Bonjour Across VLANs

[Zoom7000]

I recently implemented a Meraki WiFi network at one of my schools and used the opportunity to reconfigure my previously majority flat network in to separate VLANs. Previously, all wired and wireless clients sat on the same VLAN. To try and keep bandwidth at most optimum, I've now set it up in the following manner:

 

VLAN 1: Wired Clients VLAN (PCs, Printers etc)

VLAN 10: Wireless Clients VLAN (School Laptops, School iPads)

(These 2 VLANs have full connectivity between each other.)

 

VLAN 4: There is also a separate VLAN for Meraki infrastructure (Switches, Wireless Access Points)

 

We don't have a layer 3 switch on site, our LGfL provided Cisco ASA does the layer 3 routing. Basically, when someone connects to an AP, it sends the DHCP request from VLAN 4, through the ASA on to the DHCP server on VLAN 1 and then the DHCP server assigns the wireless client an address on VLAN 10. The Cisco ASA can't do the DHCP because it already does DHCP for our VoIP clients (Another completely separate VLAN) and only supports running 1 DHCP server.

 

This is fine and it's all great and working and any broadcast traffic stays off the data VLAN (1). Now, the issue I'm having is Bonjour. All our PCs and printers sit on VLAN 1. However, the iPads are on VLAN 10. Therefore, none of the iPads are able to print, or connect to AirServer on the PCs because all these services use Bonjour, which doesn't seem to traverse VLANs.

 

Is there any way I'd be able to overcome this issue, without essentially flattening the network?

[caffrey]

I've used a Raspberry Pi to do just this over the last few years using avahi (We also have no layer 3 routing capability) - followed this guide

 

Wireless LAN Apple Bonjour Deployment Guide - Cisco

 

Would be nice if Smoothwall had avahi built in

 

 

It's been a while but I'm not sure if I use zone bridging on Smoothwall also

[pow]

I use avahi using Ubuntu on hyper-v, different network interfaces assigned to each VLAN (as the link to the hyper-v server is a trunk with all vlans tagged).

[DGardiner]

print server connected to both vlans?

 

our aruba aps can forward bonjour broadcasts.

[Michael]

Bonjour won't work over multiple VLANs (as far as I'm aware), however if you tagged the port the printer is connected to (with both VLANs), then logically this should work.

 

In saying that, I'm not sure if Bonjour will work over multiple subnets either - again another problem, if you may/may not use multiple subnets.

[Zoom7000]

Printers aren't the only problem though. AirServer is also an issue.

[Michael]

Indeed it is - I suppose the only real answer are iPads and Apple TV on the same VLAN, which then gets around the Air Server issue installed on a PC/Mac on a separate VLAN.

[michaelf]

We also use Meraki, and while I've not set this up myself and so can't comment on it's reliability, it does have the option to forward bonjour requests on a particular SSID if that helps?

 

 

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/Bonjour_Forwarding

[Michael]

Here's how someone's managed it (sort of bridging using a proxy).

[kennysarmy]

This?

 

https://download.collobos.com/en/presto25/files/chrome_user_guide.pdf

[Zoom7000]

Indeed it is - I suppose the only real answer are iPads and Apple TV on the same VLAN, which then gets around the Air Server issue installed on a PC/Mac on a separate VLAN.

 

Unfortunately, we have no Apple TVs and they are far more expensive than AirServer, which is much better feature wise.

 

This?

https://download.collobos.com/en/presto25/files/chrome_user_guide.pdf

 

Initially looks simple enough, but looks like it's best for Chromebooks? Can't see how this would work with iPads.

 

We also use Meraki, and while I've not set this up myself and so can't comment on it's reliability, it does have the option to forward bonjour requests on a particular SSID if that helps?

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/Bonjour_Forwarding

 

This would be wonderful, but I'm assuming that you would need the PC/printer to be plugged in to a Meraki switch as the forwarding needs to happen from the wired VLAN to the wireless VLAN. Unfortunately, my wired devices are still currently plugged in to dumb unmanaged Netgear switches

 

Here's how someone's managed it (sort of bridging using a proxy).

 

Thanks for that. I think that was what @caffrey mentioned in his post, but the step by step guide is very useful!

