Networking problem on Mac

I've got a problem with my wife's Mac. Actually, the problem is not related to Mac 'cause I'm sure it would be the same problem on Windows, but she happens to use a Mac so I need a Mac solution (if there is one).

My wife works from home a lot, for this she logs into the company network (Cisco) via a dial-up application which sets up a secure VPN tunnel. As always, once the VPN tunnel has been built, her Mac becomes part of the company network (with regards to subnetting etc...)

There is one big downside to this. For one, she cannot control the Sonos music system any more because she's now on a different subnet. This is not that bad because she can always use the wireless controller.
It's worse when it comes to printing. We have one printer in the house which is connected via LAN cable. Every computer in the house prints to this printer. But when her Mac becomes part of the company network, and thus becomes part of the company's subnet, printing also doesn't work anymore. This IS a problem because now and then she needs to print something for work.

Is there a solution for this. How can I let the Mac know that, when it comes to printing, it needs to use the home LAN and not the company's network when on VPN? (also, does Windows also have solution for this - I also see this problem popping up in the not-so-distant future for Windows as well)

Thanks!

Custom routes based on destination IP. Look into "bypassing vpn" on Google for instructions for particular VPN implementations.

I'm pretty sure friends had this setup using Cisco's VPN for Mac OS a few years ago. However, it would probably take me a lot longer to contact those friends and ask for details than it would to find instructions elsewhere.

You pretty much can't do it.

The policy is set by the company's VPN's administrators. If you try to get past it, the VPN application will detect that and disable the VPN connection.

However, it's possible that it's not a policy and it's just a default on the VPN application. I don't have either of the Cisco VPN applications on my Mac any more, so I can't give you precise instructions, but search in their configs for something like "split networking" or "split-tunnel networking" and see if you can enable that for the VPN connection.

After digging deep into the VPN application's settings, I found a setting called "allow connection to local LAN". Unfortunately, it's greyed out. As it seems, there's no write access for this specific application so the settings can only be read, not altered. Which I find strange since this is my wife's own Mac, well, it's a company Mac of course, but I've installed it myself from scratch since Cisco's policy is: "we allow Macs on our network, but IT won't support them". So I have no idea how this application could become "read only", unless (most likely) this can be determined remotely by the network admins of the network the VPN client connects to.

I'll have my wife contact her IT department and ask if this can be changed. (I can already imagine the answer)

Another option might be to use the Mac's built-in VPN application, but I'm reluctant to test this, since I know that, if I make one simple mistake, her VPN key token will stop working and will have to be re-initialised, something than cannot be done remotely. This would mean my wife would have to drive up to her office just to do this (and most likely I would have to as well since as said IT refuses to support Macs). Still, it's tempting to try. (but she won't let me )

How does the iMac connect to the network for VPN? If its wired, try also turning on WiFi, and see if the VPN client leaves it alone. This may allow local access over wireless.

Won't work. It's a Macbook Pro and it's always connected wirelessly. Thanks for the suggestion though!

That won't work, either. Cisco uses some extensions to IPsec that aren't supported in the native MacOS VPN client.

Can you use "sneakernet" - that is, can she copy the file she wants to print onto a USB stick, and then have you print it from your computer? Ugly, I know, but easier than driving into work to pick up a page off the printer there.

tanstaafl.

It might work to connect, as OS X has specific "Cisco IPSec" as well as normal L2TP over IPSec. Works fine to connect to my work, however the OS X client also enforces the same split-tunneling restriction the Cisco client does.

So it does. I could swear that didn't use to be there.

Muhammed must go to the mountain.

Forget networking, hook the very portable, lappy up to the USB port on the printer.

Isn't it possible to simply stop the VPN and have it connecting through your network?

I'm pretty sure that's what we do with my wife's laptop. But I might be wrong...

The VPN *is* connecting through the network. The problem is the VPN software is effectively firewalling everything but the VPN endpoint to the rest of the system.

I assume you can't even ping the printer's IP?

I had a similar issue (on Windows) with a Nortel VPN client. My solution was a USB cable from the docking station to the printer (as Glenn suggested). Fortunately our new VPN software doesn't have this limitation (although I do have to kill the firewall to access my NAS).

Yes, it can be done. Since Macs aren't supported officially by Cisco, a community has grown because of it. On their intranet there is a great forum with lots of answers on how to get your Mac working with the Cisco VPN network. The answer to this question was not there though, I checked. I did see a how-to of how to connect via VPN using the built-in Apple tools. I would link to it and show you, but I can't since it's on the intranet.

Yes, you'd think that would be the ideal solution and in some ways it is, but not all. I mean, it will work, no doubt, but on the other hand it would require me to move the family printer from downstairs to upstairs which would make it a hassle for all other tasks than printing. It's al all-in-one and I use it a lot to scan stuff. For this it's handy that the printer is nearby. If I move it to my wife's working space it would be located on the other end of the house, which would make it a drag for me to use when I want to scan something.

