Topic: 2 networks and 1 photocopier

[mercyh]

......

removed post as the level of complexity I described is not necessary in this situation

[mercyh]

Moderator,

This thread has gone off topic for the SME Server 7.x forum. Could it be moved to the General Discussions Forum?

Royce

[electroman00]

Moderator,
This thread has gone off topic for the SME Server 7.x forum. Could it be moved to the General Discussions Forum?
Royce

Tend to agree the OP needed General since it's not specific to SME.

I did read your post before you removed and agree Advance (over kill for this application), might add expensive also.
My only question was...are you providing the hosting and what's the bandwidth it requires out of curiosity.

This dual-wan router ($200.00) is a means to an inexpensive solution and simple to setup.

[sal1504]

electroman00


tried using the Netgear FVS124 Dual Wan router and it did NOT work. The big difference is that the Netgear does NOT support load balancing and without load balancing I don't think this will work. Am I correct in making this assumption?

Sal

[electroman00]

sal1504

Not having load balancing won't stop it from working, how did you have it config'd.

Did you setup the printer on the lan or dmz.

It should work on either, however on the lan you want the printer static outside the DHCP range.

You would need to Port Forward from each wan to the printer IP for the TCP/IP port the printer uses.

If the printer i.e. uses 80 then PF 80.

Is it a FVS124 or FVS124G

[mercyh]

Just a quick drawing to make sure we understand.

Lan1            Lan2
 v                 v
 v                 v
Wan1         Wan2
 Router wan ports
------------------
 Router Lan ports
        V
    Copier

Port forward the Wan IP of the router to the copiers IP address for both Wan ports.

Be sure that the copier lan is in a different subnet from either of the other two networks.

Any print job sent to the copier would be addressed to the WAN IP of the Router for that specific subnet. This should work with no problem. Remember by doing a port forward (Or DMZ) the internal address "becomes" the Wan address when viewed from outside the firewall.


I am not sure how a packet sent from the copier will know which WAN its destination lives in. Will there need to be some sort of a static route written on the router that binds the different subnets to the correct WAN ports of the router??

[electroman00]

Lan1            Lan2
 v                 v
 v                 v
Wan1         Wan2
 Router WAN Interfaces
------------------
 Port Forwards
------------------
 Router LAN or DMZ
        V
    Copier

Remember by doing a port forward (Or DMZ) the internal address "becomes" the Wan address when viewed from outside the firewall.

This networking stuff can get confusing for sure....

The Wan IP is routed to the LAN or DMZ via the Port Forward providing external (incoming) access to the internal IP per port, per IP.... 1:1 NAT.
The port is viewed from outside the firewall, not the IP, the IP is routed aka translated.

I am not sure how a packet sent from the copier will know which WAN its destination lives in. Will there need to be some sort of a static route written on the router that binds the different subnets to the correct WAN ports of the router??

Shouldn't be a problem since the printer is the destination (Print Server) not a source (client) for request's.

[mercyh]

Electroman00,

Shouldn't be a problem since the printer is the destination (Print Server) not a source (client) for request's.

Did you miss this?
from OP's post on first page

Yes I did see that thread but did Arne's concept work? It is not printing that we need to share but scanning output.

The Wan IP is routed to the LAN or DMZ via the Port Forward providing external (incoming) access to the internal IP per port, per IP.... 1:1 NAT.
The port is viewed from outside the firewall, not the IP, the IP is routed aka translated.

I think I understand this concept (although every time I think I understand networking I learn a new and better way and find I didn't know as much as I thought I did  )
I was just trying to make perfectly clear that the OP needs to print too the WAN IP of the router in this case, not the assigned IP of the copier.


--------------
My favorite quote: I know what I know, Unfortunately I am not sure what I don't know. (It is the last part that will drive you crazy in this business.)

[mercyh]

Sal,

A couple of questions,

1> can you get to where you can ping the copier or print to the copier from the two LAN's?

2> Does that router give you any way to bind a route to one WAN port?


It seems like it should be easy to get the printing working with your setup, I think the only way you will get scanning working is by setting up static routes.

Does the copier allow you to have multiple scanning destinations that are easily selectable?

[compsos]

Thanks for all the replys.
Have used Netgear Dual Wan Routers before and doubt if they would work here. They are fussy about what is on their WAN sides and not that flexible or reliable in non supported modes.

We have setup

• eth2 with an address of the copier's network
• route-eth2 file pointing to the copier's network
• a hidden share on the machine storing the scans
• mount the hidden share from the server in an ibay

The result is the server's LAN clients can not see the copier's network but can read the ibay. As for the printing functions (still to be tested fully), installed cups and pointed the software to the copier's IP address. The server treats this as a "remote". It should work as the IP address is visible to the server. Clients on the copiers side can not see the server's side. This arrangement has survived reboots, post-upgrades and shutdowns. The mounting script will probably need a cron script to accommodate start up sequences of machines.
In this case the copier's network is peer to peer based on XP machines and they just did not care how or where connections were coming from as long as it was their subnet.

