Should printers go on a separate VLAN or just the office LAN?
Printer VLAN is a security quick-win. Printers expose many services (web admin, FTP, SMB, IPP, SNMP) that are poorly patched. A dedicated VLAN limits blast radius if one printer is compromised.
Try this first
- 1Create a 'PRINT' VLAN on the switch. Own subnet and DHCP scope.
- 2Set firewall rules: PRINT VLAN reachable from office VLAN only on IPP (631), 9100, SMB (445), HTTP/HTTPS (80/443) for admin, and SNMP (161) from monitoring server.
- 3PRINT VLAN cannot itself reach the office VLAN. A compromised printer can't pivot to internal machines.
- 4Give internet access only for firmware updates (specific vendor IPs or via a proxy). Not wide-open, or it becomes an outbound bot.
- 5Test scan-to-SMB and scan-to-email from this VLAN. Tweak firewall until everything works without being too open.
When to bring us in
A printer VLAN with the right firewall is half a day per site. We prefer to do it together with broader network segmentation.
See also
- Printer suddenly not foundFor everyone at once: print server or network. For one person: local Windows driver or expired authorisation.
- Print job stuck in queue, nothing happensA stuck queue blocks all subsequent prints. Cleaning takes two minutes.
- Scanner no longer sends emails (scan-to-email)Almost always: the account the scanner uses had its password expire, or the mail provider blocks old protocols.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.