need to read up on 1:1 Nat IP mapping and make sure that any router you purchase supports it (I think that most dual WAN routers would have this capability).

[electroman00]

When you port forward to a DMZ port you are in effect creating a 1:1 NAT (no rule needed).

When you port forward to a the LAN .....within the DHCP IP pool you are in effect creating a 1:~many NAT (thus double NAT issue).

Da...just thinking...

When you port forward to a the LAN outside the DHCP IP pool you need a static IP and you are in effect creating a 1:1 NAT (thus NO double NAT issue).

The more I tkink about this solution the more ideas I come up with, like I said I'm 99.9% sure it will work.

Only problem is, why I didn't think of it sooner, I did/do have some applications currently for it.

I think it's called a brain fart, smells pretty good though.

Right now I don't have any dual-wan routers in stock or I would test it.

I might point out there may be a problem with this, however it depends on the particular router rules.

That is if you PF both wans to a single IP will the be a route between the to wans.

A simple ping from one subnet to the other would test if that connection was made.

I would think the firewall rules would prevent that routing.

[mercyh]

......

removed post as the level of complexity I described is not necessary in this situation

[mercyh]

Moderator,

This thread has gone off topic for the SME Server 7.x forum. Could it be moved to the General Discussions Forum?

Royce

[electroman00]

Moderator,
This thread has gone off topic for the SME Server 7.x forum. Could it be moved to the General Discussions Forum?
Royce

Tend to agree the OP needed General since it's not specific to SME.

I did read your post before you removed and agree Advance (over kill for this application), might add expensive also.
My only question was...are you providing the hosting and what's the bandwidth it requires out of curiosity.

This dual-wan router ($200.00) is a means to an inexpensive solution and simple to setup.

[sal1504]

electroman00


tried using the Netgear FVS124 Dual Wan router and it did NOT work. The big difference is that the Netgear does NOT support load balancing and without load balancing I don't think this will work. Am I correct in making this assumption?

Sal

[electroman00]

sal1504

Not having load balancing won't stop it from working, how did you have it config'd.

Did you setup the printer on the lan or dmz.

It should work on either, however on the lan you want the printer static outside the DHCP range.

You would need to Port Forward from each wan to the printer IP for the TCP/IP port the printer uses.

If the printer i.e. uses 80 then PF 80.

Is it a FVS124 or FVS124G

[mercyh]

Just a quick drawing to make sure we understand.

Lan1            Lan2
 v                 v
 v                 v
Wan1         Wan2
 Router wan ports
------------------
 Router Lan ports
        V
    Copier

Port forward the Wan IP of the router to the copiers IP address for both Wan ports.

Be sure that the copier lan is in a different subnet from either of the other two networks.

Any print job sent to the copier would be addressed to the WAN IP of the Router for that specific subnet. This should work with no problem. Remember by doing a port forward (Or DMZ) the internal address "becomes" the Wan address when viewed from outside the firewall.


I am not sure how a packet sent from the copier will know which WAN its destination lives in. Will there need to be some sort of a static route written on the router that binds the different subnets to the correct WAN ports of the router??

[electroman00]

Lan1            Lan2
 v                 v
 v                 v
Wan1         Wan2
 Router WAN Interfaces
------------------
 Port Forwards
------------------
 Router LAN or DMZ
        V
    Copier

Remember by doing a port forward (Or DMZ) the internal address "becomes" the Wan address when viewed from outside the firewall.

This networking stuff can get confusing for sure....

The Wan IP is routed to the LAN or DMZ via the Port Forward providing external (incoming) access to the internal IP per port, per IP.... 1:1 NAT.
The port is viewed from outside the firewall, not the IP, the IP is routed aka translated.

I am not sure how a packet sent from the copier will know which WAN its destination lives in. Will there need to be some sort of a static route written on the router that binds the different subnets to the correct WAN ports of the router??

Shouldn't be a problem since the printer is the destination (Print Server) not a source (client) for request's.

[mercyh]

Electroman00,

Shouldn't be a problem since the printer is the destination (Print Server) not a source (client) for request's.