[Koldov]

Ok, I will just say that technically speaking I can't be much help to you.... Our network is managed, so I do not know all the ins and outs (and to be fair networking is not a strong point of mine).

 

But I can tell you we had similar issues with Apple devices and our VLAN structure.

 

To get around the printing side of things I gave a dedicated printer a static I.P. from the wireless VLAN (it worked, I don't know why but it worked - I think I also plugged it into the WLAN switch (non PoE), but can't be certain as it was a long time ago.

 

On the Airserver side of things I have only just found the Airserver Connect app. I'm not sure why this isn't widely publicised (or isn't bundled with Airserver). It is basically an iPad app that navigates VLANS and is specifically designed to do so. I haven't used it a lot, just downloaded it and tried connecting a pupil iPad to a teacher laptop (different VLAN, Subnet, SSID, everything).

 

Bottom of the page...

 

https://www.airserver.com/Download

 

Having said all this, it may well be that our switches/network infrastructure is set up somehow to do all this - I can't give you any help on that, sorry!

Edited July 20, 2017 by Koldov

[kennysarmy]

 

 

 

Initially looks simple enough, but looks like it's best for Chromebooks? Can't see how this would work with iPads.

 

 

 

 

It works for our iPads...

 

Regards

[Blue_Cookeh]

I use avahi using Ubuntu on hyper-v, different network interfaces assigned to each VLAN (as the link to the hyper-v server is a trunk with all vlans tagged).

 

ding ding ding, this is what we do, and it works flawlessly for AirPrint on iOS.

 

You need to remember the bonjour part of this is *just* for discovery, it isn't for data transfer. I setup avahi and then watched our firewall logs as I tried to print something. I believe I just needed to allow access to TCP/443 from our Mobile Device VLAN to our AirPrint-enabled printers.

 

I dare say this is the same for mirroring/screen sharing on Apple TVs or AirServer too, but we put those on our mobile VLAN too anyway since they're considered iOS devices.

Edited July 21, 2017 by Blue_Cookeh

[AlanD]

There is a free APP called "Airserver Connect" which works by Airserver displaying a QR code on the PC which when you show it to the Airserver connect app will connect the ipad to the desktop. It works across VLANs (assuming you have some kind of routing - we use smoothwall - which applies group rules to only allow staff to connect )...so no need for Bonjour when using this.

 

As far as Airprint is concerned - I've yet to see a similar application that is generic - but various printer manufactures provide a QR app. I've played with the Lexmark one but not found it as easy to use.

[Norphy]

Various wireless systems have a service called a Bonjour Gateway, our Aerohive system has this and it works ok. I've also used avahi with success as well. Bonjour is a UDP broadcast protocol like DHCP so needs help traversing networks.

[MatthewL]

I recently setup mobility print from PaperCut across multi VLAN and used this document. I had to create some DNS entries if this helps?

[kearton]

I recently implemented a Meraki WiFi network...

 

Now, the issue I'm having is Bonjour. All our PCs and printers sit on VLAN 1. However, thIs there any way I'd be able to overcome this issue, without essentially flattening the network?

 

Meraki has a Bonjour gateway built in...

[Zoom7000]

Meraki has a Bonjour gateway built in...

[ATTACH]44670[/ATTACH]

 

Thanks for that, I'll give that a try and see how it goes on Monday.

[AlanD]

The trouble with bonjour services - is that you end up with tens - possibly hundreds - of printers and/or airservers turning up in your selection lists. And its quite a "noisy" service using up potentially significant parts of your wireless if not wired bandwidth.

 

Yes - some wireless systems allow you to selectively advertise different services from different access points - but its usually fairly crude and labour intensive to setup - and then some clients/access points remain connected when you expect them to pair differently and so the expected list of services isn't what you want them to be.

 

And using Avahi you lose that ability to selectively advertise different services to different clients/wireless access points.

 

All in all - Bonjour services are a mixed blessing - and often less than ideal in larger enterprise deployments.

 

I'd like QR code systems like "airserver connect" for printers - but there doesn't appear to be anything that is universal - or which doesn't cost what ends up being quite a bit of money.