My wife doesn't print as often as I scan things, so this doesn't look like a good deal to me. Another option would be to buy her a simple printer, but I'm reluctant to do that since she uses it only for work.

A third option would be to hang an USB cable readily available from if and have my wife come downstairs with her portable every time she wants to print something. But this doesn't sound like an ideal solution to me either.

No. While this might work for something that's already on-screen (like a word document), it surely would create problems with printing emails because Outlook would have lost its connection to the server since the VPN is down.

Oh, BTW, happy birthday!

Exactly.

Correct.

I'll have my wife contact her IT department and see what they say, though there's a big chance they'll brush her off with the big 'ol "sorry, macs are not supported" knockdown answer (which would be totally braindead since this clearly is not a mac problem, but I'm sure they'll try anyway).

We'll see, I'll keep you guys informed.

Sorry Doug, I somehow didn't see your reply.
The way she now works is she'll email me the document or email and I'll print it our for her via my PC. And it's indeed an ugly solution which I would like to see resolved.

Would there be a way to put your printer out on the internet somehow. Then your wife could print out via her companies VPN over the internet back to your house to your printer.

Never tried this myself, but it could be worth a try ???

Cheers

Cris

Hmmm... that might work. I know there are services that do this, but I don't know any. Suggestions?
I only hope those solutions wouldn't require me to open up certain ports in my firewall, which I would be reluctant to do.

Edit: Ah, it seems Google has a Cloud Print service. I'll have a look at that!

And here's another way: PrinterShare

I can't suggest anything myself, but I'm glad it got you thinking

There would be 2 problems I imagine, having to either open up port or have a server app running on a local PC all the time and the corporate firewall might block traffic like that anyway?

Hope you find something that works.

Cheers

Cris

Hmmm, this turn out to be difficult after all. The way I understand this works, with GooglePrint anyway, is you'll need to have Chrome on the computer and the printer connected to the computer, unless you've got one of those 'Google Cloud ready printers' (which I do not). Since our printer is not connected via USB to a PC, but via LAN, I'm not sure this will work. And even if it works, I'm pretty sure it won't work directly from my wife's Mac (again, because of the initial problem mentioned in this thread). It might work if I install it on my pc and my wife prints to that instead, but that means I would always have to turn my PC on before she could print. Even if I'm not at home. Sounds rather wasteful to me.

Also, you can only print stuff you upload to the Google cloud. It's not as easy as choosing 'print' in any application and then selecting "Google cloud print" as the printer or something.

Printershare might do better in that regard, but it might also have the same problem with regards to the PC having to be switched on. Also, it costs $10/month for this service which I'm not willing to pay because that would soon add up for a service that the one month might be used intensively and other months not at all.

I'll look further into this.

You can find pretty good used B&W laser printers on eBay for less than $50, and having printer redundancy in the house might be helpful for you sometime, too, like if your printer runs out of toner or something...

tanstaafl.

Ah, that's true, I hadn't thought of Outlook. You could still save everything locally and disconnect from the VPN, couldn't you?

I hadn't thought of Cloud Print as an option. Good idea. I wonder if there's a way around those problems you had with it.

I use printershare on Android to print to a bluetooth printer I have. I wasn't aware of their monthly fee... Maybe there's some fine print somewhere that contradicts that?


Yes yes, I know. I meant that he could disconnect from the VPN and be accessing his network in the same way the other machines in his home were. Sheesh!

I guess I could, but remember this is for my wife to use. The WAF of such a solution is WAY too high!


I'll look further into it and let you know.


It seems printing from mobile devices is still possible for a fixed fee. All the desktop version are either recurring or offer too little pages to be of any use (like the "basic package", which offers you 20 pages...)
See here for their rates.

My wife has a Senate issued mac and has the same vpn printing problem.

Her IT dept absolutely refuses to let the vpn down in any way for local network printing. IT also refused to let her install a driver for roundabout internet printing. I looked into adding a secondary networking device via usb, but that was locked out. And she can't attach a usb flash drive, either.

As best as I could figure, it was either email the docs to another computer or connect a USB printer. We have a b/w laser printer on USB for her mac, and networked for everyone else.

-jk

Yup. You are describing the most common complaint about all VPNs. Every time I talk to someone and tell them that I work for a company that makes VPN software, they have exactly the same complaint.

The setting you looked up, the "allow connection to local LAN", is the correct thing to be looking for. However, as you've also found, the company's VPN server has control over that feature. Their reasoning is this:

If the company allowed you to communicate on your local LAN simultaneously with the company LAN, then suddenly your computer becomes a possible unprotected gateway, sort of a "back door", between the protected company network and the rest of the world, thus defeating the original purporse of the VPN's security. Since the company has no control over how secure your home LAN is, most companies don't allow this.

