User printing onsite - multi-subnet restricted network

With computer security being an ongoing and growing concern, the need for companies to protect their intellectual property is greater than ever. Many businesses, both large and small, set up their environments with multiple subnets and restrictions around data communications. 

For many of these businesses, the restrictions in place are more around who can access sensitive data in the environment on file servers, mail servers, etc.. But, as we know, sensitive data needs to be printed from time to time. So some businesses not only restrict access to the file servers but also to the print servers - to limit who can access and see what is being printed in the environment. 

These multi-subnet environments might be for a single site or for a multi-site environment. It’s really about controlling who has access to what and what ports are allowed for communications. 

Customers that have this type of environment range far and wide. They may be anything such as a:

• small legal firm
• school
• library
• university
• Government agency
• Healthcare provider
• and the list goes on and on. 

Regardless of the customer, they all have one thing in common - the need to control the flow of access and information in their network.

Recommended solution

As with all more complex environments, there are multiple ways in which you can set up and configure your network to not only restrict, but also allow printing to occur. 

Below are a couple of common scenarios with a suggestion on how you can allow printing to occur in a restricted subnet environment. The right setup for you depends on the severity of the restrictions you want to impose.

Scenario 1: Restriction between user subnets, but allowed access to printer subnet

This scenario is where any computer within the network environment can contact and deliver a print job to the printer (that is, no printer port restrictions in place). However, for security purposes, there is limited or no communication allowed between different user subnets (such as guest network and staff network, or teacher network and student network, or secure network and unsecure network, etc.). 

Where there are restrictions between user subnets, the edge nodes will utilize the most appropriate edge nodes that exist within the subnet that the user has generated the print job from. 

So if we had a subnet for teaching staff, other edge nodes in the teacher subnet will be used by PaperCut Hive and Pocket to allow a teacher to submit a print job. However, the job will not be delivered to an edge node in the student subnet. This is managed by restricting the edge node communications (blocking the edge node ports) between the different subnets.

When the job is to be released, any edge node in the originating subnet will be able to accept and release the print job to the printer.

Scenario 2: Restrictions between user subnets and printer subnets, or no direct comms allowed between any user machines or printers

This used to be one of the most common network configurations in a traditional organization’s network. Often schools and universities would set up their printing with this scenario so that students could only access data in the student subnet and only have access to printing via a single print server. This prevented students from manually installing a printer driver and bypassing the charging for the print jobs. 

When running PaperCut Hive or Pocket, this setup can still be accomplished, but there is a requirement for at least one edge node to be able to communicate with the printers to allow a print job to route successfully to the device.

There are two ways to accomplish this; create a separate subnet for two dedicated edge node computers (details below):

• Create a separate subnet for 2 dedicated edge node computers that all machines can contact.
• Create a separate subnet for 2 dedicated edge node computers with the cloud node enabled.

Create a separate subnet for 2 dedicated edge node computers that all machines can contact

1. Create a new subnet and install 1-2 dedicated edge node machines.
2. Promote these machines to be super nodes. This results in all jobs being replicated to these machines.
3. Allow all edge nodes to communicate with the two super nodes in the new subnet.
4. Allow the new subnet permission to access the printers

Then, when print jobs are submitted by an edge node, they will replicate to these super nodes. When the user attempts to release their print job, the super node can deliver the job successfully to the printer.

Create a separate subnet for 2 dedicated edge node computers with the cloud node enabled

1. Allow the separate subnet to have access to the printer subnet (for print job delivery).
2. Users print their job to the edge node. By default, their job will also replicate to the cloud node.
3. When the user releases their print job, the job is delivered to one of the 2 edge node computers with access to the printer subnet.
4. The job is then released to the printer.

How printing with PaperCut Hive and Pocket works

For a summary of how printing works with PaperCut Hive and Pocket, take a look at the How it works page in the manual. 

For a detailed look at the print job process and release print job process, including the ports and communications at each step, refer to The print process and The release print job process below.

Pros and cons

Network diagrams

Scenario 1: Create a separate subnet for 2 dedicated edge node computers that all machines can contact

Scenario 2 - Option 1: Create a separate subnet for 2 dedicated edge node computers with the cloud node enabled

Scenario 2 - Option 2: Create a separate subnet for 2 dedicated edge node computers with the cloud node enabled

Ports

If you’re running the Full Embedded app, some platforms (MFDs) need additional ports to allow communications. For the complete list of ports, refer to Firewall ports and Networking .

The print job process

We are going to assume at this point that you have already read through the articles about getting your users joined to your print environment and that their computers or devices are configured to print. If you haven’t, read Getting started for administrators , which details the prerequisites and how to get your users set up.

Let’s now run through the process involved when a user prints in this environment.

Printing from Windows/Mac/Chromebook/Android

Printing from iOS devices

The release print job process

When it’s time for the end-user to release the print job, there are two different methods:

• MFD Release
• mobile device release.

MFD release

Mobile device release - via cloud service

Mobile device release - offline mode

If the link to the cloud services is unavailable, for example, your Internet Provider has gone offline, you can still release print jobs using your mobile device connected to your local WiFi. Here’s what the comms looks like.

​​​​​​