Access guest network printers from primary network?

[rutilate]

I have two HP printers (2.4GHz only) that I'd like to put on the guest network so that guests have access but are still accessible from the primary network.

The biggest problem is that I can't access the guest network printers from the main network. Is that a feature such that I simply need to move the printers back to the main network and too bad so sad for guests?


I have a GT-AX6000 with another in mesh mode (xxx.xxx.50.1). I've created a guest network (xxx.xxx.52.1) and connected printers to the guest network. One printer is connected to each GT-AX6000 device based on proximity. I'm struggling to access printers from the primary network, and especially struggling to initiate a scan from a laptop on the primary network to one of the printers on the guest network. The only way to enable this scanning seems to be to allow guest network devices to "Access Intranet" in the general settings, but this seems to defeat the security feature of having less secure devices on the guest or IOT network.


Guest network config changes (all other features are defaults)
2.4/5GHz
WPA2-Personal
Access Intranet YES (This seems like a huge problem)

AIMesh Mode: both GT-AX6000 acessible

Is there a better way to look at this problem?

 

[ColinTaylor]

This type of requirement was one of the reasons for YazFi. But YazFi doesn't support AIMesh setups.

How have you "created a guest network (xxx.xxx.52.1)"? AFAIK that's not possible unless you're using VLANs or custom scripting like YazFi.

 

[rutilate]

The GTax6000 has the ability to create multiple guest networks, and offers greater configuration than on my XT8.
It is using VLAN.

I had assumed that I would be able to manage devices on the guest network without having to manually join the guest network. But it isn’t obvious how to enable that.

Is it something so simple as changing the subnet mask? I haven’t actually tested that and am away from the office atm.

 

[ColinTaylor]

Is it something so simple as changing the subnet mask?

No.

 

[drinkingbird]

The GTax6000 has the ability to create multiple guest networks, and offers greater configuration than on my XT8.
It is using VLAN.

I had assumed that I would be able to manage devices on the guest network without having to manually join the guest network. But it isn’t obvious how to enable that.

Is it something so simple as changing the subnet mask? I haven’t actually tested that and am away from the office atm.

On the standard routers (without advanced guest) the access is actually allowed from main LAN to GW1 but AP isolation blocks the ARPs so it fails. Does the advanced guest let you disable AP/client isolation? Worth a shot if so. Otherwise you're looking at doing some scripting assuming that model supports Merlin.

That feature would have to be disabled to allow guests to print anyway since they can't see the printers otherwise, even if on the same guest network.

 

[rutilate]

On the standard routers (without advanced guest) the access is actually allowed from main LAN to GW1 but AP isolation blocks the ARPs so it fails. Does the advanced guest let you disable AP/client isolation? Worth a shot if so. Otherwise you're looking at doing some scripting assuming that model supports Merlin.

That feature would have to be disabled to allow guests to print anyway since they can't see the printers otherwise, even if on the same guest network.

I can allow guest access to the Intranet (thereby defeating the hope of additional security) and toggle the "Set AP Isolated" which will prevent devices from communicating with each other on the guest network, moving myself further away from guests having printer access.

I'm moving the printers back inside, and will have to work out something different for the guests.

 

[drinkingbird]

I can allow guest access to the Intranet (thereby defeating the hope of additional security) and toggle the "Set AP Isolated" which will prevent devices from communicating with each other on the guest network, moving myself further away from guests having printer access.

I'm moving the printers back inside, and will have to work out something different for the guests.

No I mean the AP isolation on the guest network, on regular routers it is forced on and the only way to disable it is with a script. Wasn't sure if the pro routers let you control that in the GUI.