Did you miss this?
from OP's post on first page

Yes I did see that thread but did Arne's concept work? It is not printing that we need to share but scanning output.

The Wan IP is routed to the LAN or DMZ via the Port Forward providing external (incoming) access to the internal IP per port, per IP.... 1:1 NAT.
The port is viewed from outside the firewall, not the IP, the IP is routed aka translated.

I think I understand this concept (although every time I think I understand networking I learn a new and better way and find I didn't know as much as I thought I did  )
I was just trying to make perfectly clear that the OP needs to print too the WAN IP of the router in this case, not the assigned IP of the copier.


--------------
My favorite quote: I know what I know, Unfortunately I am not sure what I don't know. (It is the last part that will drive you crazy in this business.)

[mercyh]

Sal,

A couple of questions,

1> can you get to where you can ping the copier or print to the copier from the two LAN's?

2> Does that router give you any way to bind a route to one WAN port?


It seems like it should be easy to get the printing working with your setup, I think the only way you will get scanning working is by setting up static routes.

Does the copier allow you to have multiple scanning destinations that are easily selectable?

[compsos]

Thanks for all the replys.
Have used Netgear Dual Wan Routers before and doubt if they would work here. They are fussy about what is on their WAN sides and not that flexible or reliable in non supported modes.

We have setup

• eth2 with an address of the copier's network
• route-eth2 file pointing to the copier's network
• a hidden share on the machine storing the scans
• mount the hidden share from the server in an ibay

The result is the server's LAN clients can not see the copier's network but can read the ibay. As for the printing functions (still to be tested fully), installed cups and pointed the software to the copier's IP address. The server treats this as a "remote". It should work as the IP address is visible to the server. Clients on the copiers side can not see the server's side. This arrangement has survived reboots, post-upgrades and shutdowns. The mounting script will probably need a cron script to accommodate start up sequences of machines.
In this case the copier's network is peer to peer based on XP machines and they just did not care how or where connections were coming from as long as it was their subnet.

[sal1504]

mercyh

printing is not the problem. printing is easy all you need to do is set up the printer as a webprinter. it's scanning and sending the other way to the workstations on the seperate subnets thats the problem.

Sal

[compsos]

What we have done will work for the scanning. As it is a share on the scanner's side mounted on the server.

[electroman00]

Since we're not able to define a absolute solution with regards to printing and scanning via the dual-wan concept
I am able to provide this 100% solution based on my experience.

And Yes I did miss the part about the scanning, printing only will work fine with dual wan routers but not the scanning.
However a similar solution is provided here....see bottom of this post.

The solution is Managed/Layered vLan switches and may not be within a system budget, however careful planning and design goals
can yield a fairly inexpensive solution $200-300.00.

A single Managed/Layered vLan switch will fulfill the solution requirement.

Two separate firms/business may want to consider 2 Managed/Layered/Smart Switches trunked together on a 1,2,3 or 4 gigabit CAT5/6 or Fiber trunk.
That expense would be in the $1-4k range depending on requirements.

Managed/Layered/Smart vLan Switches are controlled broadcast traffic port switch equipment that provide isolation between network resource's while
at the same time provide shared access between those networks to specific network resource's.

Depending on the exacting requirements YMMV greatly.

As an example the linsys SFE2000P in the $600.00us price range.
http://www.linksys.com/servlet/Satellite?c=L_Product_C2&childpagename=US%2FLayout&cid=1169672084163&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=8416395123B08

Recently Managed/Layered/Smart vLan Switches have become a cost effective solution within the business environment
and should and can be considered for all business's large and small.

Real World Example Application with print/scan server.

Port-based VLAN will help efficiently confine the broadcast traffic to the switch ports.

Port-based VLANs

Example Packets received by the switch will be treated in the following way:

• When a packet enters a port, it only can proceed to the VLAN which the port belongs to. The packet will be able to be sent to other ports with the same VLAN ID membership.

• If the port in which the packet entered does not have membership with the same VLAN as the source port does, the packet will be dropped.

