snmp over ipsec
-
dear all
We use a managed print service and they send toner when the printers are low, they manage and monitor this by SNMP (UDP port 161)
We have multiple sites and I have successfully connected two of these sites with an IPSec site-to-site tunnel.Site A - 192.168.100.0/24 Site B - 192.168.200.0/24
I had to install print service software on server in site A.
It should work via snmp and it reaches all printers on site A (same subnet of course) but no printer in different subnetI installed print service software in Site A a Ii wrote above and i need to manage printer in Site B
I'm able to
-ping the printer from site A
-connect to web gui of printer from site A
I set up a any any rule on ipsec so I allowed traffic between subnetBut unfortunately the sw does not discover printer.
Could you help me?
-
@reynold I'm guessing the print service software "discovers" the printers in the same network which it is on (Site A). But that discovery doesn't automatically happen across networks.
If it's possible to specify each IP of the printers in the service software, you should be able to add the respective IP's of the printers on site B...
If not, I guess you need some way to get the broadcast/discovery to work across... like installing Avahi...
-
Hi
I want to disappoint you, but using a classic ipsec tunnel based on traffic selectors (Site A - 192.168.100.0/24 Site B - 192.168.200.0/24) , it is impossible to transmit broadcast messages that are used to detect devices (for example, printers) on the networkAs an option to solve this problem, it is to connect two networks using any tunnel that supports routing
, for example, VTI, OpenVPN, GRE over Ipsec, etc.And then , using Avahi at both ends of the tunnel , transmit broadcast traffic from one network to another
-
@reynold As @Konstanti is saying, use a VTI tunnel for this... It's as simple as going into the Phase 2 Entries and change them to Routed (VTI )
You will also need to go into System > Routing > Static Routes and set up the routes to the respective remote locations using the VTI interface that is created (at both sites of course).
I have succesfully used this setup, not with a printer but for SNMP and Zabbix monitoring across VPN.
-
@Gblenn @Konstanti
Thanks a lot.
I will try in the next days
Avahi is not an option because it seems not available for windows. -
@reynold Actually you install Avahi as a package on pfsense, not on the windows clients.