You have three options here:

- Convince the company to assign what's called a "policy" to that PC which allows it to connect to the local LAN for the purposes of printing.

- Briefly bypass the VPN connection while you're printing, and reconnect to the VPN when you're done printing. I don't know how Cisco's VPN client handles it, but ours has a tray icon which lets you do this with a couple of clicks on its fly-out menu. Takes only a second.

- Connect the computer directly to the printer via a USB cable.

OK, update. Google Cloud print doesn't work. Printer Share doesn't work. I'm guessing Cisco's network simply blocks it all. I'm giving up. As Tony says, I've only got a few options. The first, I don't see that happening. The second may be worth a try. And if all else fails, I'll simply try the third option. None of these options are perfect, but they'll have to do.

Thanks all!

Ah, another thought... I still have a WiFi USB stick laying around. I wonder if I connect it to the MacBook, if I could then setup two different wireless connections (on different subnets): one for the VPN and one for the printing. I believe it's possible with Unix to tell which network traffic should use which adapter? (in Windows this isn't possible, I know that)

Jmwking's comments above make me doubt if the VPN won't also block that option, but it's worth a try I guess. My wife's notebook is also not nearly as locked down as his wife's seem to be. I can install all I want onto it and/or use any device with it. Only the company's VPN is mandatory.

This might be worth checking out, but I won't be able to until I home tomorrow. I'll keep you updated.

It certainly is possible in Windows, works pretty much the same as in Unix.

You can do that in Windows too? Could you tell me how please?

"route print" will show the current routes

"route add xxx" will add a new specific route

route by itself has fairly comprehensive help. It's in XP and Windows 7 for sure and almost definitely back to the 98/2000/NT days too.

Not that you need to use route for anything trivial. Just installing a second interface and setting the IP address, netmask and broadcast address on the interface are enough for most cases.

It is entirely possible that stuff like this is crippled in Windows Home (or whatever they call it) and the like, I've only ever used it on pro versions of Windows (and even then I haven't needed to do it for a while).

Though I do still use route regularly still. When you need to access a client's secured network and only the IP address of the office broadband router has access, it is quick and easy to VPN into the office and then add a route for the client's server via the VPN.

(the VPN I use in this case isn't locked down at all)

How? Is the VPN installed at such a low level on this machine that it has complete control over everything? I haven't seen anything like that before. In fact, I've never seen any way to completely lock down a Mac (meaning something that can't be gotten around). If you have an admin account you should be able to do whatever you want and get around any restrictions placed by any third party software.

I think it's been mentioned before however, that the VPN software might fail or pop some error if it detects another network - I wonder if they've included anything like this.

You can create networks in Mac OS over bluetooth and firewire as well. It's possible that the system's network control panel has been locked down, but you should be able to get around it with some work. I'm not sure how a third-party product would do this of course. If it's locked down by some policy on the Mac, an admin user, which can also get root access, should be able to unlock it.

No idea, but I hope you're right. I only said that because jmwking said in his post that he tried to add a secondary network device via USB, but that it didn't work for him.

Again, I hope you're right because that would be a relatively simple way to solve my problem. I'll check tomorrow and let you know how it went.

Not sure, but I *think* that would still be blocked by the Cisco VPN for the same reasons. I know ours works that way. Ours has an additional reason for doing it that way: Ours is intended to automatically hop among different connection types (wifi, wired, wwan) without losing the VPN connection, so ours grabs every single possible network connection, and then directs all network traffic destined for any one of those connections through the VPN, using the fastest available network connection as its tunnel.

Again, that's all configurable... at the VPN server side.

At the end of the day you can also dual-boot the Mac to another instance of Mac OS without VPN.

Erm, no. Just turn the VPN client off. They arent typically designed to lock you out of your networking, they are just designed to stop you making other connections while connected to the network they are supposed to be protecting.

Yes. The VPN software will detect any change to the routing table and disable the VPN connection.

If it can be turned off, then it's not locking down the entire system. Which did sound implausible anyway.

Bitt's routing table point makes the most sense, and having the VPN shut down when it see changes would preclude my original suggestion of simply creating a new route for the printer.

Just a thought, triggered by one of mlord's posts about an Android app -- does your printer have bluetooth capability, or can that be achieved via an adaptor? Since that's using a different networking technology, the VPN won't block it.

If you have spare in-wall cat5 cabling that runs between the two rooms, then you could use a $20 USB extender kit from DX.

Good point! Yes it does, and so does the Macbook pro obviously. I'll give it a try, but I doubt it'll work since there's too much room between the MBP and the printer. The printer is about three rooms away and on the floor beneath where the MBP is. Lots of concrete between those two points too, and Bluetooth isn't exactly known for its wide range. But I'll give it a try.