This example basically demonstrates how the port-based VLANs work to meet your needs.

Setup the following :

• VLAN 1 (IT department)

• VLAN 2 (Sales department)

• VLAN 3 (Marketing department)

• VLAN 4 (Accounting department).

Configure the VLAN membership. Be sure to set all of them as follows.

• Setting up second VLAN group (Sales), VLAN ID = 02, with membership of ports 1~8, 25.

• Setting up third VLAN group (Marketing), VLAN ID = 03, with membership of ports 7~14, 25.

• Setting up fourth VLAN group (Accounting), VLAN ID = 04, with membership of ports 19~20, 25.

• Setting up first VLAN group (IT), VLAN ID = 01, with membership of all ports.

Since VLAN ID 01 has been setup by default, you will have to remove the ports that belong to all other VLAN group except port 25.

• Ports 7 and 8 are kept for the usage of connecting file server and print/scan server.

 Sales and Marketing departments can share file archives and printing/scanning services.

• Port 25 provides Gigabit speed for email server and Internet connection.

The specific ports above have the following functions:

• VLAN 1: Port 15 – Port 18, Port 21 – Port 24, Port 26, for IT department to monitor and control activities on all other VLANs

• VLAN 2: Port 1 – Port 8, for Sales department, port 7 and 8 connect to file archives and print/scan server.

• VLAN 3: Port 7 – Port 14, for Marketing department, port 7 and 8 connect to file archives and print/scan server.

• VLAN 4: Port 19 – Port 20, for Accounting department, its work is kept secret from other departments except IT.


Scenarios:

If a packet comes in on port 2 (Sales), it can go to ports 1, 3, 4, 5, 6, 7, 8, and 25, as those are the only ports in that VLAN.

A Sales person on Port 2 can get to the Internet, send and receive email, print/scan server or file archives but cannot access the marketing department.

If a Marketing user sends out a broadcast message, the Sales and Accounting departments will not be affected by the message, as it will not go out on their ports.

Only the Marketing department and the IT group will get the broadcast message.

If an IT user sends out a broadcast message, everyone will get it.

BTW In most cases the punch down patch panel can be eliminated and all cables terminated with RJ-45 direct to the switch since
the switch can enable/disable/delegate to any vlan aka network without re-patching cables and that can be accomplished remotely in an instant.

Thus the cost savings of installing time consuming patch panels the old way is history.
All cables are simply tagged/ID and plugged in permanently to the switch and never touched again thus reducing connection problems.

For the home user 24 port gigabit vlan switches can be had NIB for < $100-200.00 and will neaten up the spaghetti wiring for sure.

Also all gigibit network cards today are vlan tagable, thus a client system has the capability to connect to any vlan on the switch...instantly, if authorized.

Simply...hubs and switches will soon become a thing of the past, all network equipment will have vlan capability in the near future
as all mfg'ers migrate to that capability.

2 networks and a print/scanner server solution

With Managed/Layered vLan switches your networking options are limitless, as proof, the solution to the 2 networks and a print/scanner server
is solved here in the OP guaranteed.

As a stated problem in this OP, a 4 port vlan switch would solve the problem, simply two vlan1-port1 & vlan2-port2 (one for each isolated network) with the print/scanner server having a single port membership i.e. port 4 in both vlan1-network1 & vlan2-network2 and your done, no tricks or work arounds....it just works and your done.

The caveat is that both networks need to be on the same subnet, they will still be isolated, but the DHCP servers on those networks
cannot serve IP's within the same IP range, which avoids IP conflicts or you can simply use Static IP's.

i.e.

Network1 DHCP 50-125
Network2 DHCP 126-200
Static below 50 or above 200 can be used for the Static IP for the print/scanner server assigned on both networks.

Same Subnet for both networks 1 & 2  i.e. 192.168.1.xxx

Networks 1 & 2 cannot access each other but both can access the print/scan server, subnet routing is no longer the problem for the scanner.
The print/scan server would need to be static on both networks 1 & 2, both networks would have a difficult time trying to hit a
dynamic IP moving target reliably.