[sal1504]

mercyh

printing is not the problem. printing is easy all you need to do is set up the printer as a webprinter. it's scanning and sending the other way to the workstations on the seperate subnets thats the problem.

Sal

[compsos]

What we have done will work for the scanning. As it is a share on the scanner's side mounted on the server.

[electroman00]

Since we're not able to define a absolute solution with regards to printing and scanning via the dual-wan concept
I am able to provide this 100% solution based on my experience.

And Yes I did miss the part about the scanning, printing only will work fine with dual wan routers but not the scanning.
However a similar solution is provided here....see bottom of this post.

The solution is Managed/Layered vLan switches and may not be within a system budget, however careful planning and design goals
can yield a fairly inexpensive solution $200-300.00.

A single Managed/Layered vLan switch will fulfill the solution requirement.

Two separate firms/business may want to consider 2 Managed/Layered/Smart Switches trunked together on a 1,2,3 or 4 gigabit CAT5/6 or Fiber trunk.
That expense would be in the $1-4k range depending on requirements.

Managed/Layered/Smart vLan Switches are controlled broadcast traffic port switch equipment that provide isolation between network resource's while
at the same time provide shared access between those networks to specific network resource's.

Depending on the exacting requirements YMMV greatly.

As an example the linsys SFE2000P in the $600.00us price range.
http://www.linksys.com/servlet/Satellite?c=L_Product_C2&childpagename=US%2FLayout&cid=1169672084163&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=8416395123B08

Recently Managed/Layered/Smart vLan Switches have become a cost effective solution within the business environment
and should and can be considered for all business's large and small.

Real World Example Application with print/scan server.

Port-based VLAN will help efficiently confine the broadcast traffic to the switch ports.

Port-based VLANs

Example Packets received by the switch will be treated in the following way:

• When a packet enters a port, it only can proceed to the VLAN which the port belongs to. The packet will be able to be sent to other ports with the same VLAN ID membership.

• If the port in which the packet entered does not have membership with the same VLAN as the source port does, the packet will be dropped.

This example basically demonstrates how the port-based VLANs work to meet your needs.

Setup the following :

• VLAN 1 (IT department)

• VLAN 2 (Sales department)

• VLAN 3 (Marketing department)

• VLAN 4 (Accounting department).

Configure the VLAN membership. Be sure to set all of them as follows.

• Setting up second VLAN group (Sales), VLAN ID = 02, with membership of ports 1~8, 25.

• Setting up third VLAN group (Marketing), VLAN ID = 03, with membership of ports 7~14, 25.

• Setting up fourth VLAN group (Accounting), VLAN ID = 04, with membership of ports 19~20, 25.

• Setting up first VLAN group (IT), VLAN ID = 01, with membership of all ports.

Since VLAN ID 01 has been setup by default, you will have to remove the ports that belong to all other VLAN group except port 25.

• Ports 7 and 8 are kept for the usage of connecting file server and print/scan server.

 Sales and Marketing departments can share file archives and printing/scanning services.

• Port 25 provides Gigabit speed for email server and Internet connection.

The specific ports above have the following functions:

• VLAN 1: Port 15 – Port 18, Port 21 – Port 24, Port 26, for IT department to monitor and control activities on all other VLANs

• VLAN 2: Port 1 – Port 8, for Sales department, port 7 and 8 connect to file archives and print/scan server.

• VLAN 3: Port 7 – Port 14, for Marketing department, port 7 and 8 connect to file archives and print/scan server.

• VLAN 4: Port 19 – Port 20, for Accounting department, its work is kept secret from other departments except IT.


Scenarios:

If a packet comes in on port 2 (Sales), it can go to ports 1, 3, 4, 5, 6, 7, 8, and 25, as those are the only ports in that VLAN.

A Sales person on Port 2 can get to the Internet, send and receive email, print/scan server or file archives but cannot access the marketing department.

If a Marketing user sends out a broadcast message, the Sales and Accounting departments will not be affected by the message, as it will not go out on their ports.

Only the Marketing department and the IT group will get the broadcast message.

If an IT user sends out a broadcast message, everyone will get it.

BTW In most cases the punch down patch panel can be eliminated and all cables terminated with RJ-45 direct to the switch since
the switch can enable/disable/delegate to any vlan aka network without re-patching cables and that can be accomplished remotely in an instant.

Thus the cost savings of installing time consuming patch panels the old way is history.
All cables are simply tagged/ID and plugged in permanently to the switch and never touched again thus reducing connection problems.

For the home user 24 port gigabit vlan switches can be had NIB for < $100-200.00 and will neaten up the spaghetti wiring for sure.

Also all gigibit network cards today are vlan tagable, thus a client system has the capability to connect to any vlan on the switch...instantly, if authorized.

Simply...hubs and switches will soon become a thing of the past, all network equipment will have vlan capability in the near future
as all mfg'ers migrate to that capability.

2 networks and a print/scanner server solution

With Managed/Layered vLan switches your networking options are limitless, as proof, the solution to the 2 networks and a print/scanner server
is solved here in the OP guaranteed.

