Isolating printers from computers on the same VLAN?

[clybumat1]

I have been tasked with isolating printers from computers.  The printers will still talk to the print servers, but users on the PC's should not be able to access them via browser etc. 

This would be easy if they were on separate VLANs.  But printers/computers/APs, etc. are all on the same VLANs.  Our topology is a L3, Routed network design, where each department has their own routed link on a 3750 user network switch that runs to a core 6500 router. 

We first looked into creating access lists, but there are over 300 printers, all on different VLANs and IP ranges, so the access lists would be way too long.

We then looked into private VLANs, but these only work on a trunked environment. 

Is there any other solution here? 

[acampbell]

Hi,

You could try creating a VLAN & subnet purely for the printers.
Then create an access list that only allows your print servers and any other management address
to the printers.

Lets say VLAN 111 & subnet 10.100.111.0/24 is defined for the printers
Lets say VLAN 10 & subnet 10.100.10.0/24 is all other devices.
Lets say the Print Servers and your NET MAN Station are

10.100.10.101, 102 & 103

!
vlan 10
name THE-BIG-VLAN
!
vlan 111
name THE-PRINTER-VLAN
!
int vlan 10
decription *** THE-BIG-VLAN ***
ip address 10.100.10.1 255.255.255.0
!
!
int vlan 111
decription *** THE-PRINTER-VLAN ***
ip address 10.100.1.101 255.255.255.0
ip access-group 111 in
!
ip access-list 111 permit ip host 10.100.10.101 any
ip access-list 111 permit ip host 10.100.10.102 any
ip access-list 111 permit ip host 10.100.10.103 any
!

Hope this gives you some pointers

Regards
Alex

[clybumat1]

Hi acampbell.  Thanks for the response.  This was our original idea, but the issue is, there are literally hundreds of printers, and all are setup in DNS.  So we'd have to put in a request for each printer to update their DNS to the new IP, not to mention the task of going to every single printer and changing it's static IP. 

[acampbell]

Hi,

NO PAIN - NO GAIN.

Rome was not built in ONE day.

You could use DHCP for your printers with a long lease time.

That would buy you some time to reset printer to DHCP
Change access vlan
Build DNS
Build Print Q
Re-static IP printer

Regards
Alex

[clybumat1]

Ha, believe me, I'm with you acampbell.  If it were up to me, I'd put all printers on one or two VLANs.  But the business wants a quick solution here, and it's looking more and more like that is not possible.

This issue is a result of the original design of the network.  And unless there's some other solution we're not thinking of here, we may have to rebuild Rome, if security is that important to the business. 

[glen.grant]

Sort of sounds like what PVLANS are used for but I can't say I have ever configured them or used them .   Just something to investigate .

Update: sorry didnt see you had looked at that

[clybumat1]

Ok, so the business still wants us to do this by any means possible.

We have decided to apply a VLAN access map.  Yes it's going to be long, especially for the switch stacks that have 100 printers, but they insist we do it.

The printers need to be isolated to everything but the print servers.  Our first attempt at the list has failed--it is dropping traffic from PC's, and also the print servers.. 

So in other words, we need to permit printer IP x.x.x.x to server IP x.x.x.x.

But deny the printer from everything else.

Can someone post an example config for this?

[clybumat1]

Bump. Any thoughts on this?

By the way, we were able to get the VACL's working if we applied them to the interface of the printer(s).  But if we apply them to the VLAN, it will block all traffic to/from the printers, even to the print servers that are being allowed in the extended access list..

[paul driver]

Hello

the most simplistic way I can think of at present refers not to networking -Cisco but to my days as a wintel server admin and is tying printer browsing down via active directory group policy (gpo)

I am assuming your printers are authorised in AD , If so -You can create gpo security templates defined to certain organisational units (OU)to the enable/disable printer browsing capability and then push this policy out into you relative ad domain

i have not worked with AD for some time now but I am sure you could search the exact procedure 

res

paul