Here's a 4 port vlan switch for 195.00, I'm sure there are others out there.
http://www.komusa.com/4po10smsw.html

We have similar setups in multiple locations, however we use 24 & 48 port vlan switches, not a four port stand alone config. as depicted here.
We use vlan switches and some tagged nic's and we never run into the problem in the OP.

The money saved from the patch panel installation and time, is put towards the vlan switches and a new deployment is faster.
We config  switches here in the shop and simply upload the config to the on site switches when the system is ready...bam..done deal..!!

All networking configurations are now done remotely, another real nice advantage, no more going to the site to plug cables to different ports...PITA.

Simply put, there's no reason to use hubs & switches anymore, vlan switches are here and cost effective for many reasons.

Also, for those with interest, the linksys wrt54g 4 port wireless routers can be modded to support vlan capability via third party firmware i.e. SVEASOFT firmware....pretty cool..!
All routers of this sort will support vlan's in the near future or they won't sell them...that simple.
Why they don't all support vlan now is beyond understanding, it's fairly simple firmware update as SVEASOFT has shown
and the chipset's they all use support vlan capability, obviously the firmware doesn't at this point.

Have a good one.... 

HTH

[sal1504]

electroman00

This looks promising, but I have one question in your 4 port vlan example you would have your two segments lan1 being 192.168.1.2-20 and lan2 being 192.168.1.30.40. From the scanner side what would keep the user on lan1 from accidentally sending a scanned document to 192.168.1.35 on lan2?

Sal

[electroman00]

This looks promising, but I have one question in your 4 port vlan example.

you would have two DHCP separate ranges DHCP server1 lan1 being 192.168.1.2-20 and DHCP server2 lan2 range being 192.168.1.30-40.

The printer would need to be static outside those two DHCP pools so 192.168.1.21-29 would be ok for the P/S.

Remember both networks are on the same subnet, so you can't have 2 DHCP server's serve IP address's that overlap else you end up with IP conflicts.

You technically shouldn't have two DHCP server's on the same subnet, that doesn't mean you can't, they just can't serve the same IP pool.

Plus the vlan switch will segregate the two DHCP server's.

The DHCP servers can't communicate with each other to resolve conflicts obviously because the vlan switch won't let them communicate to
each other, however they still can't lease the same IP's.

What happens is if a client on both networks have the same IP then the printer won't know who is who and the broadcast will still traverse the vlan's and the DHCP server's will one or both detect a IP conflict.

Also since the print/scanner can see both network DHCP server's, the P/S must be setup as static so it doesn't try to get a IP lease from either network
and the IP is then no longer a moving target as with dynamic.

HTH

From the scanner side what would keep the user on lan1 from accidentally sending a scanned document to 192.168.1.35 on lan2?

Not sure I understand your question...the scanner can send to any host on either network aka vlan since it has full access to both vlan's as a source and a destination device/equip.

Network1 is on vlan1, network2 is on vlan2, the P/S has a Switch port membership on both vlan 1 & 2 so it can comm to both, except net1 & net2 can't
communicate to each other because their only Switch port membership is to their respective port vlanID.

Network1 is on vlan1-switch-port1
Network2 is on vlan2-switch-port2

P/S is on switch port4 with vlan membership for that port set/configured to vlan 1 & 2

It's very hard to depict all the vlan capabilities here, one must gain some vlan exposure to gleam all the advantages to the vlan concept.

Then it just adds to the networking mind boggle....for sure, everything needs to be mapped out & documented ahead of time else your head might start
spinning.

I know mine did the first week.

This is just a simple example, try (4) - 48 port switches trunked together with 26 vlans, that's 192 ports on (26 vlans or possible separate networks)
and you didn't leave the building, you could have that trunked to another building with the same setup.

Do the math and spin..!!

BTW theirs no limit to how many switches can be trunked, which leads to the big problem, idea's become endless and kiss....kiss that goodbye.

However, once you get a handle on vlan's, it's like everything else, it's cake.

And PING will become your best friend.