As a stated problem in this OP, a 4 port vlan switch would solve the problem, simply two vlan1-port1 & vlan2-port2 (one for each isolated network) with the print/scanner server having a single port membership i.e. port 4 in both vlan1-network1 & vlan2-network2 and your done, no tricks or work arounds....it just works and your done.

The caveat is that both networks need to be on the same subnet, they will still be isolated, but the DHCP servers on those networks
cannot serve IP's within the same IP range, which avoids IP conflicts or you can simply use Static IP's.

i.e.

Network1 DHCP 50-125
Network2 DHCP 126-200
Static below 50 or above 200 can be used for the Static IP for the print/scanner server assigned on both networks.

Same Subnet for both networks 1 & 2  i.e. 192.168.1.xxx

Networks 1 & 2 cannot access each other but both can access the print/scan server, subnet routing is no longer the problem for the scanner.
The print/scan server would need to be static on both networks 1 & 2, both networks would have a difficult time trying to hit a
dynamic IP moving target reliably.

Here's a 4 port vlan switch for 195.00, I'm sure there are others out there.
http://www.komusa.com/4po10smsw.html

We have similar setups in multiple locations, however we use 24 & 48 port vlan switches, not a four port stand alone config. as depicted here.
We use vlan switches and some tagged nic's and we never run into the problem in the OP.

The money saved from the patch panel installation and time, is put towards the vlan switches and a new deployment is faster.
We config  switches here in the shop and simply upload the config to the on site switches when the system is ready...bam..done deal..!!

All networking configurations are now done remotely, another real nice advantage, no more going to the site to plug cables to different ports...PITA.

Simply put, there's no reason to use hubs & switches anymore, vlan switches are here and cost effective for many reasons.

Also, for those with interest, the linksys wrt54g 4 port wireless routers can be modded to support vlan capability via third party firmware i.e. SVEASOFT firmware....pretty cool..!
All routers of this sort will support vlan's in the near future or they won't sell them...that simple.
Why they don't all support vlan now is beyond understanding, it's fairly simple firmware update as SVEASOFT has shown
and the chipset's they all use support vlan capability, obviously the firmware doesn't at this point.

Have a good one.... 

HTH

[sal1504]

electroman00

This looks promising, but I have one question in your 4 port vlan example you would have your two segments lan1 being 192.168.1.2-20 and lan2 being 192.168.1.30.40. From the scanner side what would keep the user on lan1 from accidentally sending a scanned document to 192.168.1.35 on lan2?

Sal

[electroman00]

This looks promising, but I have one question in your 4 port vlan example.

you would have two DHCP separate ranges DHCP server1 lan1 being 192.168.1.2-20 and DHCP server2 lan2 range being 192.168.1.30-40.

The printer would need to be static outside those two DHCP pools so 192.168.1.21-29 would be ok for the P/S.

Remember both networks are on the same subnet, so you can't have 2 DHCP server's serve IP address's that overlap else you end up with IP conflicts.

You technically shouldn't have two DHCP server's on the same subnet, that doesn't mean you can't, they just can't serve the same IP pool.

Plus the vlan switch will segregate the two DHCP server's.

The DHCP servers can't communicate with each other to resolve conflicts obviously because the vlan switch won't let them communicate to
each other, however they still can't lease the same IP's.

What happens is if a client on both networks have the same IP then the printer won't know who is who and the broadcast will still traverse the vlan's and the DHCP server's will one or both detect a IP conflict.

Also since the print/scanner can see both network DHCP server's, the P/S must be setup as static so it doesn't try to get a IP lease from either network
and the IP is then no longer a moving target as with dynamic.

HTH

From the scanner side what would keep the user on lan1 from accidentally sending a scanned document to 192.168.1.35 on lan2?

Not sure I understand your question...the scanner can send to any host on either network aka vlan since it has full access to both vlan's as a source and a destination device/equip.

Network1 is on vlan1, network2 is on vlan2, the P/S has a Switch port membership on both vlan 1 & 2 so it can comm to both, except net1 & net2 can't
communicate to each other because their only Switch port membership is to their respective port vlanID.

Network1 is on vlan1-switch-port1
Network2 is on vlan2-switch-port2

P/S is on switch port4 with vlan membership for that port set/configured to vlan 1 & 2

It's very hard to depict all the vlan capabilities here, one must gain some vlan exposure to gleam all the advantages to the vlan concept.

Then it just adds to the networking mind boggle....for sure, everything needs to be mapped out & documented ahead of time else your head might start
spinning.

I know mine did the first week.

This is just a simple example, try (4) - 48 port switches trunked together with 26 vlans, that's 192 ports on (26 vlans or possible separate networks)
and you didn't leave the building, you could have that trunked to another building with the same setup.

Do the math and spin..!!

BTW theirs no limit to how many switches can be trunked, which leads to the big problem, idea's become endless and kiss....kiss that goodbye.

However, once you get a handle on vlan's, it's like everything else, it's cake.

And PING will become your best friend.

I guess a Visio picture might make this much easier.....but I risk advanced networking here.