Hope you're all well.

 

I have several VLANs on my EAP with different subnets. I need a VLAN belonging to a Wi-Fi printer to be accessed by another VLAN where the clients are located.

 

Printer VLAN = 2.4GHz
Client VLAN = 5.0GHz

 

I created an ACL on the client network for printer access. I can ping it, but it won't print.

I created an additional ACL on the printer network for client access. I ran the same test, but nothing.

I can only print when I connect the client to the same network as the printer.

 

If I'm pinging, the ACL is allowing it; I should be printing. I only see the printer going offline.

 

What am I doing wrong?

 

ADDITIONAL DETAILS - 1

 

The networks have some peculiarities.

 

[ SSID - 2G Printer ]
Guest Network = Disable
LAN = 192.168.10.0 / 29
Prohibit Wi-Fi Sharing = Enable
WPA Mode = WPA2-PSK / AES

VLAN: 71

 

[ SSID - 5G Client ]
Guest Network = Enable
LAN = 192.168.5.0 / 28
Prohibit Wi-Fi Sharing = Enable
WPA Mode = WPA2-PSK/WPA3-SAE / AES

VLAN: 70

 

[ ACL - VLAN 70 - Deny LAN to LAN ]

Type: Gateway

Direction: LAN -> LAN

Policy: Deny

Protocols: All

Source: VLAN 70

Destination: Others, except 71.

 

[ ACL - VLAN 71 - Deny LAN to LAN ]

Type: Gateway

Direction: LAN -> LAN

Policy: Deny

Protocols: All

Source: VLAN 71

Destination: VLAN 70 and others.

 

[ ACL - Allow VLAN 70 to Printer ]

Type: EAP

Policy: Permit

Protocols: All

Source: VLAN 70

Destination: IPgroup Printer. <- Create this to IP Printer - 192.168.5.4

 

I remembered something that happened to me, even before updating to the new firmware version of the controller and even the router.

I remember an IoT device couldn't work with the 192.168.7.0 / 29 network. I couldn't understand the limitation and couldn't find an explanation anywhere else. When I changed it to 192.168.7.0 / 28, the device was able to use the SSID - IoT.

 

I haven't tested it yet, but if anyone has any information, it would be helpful.

 

 

ADDITIONAL DETAILS - 2

 

I also tried disabling the Guest Network on the client VLAN, but the result was the same.

And in response to my friend, I also tried creating a Group to only report the printer's IP address.