Problem Introduction
I frequently use a workstation that sits behind an Adtran NetVanta 3120. The NV3120 is powerful little box. It provides secure VPN access back to corporate headquarters, but it also provides a 4-port switch, a highly configurable firewall, and generally more bells and whistles than you could ever want.
Recently, I added a Hewlett-Packard Photosmart C7280 to the network. However, it sits beyond the NV3120’s LAN, so other workstations on the greater LAN can use it, like my Gentoo laptop.
The default printer configuration went great! I was printing in no time from my workstation behind the NV3120. However, scanning was another issue.
Apparently, when used in scan mode, the HP C7280 originates traffic on a non-established port, so it becomes blocked or is otherwise lost. I knew everything else was working fine, because I could bypass the NV3120 and scanning would work great! But, that was not going to be acceptable for frequent use.
Network Topology
Here is an ASCII representation of the relevant network subsection:
Incoming Line
|
[ Wireless Router ]
192.168.1.1
/ | \
192.168.1.100 192.168.1.101 192.168.1.102
[ NetVanta 3120 ] [ HP C7280 Printer-Scanner-Fax ] [ Workstation #3 ]
10.10.0.110 Laptop
/ \
10.10.0.99 10.10.0.100
[ Workstation #1 ] [ Workstation #2 ]
Windows XP Pro Linux
The critical path is highlighted in red.
Solution
Eventually, I called the Adtran tech support. I was pleasantly surprised to receive a call back from a support engineer in short order. He understood my problem very quickly, and he knew immediately what to do! What follows are my scribbled notes for the steps he proscribed: (Of course, your policy names and IP numbers may vary.)
- Backup NV3120 configuration, in case something goes wrong. 😉
- Configure NV3120 to grab static IP, not DHCP-based IP from wireless router:
Click on: System -> Public Interface -> IP SettingsComplete as follows:IP: 192.168.1.100
MASK: 255.255.255.0
DEF GW: 192.168.1.1 - Add UDP relay for NetBios broadcast by HP C7280 printer (192.168.1.101) to be encapsulated and relayed through NV3120 (192.168.1.100) to its LAN (10.10.0.X) and vice-versa:Click on: Data -> UDP Relay -> IP Helper AddressAdd following addresses:
10.10.0.99 – Public (eth0)
10.10.0.100 – Public (eth0)
192.168.1.101 – vlan1
UDP Forward Protocol: netbios (port 137) [Press “Add”] - Allow traffic between 10.10.0.X subdomain and and 192.168.1.X subdomain:Click on: Data -> Firewall -> Security Zones -> Edit Security Zones -> Public
Add Policy to Zone “Public”
Type: Allow
Description: Allow 192.168.1.X to 10.10.0.X
Stateless Processing: OFF
Destination Security Zone: <Any Security Zone>
Source – Specified: 192.168.1.0 / 255.255.255.0
Destination – Specified: 10.10.0.96 / 255.255.255.240
Protocol: anyUse “arrows” to move new policy right below “VPN Selector” and before everything else.
- Allow traffic between 192.168.1.X subdomain and 10.10.0.X subdomain:Click on: Data -> Firewall -> Security Zones -> Edit Security Zones -> Private
Add Policy to Zone “Private”
Type: Allow
Description: Allow 10.10.0.X to 192.168.1.X
Stateless Processing: OFF
Destination Security Zone: <Any Security Zone>
Source – Specified: 10.10.0.96 / 255.255.255.240
Destination – Specified: 192.168.1.0 / 255.255.255.0
Protocol: anyUse “arrows” to move new policy right above “NAT list wizard-ics” and below everything else.
- Create policy for UDP Relay:Click on: Data -> Firewall -> Security Zones -> Edit Security Zones -> Public
Add Policy to Zone “Public”
Type: Advanced
Description: Relay netbios
Policy Action: Allow
Destination Security Zone: <Self Bound>
Stateless Processing: OFF– Add New Traffic Selector –
Type: Permit
Protocol: UDP
Source: Any, Any
Destination: Any host, Port: “Well Known” : 137 – netbios-nsUse “arrows” to move second from top, below “VPN selector”, but above recent “Allow 192.168.1.X to 10.10.0.X” policy.
- Reassign VPN Crypto Map – It occasionally gets lost during the above changes:Click on: Data -> VPN -> VPN Peers -> Advanced VPN Policies -> Assign Crypto Maps to Interfaces:
Public VPN
vlan1 none - Save configuration changes and reboot NV3120 unit. Backup configuration again, in case something goes wrong in the future. 😉
- On wireless router, add a “static route”, so traffic intended for the VPN subdomain (10.10.0.X) that leaves the printer (192.168.1.X) can find its way back to VPN subdomain and not onto global internet:
On wireless router’s configuration page (not NV3120), click on: Advanced -> Static Routes -> Add (Or, similar depending on brand and model):
Name: NV3120-VPN
Private: Off
Active: On
Destination IP: 10.10.0.96
Gateway IP: 192.168.1.100
Metric: 2Beyond the destination and gateway IP’s, the exact settings and menu navigation path will vary depending on router’s brand and model.
Explanation
Admittedly, the solution is a bit complex, but the problem is a bit complex too. Part of the complication comes from the fact that the printer broadcast various netbios-ns UDP packets to find computers on its domain. However, the computer used in this case does not exist on that domain. It exists on a private, VPN domain. So, we have to not only configure the firewall to allow traffic, but we must also relay UDP broadcasts between the two domains.
Many thanks to the Adtran support engineer, who guided me through the above steps, including configuring the 3rd party router!
