Printer vlan best practice

[and12345]

Hi, wanna ask how do you guys treat printer vlan on network ?

Should i separate it, or just joining the printer with others and how about printer sharing.

Many thanks

[Reza Sharifi]

Hi,

If you have a multiple data vlans, it is just easier to put just add the printers to data vlan.

So, if you have a building with 5 floors and each floor is in a different data vlan, you can simply add the printers to the same floor vlan. This way when a user print in that floor, the data doesn't have to go to the router as the printers and users are in the same vlan.

HTH 

[Joseph W. Doherty]

Personally, like Reza (?), I prefer to have printers, as hosts, on whatever data/user VLAN supports the local wall jacks.

However, I worked in one firm that was very much into security, and not only had a printer VLAN, that VLAN was in a separate VRF. This allowed network devices, like firewalls, to determine what traffic is allowed to be sent to what printers.

[Karsten Iwen]

Personally I like to have printers on an own VLAN and for added security even firewalled. Printers are very often not patched and can pose a security risk to the network. With a proper segmentation these risks can be diminished. But this separation is typically not one of the first steps in securing the environment.

[and12345]

yup me myself also prefer to secure the printer on 1 vlan after hearing many news about company getting hacked from printers. So how do you guys share the printer to different OS (Mac), i mean what protocol do you guys use to connect to the windows print server ?

[pieterh]

there is no one-size-fits-all

All depends on the size of your network and the number of workstations and printers.

and the amount of management you want to put in separating your printers

take into account if you use local printing or centralized printing.

with central printing your dat still leaves the floor to the printserver and then returns to the same floor but to the printer vlan

if you only have one-or-two printers per floor,

think of the management overhead by creating separate printer vlan's per floor.

including subnets with only 1-2 addresses assigned and router-interfaces between vlans

on the other hand, you may use a mechanism to "automatically" assign the printer based on the floor the user(vlan) is connected.