Trevor's IT Blog

Problem Introduction

I frequently use a workstation that sits behind an Adtran NetVanta 3120.  The NV3120 is powerful little box.  It provides secure VPN access back to corporate headquarters, but it also provides a 4-port switch, a highly configurable firewall, and generally more bells and whistles than you could ever want.

Recently, I added a Hewlett-Packard Photosmart C7280 to the network.  However, it sits beyond the NV3120’s LAN, so other workstations on the greater LAN can use it, like my Gentoo laptop.

The default printer configuration went great!  I was printing in no time from my workstation behind the NV3120.  However, scanning was another issue.

Apparently, when used in scan mode, the HP C7280 originates traffic on a non-established port, so it becomes blocked or is otherwise lost.  I knew everything else was working fine, because I could bypass the NV3120 and scanning would work great!  But, that was not going to be acceptable for frequent use.

Network Topology

Here is an ASCII representation of the relevant network subsection:

                                            Incoming Line
                                                  |
                                         [ Wireless Router ]
                                            192.168.1.1
                      /                           |                        \
               192.168.1.100                192.168.1.101              192.168.1.102
            [ NetVanta 3120 ]    [ HP C7280 Printer-Scanner-Fax ]    [ Workstation #3 ]
                10.10.0.110                                               Laptop
             /             \
    10.10.0.99           10.10.0.100
[ Workstation #1 ]   [ Workstation #2 ]
  Windows XP Pro           Linux

The critical path is highlighted in red.

Solution

Eventually, I called the Adtran tech support.  I was pleasantly surprised to receive a call back from a support engineer in short order.  He understood my problem very quickly, and he knew immediately what to do!  What follows are my scribbled notes for the steps he proscribed:  (Of course, your policy names and IP numbers may vary.)

1. Backup NV3120 configuration, in case something goes wrong.  😉
2. Configure NV3120 to grab static IP, not DHCP-based IP from wireless router:

   Click on:  System -> Public Interface -> IP SettingsComplete as follows:IP:  192.168.1.100
   MASK:  255.255.255.0
   DEF GW:  192.168.1.1

3. Add UDP relay for NetBios broadcast by HP C7280 printer (192.168.1.101) to be encapsulated and relayed through NV3120 (192.168.1.100) to its LAN (10.10.0.X) and vice-versa:Click on:  Data -> UDP Relay -> IP Helper AddressAdd following addresses:

   10.10.0.99 – Public (eth0)
   10.10.0.100 – Public (eth0)
   192.168.1.101 – vlan1
   UDP Forward Protocol:  netbios (port 137)  [Press “Add”]

4. Allow traffic between 10.10.0.X subdomain and and 192.168.1.X subdomain:Click on:  Data -> Firewall -> Security Zones -> Edit Security Zones -> Public
   Add Policy to Zone “Public”
   Type:  Allow
   Description:  Allow 192.168.1.X to 10.10.0.X
   Stateless Processing:  OFF
   Destination Security Zone:  <Any Security Zone>
   Source – Specified:  192.168.1.0 / 255.255.255.0
   Destination – Specified:  10.10.0.96 / 255.255.255.240
   Protocol:  any

   Use “arrows” to move new policy right below “VPN Selector” and before everything else.

5. Allow traffic between 192.168.1.X subdomain and 10.10.0.X subdomain:Click on:  Data -> Firewall -> Security Zones -> Edit Security Zones -> Private

   Add Policy to Zone “Private”
   Type:  Allow
   Description:  Allow 10.10.0.X to 192.168.1.X
   Stateless Processing:  OFF
   Destination Security Zone:  <Any Security Zone>
   Source – Specified:  10.10.0.96 / 255.255.255.240
   Destination – Specified:  192.168.1.0 / 255.255.255.0
   Protocol:  any

   Use “arrows” to move new policy right above “NAT list wizard-ics” and below everything else.

6. Create policy for UDP Relay:Click on:  Data -> Firewall -> Security Zones -> Edit Security Zones -> Public
   Add Policy to Zone “Public”
   Type:  Advanced
   Description:  Relay netbios
   Policy Action:  Allow
   Destination Security Zone:  <Self Bound>
   Stateless Processing:  OFF

   – Add New Traffic Selector –
   Type:  Permit
   Protocol:  UDP
   Source:  Any, Any
   Destination:  Any host, Port:  “Well Known” : 137 – netbios-ns

   Use “arrows” to move second from top, below “VPN selector”, but above recent “Allow 192.168.1.X to 10.10.0.X” policy.

7. Reassign VPN Crypto Map – It occasionally gets lost during the above changes:Click on:  Data -> VPN -> VPN Peers -> Advanced VPN Policies -> Assign Crypto Maps to Interfaces:

   Public    VPN
   vlan1     none

8. Save configuration changes and reboot NV3120 unit.  Backup configuration again, in case something goes wrong in the future.  😉
9. On wireless router, add a “static route”, so traffic intended for the VPN subdomain (10.10.0.X) that leaves the printer (192.168.1.X) can find its way back to VPN subdomain and not onto global internet:

   On wireless router’s configuration page (not NV3120), click on:  Advanced -> Static Routes -> Add (Or, similar depending on brand and model):

   Name:  NV3120-VPN
   Private:  Off
   Active:  On
   Destination IP:  10.10.0.96
   Gateway IP:  192.168.1.100
   Metric:  2Beyond the destination and gateway IP’s, the exact settings and menu navigation path will vary depending on router’s brand and model.

Explanation

Admittedly, the solution is a bit complex, but the problem is a bit complex too.  Part of the complication comes from the fact that the printer broadcast various netbios-ns UDP packets to find computers on its domain.  However, the computer used in this case does not exist on that domain.  It exists on a private, VPN domain.  So, we have to not only configure the firewall to allow traffic, but we must also relay UDP broadcasts between the two domains.

Many thanks to the Adtran support engineer, who guided me through the above steps, including configuring the 3rd party router!