Printing Across VLANs

[alienhive]

I gave this a shot once before with no success. I figured I would try it one more time. I have an HP OfficeJet 8720 printer connected to my network via Ethernet. I have UniFi networking gear (a UniFi Dream Machine Pro and a USW Pro switch). I have a separate VLAN for the printer that I would like to move it to. However, when I do so, the devices on my Home VLAN can't connect to print. I am however able to access the Embedded Web Server via a browser.

All of my VLANs are "Corporate," and I have "IGMP Snooping," "UPnP," and "Multicast DNS" enabled for the Printer VLAN. I have added firewall rules to allow every port and protocol I can find that this printer uses.  I even tried turning off all of the firewall rules to see if it could talk across VLANs without any restrictions and it still didn't work.

For the printer's web interface, under Advanced Settings -> Bonjour Highest Priority Service, there is "Internet Printing Protocol," "9100 Printing," and "LPD." Internet Printing Protocol is what is selected by default. There is also text on this page that says "Bonjour services (which use mDNS, or Multicast Domain Name System) are typically used on small networks for IP address and name resolution (through UDP port 5353), where a conventional DNS server is not used." Does something need to be changed here?

I have two questions:

1) Has anyone successfully made this work, including being able to utilize the HP Smart software functions? If so, how?

2) Is it worth putting the printer on it's own VLAN (it would be the only device)? On the one hand, I have seen arguments that it's not worth it. On the other hand, I see horror stories about how a single printer infects an entire network since they tend to not be great in the security department. If I don't put it on it's own VLAN, it would be on my "Home" VLAN with my trusted devices.

Thank you!

[alienhive · Accepted solution]

For anyone who comes across this thread in the future, the solution was to make sure you have mDNS on in UniFi, set a static IP for the printer, then re-add your printer in Windows using the static IP address. If you're using the HP Smart software, it should see the printer and ask you to set it up. You should then only need allow related/established and deny new traffic firewall rules.