Edit: No dice. It seems the printer needs an USB Bluetooth adapter for the Bluetooth function since the printer doesn't seem to have the Bluetooth transmitter built in. Needless to say, I don't have such a USB adapter. Bummer.

Also a good idea, but unfortunately, no such luck.

Must be an HP printer, right?

I stuck a $1.50 BT adapter (from DX) into mine. Works well, but I doubt it would go through concrete.

Yup. An HP Photosmart C6180 all-in-one.

Come to think of it, I DO have a BT adapter here,$ the one from my DiNovo keyboard. Of course I need that one, or my keyboard wouldn't work any more, but I could use it just to try it if it works. But indeed, I don't have high hopes because of the distance issue.

That dinovo dongle isn't likely to work. It presents it's self as a pair of hid devices. Besides its a usb slave.


Just noticed, on an iPad, after selecting some text, the iPad's action balloon can obscure the bbs's action icons. I couldn't strike out that text till I added a few leading blank lines.

I still offer that picking up the laptop and walking it to the printer, where a handy USB cable can be employed, is your best option.

After all the paper isn't going to deliver it's self wirelessly.

Nothing wrong with USB slave -- that's what the printer expects from a BT dongle. But it does have to be a real BT dongle.

I was thinking, mistakenly, of the dinovo dongle, somehow being plugged into the printer.

No, you're correct. The dongle needs to be connected the USB port of the printer. There's one built in the front of the printer especially for that purpose. Still haven't gotten around in trying the DiNovo dongle though, but I also have my doubts if it'll work.

On the other side, you're obviously correct also. The range of Bluetooth is so limited, I could just as well walk up to the printer and connect the USB cable. But, more than anything, this 'problem' for me has become a challenge in 'beating the system', without giving in, in this case: printing while connected to VPN without having to move the laptop to the printer. Hmmm... maybe wireless USB is an option.

No that one won't work. It doesn't register as a generic BT device.

It shows up as as if a kbd & mouse was plugged in. Which makes it very good if you are trying to activate a bios menu on your computer.

Although I admire you for wanting to beat the system, you've got some things happening which are at direct odds with each other, so that's going to be a hard system to beat. The printer has three inputs: Bluetooth, USB, and LAN, and each of those has a problem.
- Bluetooth: Too far.
- LAN: Blocked by VPN (I still say your easiest option is bypass VPN while printing, takes all of two seconds).
- USB: Requires physical proximity.



Not a cheap one, but maybe.

Here's a more basic question:
- You want to print a hard copy of something from this laptop.
- Printing something implies that you want to have that hard copy in your hand.
- So, at some point, you personally have to be in physical proximity to the printer anyway, to pick up the hard copy.
- So why not just get a cheap USB or Bluetooth printer for the room that contains the laptop? Or permanently move the printer to the room with the laptop?

I asked my wife about the 'dropping the VPN for a few seconds to issue a print command', but it seems this doesn't work for her. One of the programs she uses the most is Outlook. Now, her version of Outlook runs in a Windows 7 virtual environment (vmware) on her Mac. (she doesn't use the Mac version of Outlook because it lacks certain features she really needs). It seems her Outlook doesn't like it when it's connection to the server gets interupted, I don't know if this has anything to do with the fact it runs in a virtual window or not.


Heh. At the prices those Wireless USB extenders come, it's actually a lot cheaper to just buy another printer. I think I'll take your advice, thanks.

Yeah, printers are cheap these days.

So's clicking on a disconnect button...

As said, it's not the disconnecting itself which creates a problem, because that's obviously easy enough, but the fact my wife's Outlook creates all sorts of problems (lockups, crashes, ...) when you bluntly cut the connection to the server.

Wow, okay, yeah. That's a pain. It's not supposed to do that. My Outlook doesn't have that problem, it just quietly disconnects in that situation. Actually, my company allows Outlook to work outside the firewall, so mine quietly disconnects, then reconnects to the external-facing exchange address. Maybe it's because something is wrong with her outlook installation (my guess would be plug-ins causing that), or maybe it's because my company's VPN is cleaner about disconnecting than Cisco's VPN is.

Of course, there's always: Exit outlook, disconnect, print, reconnect, launch outlook, but yeah, that's a pain. Especially if you want to print from outlook.

But yeah: cheap little bluetooth printer? Simplest solution.

No idea, could be.


...which is indeed mostly the case. (of course it is, anything other would be less annoying and we can't have that, can we? )


By now: agreed.
(thanks for your help!)

You could always print to PDF (which is very easy under MacOS) and then print those to paper after the VPN session is complete. That requires that the physical printouts are not needed at the time, though.

That's an excellent suggestion, I'll keep that in mind, thanks!