Jump to content



Photo

printer madness with OS X clients in multi-OS environment


  • Please log in to reply
10 replies to this topic

#1 Seizure1990

Seizure1990

    Neowinian Senior

  • Joined: 17-February 08
  • Location: NYC

Posted 18 August 2014 - 21:26

Hello all. I am having a very strange issue with printers and OS X client machines on our network. any help would be greatly appreciated.

 

Description of environment:

at my org, our network infrastructure consists of a pfSense server serving as our routing software and first layer between modem and network. We have two Windows 2012 servers running as primary and secondary DHCP and DNS servers, and we have an OS X server for random needs and jobs.

 

Many machines are laptops, and obviously wireless. Most of the desktops are wired. We use two Apple Airports as our WiFi stations, acting in tandem under the same SSID.

 

Our org contains both Windows and OS X machines. All Windows machines are Windows 7. OS X machines are either 10.6 or 10.9 depending on hardware.

 

The problem:

There is a consistent issue with Mac computers in the office being unable to successfully add printers by FQDN. To make this even more frustrating, nearly all aspects of the issue seem completely random. On any given day, a given Mac seems to have issues connecting to at least one of our networked printers by FQDN, and will only work by IP or Bonjour. One of the other Macs will be able to connect just fine to those, but maybe have trouble with another printer, and only work with NETBIOS, but not FQDN. Two of our printers are exactly the same model, and there is no pattern to be seen in that. Some of our Macs are the same model, no pattern there either. No pattern between OS X version.

 

Once a Mac successfully connects to a printer, all is good. You will be able to use that printer forever. But maybe one day you decide to disconnect the printer and reconnect for some reason, or the OS had to be reinstalled. You might find that the printer you connected to fine a day ago, now can no longer be connected to.

 

The only pattern I've seen is that IP address and Bonjour always work. Great, but not very user friendly.

 

Troubleshooting:

I have tried doing ping/nslookup/traceroute diagnostics on all the OS X machines. What I have noticed:

- Ping works as expected: FQDNs which are currently giving issues on the particular computer will not respond to pings. IP always works. Sometimes NETBIOS works but not FQDN, as I mentioned

- nslookup always works. Even for FQDNs which supposedly aren't working. It gets the gateway or DNS server(I forget which it's supposed to be) correctly as well as the correct IP address for the given FQDN. No warnings or errors.

- traceroute is interesting. It does not seem to work internally at all. Running a trace to external sites hangs on the internal section for a bit, then skips ahead to the external hops as normal. Trying to trace an internal address causes it to "* * *" forever. I have tried doing tracert on Windows machines for comparison, and it works perfectly,  internally and externally.

 

If anyone has any insight which helped me solve this, you would become my hero. Thanks in advance!




#2 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 96
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 18 August 2014 - 21:36

" FQDNs which are currently giving issues on the particular computer will not respond to pings."

FQDNs do not respond to anything - they would resolve, and then that IP would ping

So when you do say

ping printer.yourdomain.tld -- do you get back the IP address or does it say host not found or some other error?

Where do you point for DNS? The only DNS in how you described your network would be your 2012 boxes - that would be the ONLY dns server you should be handing out to any client be it wired or wireless. If you hand out others this could cause you grief, because most likely pfsense does not know about your printers, etc.

what are the settings your getting for your os x clients when wireless. What does ipconfig /all show for your window machines?

pfsense should be the gateway, your 2k12 boxes should be dns

What is your domain your using for your fqdn for your printers?

#3 OP Seizure1990

Seizure1990

    Neowinian Senior

  • Joined: 17-February 08
  • Location: NYC

Posted 18 August 2014 - 22:49

When I ping an FQDN it claims it could not resolve the host, despite nslookup working perfectly.

 

Our Windows 2012 servers are the only DNS servers in the system, and only one is primary, other is secondary/backup. Nothing else besides our Windows server is handing out DNS.

 

"pfsense should be gateway, 2012 boxes dns"

Sorry, I was wrong about what I said. Our gateway is indeed what it should be, pfsense. DNs is 2012.

blhB34L.png

 

Here are the OS X settings, from a very new Macbook Air running 10.9:

Huairous-MacBook-Pro:Desktop admin$ sh networkinfo.sh
 
   Public IP: XX.XXX.XXX.250
   Hostname: XXXXXXX-MacBook-Pro.local
 
Wireless Ethernet (en0)
-----------------------
  IP Address: 10.10.10.97 (DHCP)
  Subnet Mask: 255.255.255.0
    Router: 10.10.10.1
  DNS Server: 10.10.10.6, 10.10.10.7, 8.8.8.8
Search Domains: xxxxxx.org
  MAC Address: XX:XX:XX:XX:ee:6a
     Speed: 	media:
 
Wired Ethernet (en1)
-----------------------
  IP Address: inactive
  MAC Address: XX:XX:XX:XX:52:50

Our main, EXTERNAL domain (the one you use to reach our public website) is xxxxxxx.org, while our internal network is local.xxxxxxxx.org. So to reach one of our printers, you should be able to use the address "printer.local.xxxxxxxx.org"



#4 DaveLegg

DaveLegg

    Coderator at heart

  • Tech Issues Solved: 15
  • Joined: 31-October 04
  • Location: Oxford, UK

Posted 19 August 2014 - 07:48

DNS Server: 10.10.10.6, 10.10.10.7, 8.8.8.8
 
There's your problem, you've got 8.8.8.8 configured as a DNS server in addition to your two internal ones. Remove that from the configuration, and your issues will likely go away.