I guess a Visio picture might make this much easier.....but I risk advanced networking here.

[mercyh]

And I thought my explanation was too complex.......

Sal,
Didn't you get this working with the scanner on one network and a share mounted on the other network??

What we have done will work for the scanning. As it is a share on the scanner's side mounted on the server.

[electroman00]

And I thought my explanation was too complex.......

Since there's not much about vlan's on the internet I figured it can't hurt.

Bottom line is everyone now has a choice of solutions if nothing else.

One or the other or both.

Since it appears to hurt some, I'll just go hibernate in my work here in the orifice.

Have a good one...

[mercyh]

touchy, touchy..........

Since it appears to hurt some

Actually didn't hurt a bit....

And I thought my explanation was too complex.......

this is a comment not a criticism.

I should know much more about this then I do. I have used vlan only as a bit of a security measure within my lan.
(For sending radiology scans directly to a specific server so I can Guarantee to a picky radiologist that his precious pictures have not been touched in any way en route to his repository.)

PS> after your explanation I know more about it then I did before and that can never hurt.

Thanks for taking the time to explain

[sal1504]

Electromann00

From what I am understanding in your example from the scanner you can send a scanned document to anyone on the network, lan1 or lan2. What I need to do is isolate the scanner so if lawyer from lan1 scans in a document it can NOT be sent to anyone on LAN2. The printing function I understand because you are going from the individual lan's to the shared S/C but on the scan side how do you isolate the scanned image so it goes to either lan1 or lan2 but not both. Example a lawyer from the law firm on lan1 goes to the scanner and scans a document, what is to prevent that document from accidentally being sent to a lawyers computer on lan2? In my case I have two law firms that want to share the S/C that the purchased together, but need to keep complete seperation between the two law firms.

Sal

[mercyh]

From what I am understanding in your example from the scanner you can send a scanned document to anyone on the network, lan1 or lan2. What I need to do is isolate the scanner so if lawyer from lan1 scans in a document it can NOT be sent to anyone on LAN2.

This is impossible to do at the network level. How does the copier/network card know which organization the lawyer standing in front of it works for?

I would think that your copier supports departments, (where each user has to login with a password and the expense can be billed to the correct department.) Does it support different scanning locations per department?

The networking goal we are trying to achieve is that the Copier can talk to both networks but the networks cannot talk to each other.

[electroman00]

but on the scan side how do you isolate the scanned image so it goes to either lan1 or lan2 but not both

Thats done at the scanner, it's the source and need to be told for all scans where to send the scan.
Some of these units can buffer the scans until a client requests them for download.

what is to prevent that document from accidentally being sent to a lawyers computer on lan2

Nothing

I hope that's not to much of a complex answer.....LOL.

I know my lawyer is smart enough to be able to instantly tell you if a contract is verbal or written, however he's probably
not smart enough to make sure he's sending the scan to the right system/place every time.

I never said this was an idiot proof solution, nor did you make that a requirement.

However depending on the scanner you may be able to reduce that risk, not eliminate it.

[electroman00]

I might add it will never be sent to both networks at the same time, one or the other, not both.

If scan is sent to network1 then that's where it goes, you may have to rescan to send that same scan to the other network.
Your scanner may buffer it and send the scan and maintain the sent scan in it's buffer for a resend later.

[sal1504]

Electormann and MercyH

There lies the problem. With Sarsbane-Oxley and HIPAA the need for complete isolation between the two companies is a mandate. The company that sold them the S/C (which is a Sharp Copier/Scanner) misrepresented the capabilities of the S/C and from what I can tell has no networking or security training. One of the law firms IT person said no problem we'll just put everyone on the same network. The second law firm told them that HIPAA requires complete isolation between the two companies. I was called in to see if there was a solution. The copier does NOT support departments and we can't even password the individuals in the address book. My recommendation to the law firms was to return the copier. After all the research I have put into this I feel that it is the company that sold the copier responsibility to make it work to HIPAA standards or take it back and provide a copier with more advanced features. Thanks for everyone's input and sorry this got so off track.

Sal