#5 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 96
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 19 August 2014 - 09:50

^ YUP exactly -- thought you said your 2k12 were the only dns

 

"Our Windows 2012 servers are the only DNS servers in the system"

 

I can tell you for fact that 8.8.8.8 has no clue to your printers IP ;)

 

You can not list dns that don't know your stuff without having grief..  Your local dns servers need to forward or look up from roots what they are not authoritative for.  That way when you look for printer you always get answer, when you look for say www.neowin.net your 10.10.10.6 box goes and asks 8.8.8.8 hey whats the ip for www.neowin.net I don't know it.

 

Another thing I see as possible issues is

 

hostname MacBook-Pro.local

Search Domains: xxxxxx.org

 

Why do you have your hosts in a .local domain, but have them search xx.org domain? - Single label domain as well from what it looks like since their hostname is XXXXXXX-MacBook-Pro.local

 

Why not put all your box in whatever domain your using locally -- what domain are you printers in?  And single label not really a good idea -- should use say xxx-macbook-pro.yourdomain.local

 

Also see a link local ipv6 there - are you using ipv6?  Are you registering AAAA in your dns?  If not just completely disable it - there is no reason for ipv6 if not actually using it.  If you want to use it then set it up correctly and your mac books should have it as well, etc.



#6 Anibal P

Anibal P

    Neowinian

  • Tech Issues Solved: 1
  • Joined: 11-June 02
  • Location: Waterbury CT
  • OS: Win 8.1
  • Phone: Android

Posted 20 August 2014 - 12:32

The Airports are set to only be access points, right? Unless a setting was missed the 8.8.8.8 DNS should not be there at all, but the pros already said that 



#7 OP Seizure1990

Seizure1990

    Neowinian Senior

  • Joined: 17-February 08
  • Location: NYC

Posted 27 August 2014 - 14:57

Hello, and thanks for the help everyone! I will need some clarification though... where exactly should we be putting the 8.8.8.8 entry? I should mention that the reason we use Google's DNS is because our own ISPs DNS servers (TimeWarner Cable) have been iffy in the past and caused us issues with domain resolution. The 8.8.8.8 entry is NOT within the computer's settings its self, but within the router or server settings (forget which off the top of my head right now).

 

Where should I be adding the 8.8.8.8 so that DNS requests are answered properly? How do I forward them as opposed to whatever I am doing now? Is this the proper tutorial here?

http://technet.micro...y/cc754941.aspx

 

As for the rest... I honestly have no clue why the mac says ".local" as a TLD. We definitely have no such thing on our network (using custom TLDs is bad news). I assumed it was some sort of Mac quirk. and to answer your question, our interal domain is local.[xxxxxx].org. 

 

I will talk to the senior tech about diabling ipv6, though I am curious as to what problems this could cause, and I am sure he would be too. Is it just a matter of best practice?

 

Can you clarify for me what you mean by "single label"?

 

And as for our airports, they are only access points.

 

Thanks for everyone's advice!



#8 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 96
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 27 August 2014 - 19:21

As to disabling ipv6 - I am sure there will be debate on is it best practice to disable or not.. Windows out of the box has 3 different methods of tunneling ipv6 out over ipv4, 6to4, teredo and isatap. You would think they would of learned their lesson from back in the day when iis was enabled out of the box.

Enabling protocols/services that are not used is security 101.. Do you run ipx/spx if your not using that network protocol? So why should you be running ipv6 unless your actively using it. I run ipv6 on a couple of boxes. All my others its disabled on - because they have no use for it as of yet. If at such time there are actual services that are only available via ipv6 then I will enabled. As of yet this is not the case.. And most likely will not be for years to come.

If you want your company to be in the front of the pack - great!! Get your network guys to correctly roll out ipv6. Leaving on what MS turned on out of the box is nothing but a sign that the network guys running this network have no clue to what they are doing in my personal opinion. Just being blunt about that - I would ask your network guys why it is enabled, you didn't show your full output - but I guess that 6to4, teredo and isatab all enabled aren't they ;) Are you using all three of those methods of getting out to ipv6 addresses?

If your mot using it its going to cause nothing but noise on your network for no reason.

Yes that article should work - 8.8.8.8 should where your AD servers go ask when a client asks hey where is www.neowin.net

Single label dns is this

hostname.tld

so mybox.local is a single label domain name.

While there is support for it
http://support.micro....com/kb/2269810

Its not really good practice, and yes your .local is mac thing
http://en.wikipedia.org/wiki/.local

I would do some research on macs and .local with your AD setup - there is some info about in that above link. You also are going to want to make sure that your AD box is authoritative for it if your not going to remove it from your OS X stuff. Or you start sending queries to 8.8.8.8 for something.local

So you your OS X box asks for printername.local -- well your AD doesn't know about that, so what will it do - it will ask 8.8.8.8 for it.. Well .local is not a valid public tld, so it sure and the hell is not going to know anything about it. So your just wasting queries and sending out info about names on your network to the public net for no reason, etc.

Once you get your clients from not asking 8.8.8.8 for dns, and make sure your printers are all listed in your AD dns with their actual fqdn all your name resolution problems will go away.

#9 OP Seizure1990

Seizure1990

    Neowinian Senior

  • Joined: 17-February 08
  • Location: NYC

Posted 27 August 2014 - 22:14

Thank you so much for all your guidance! I am going to be in the offices tomorrow, so I will be able to put all of this advice to use soon. I will be back to report on my progress for sure.



#10 OP Seizure1990

Seizure1990

    Neowinian Senior

  • Joined: 17-February 08
  • Location: NYC

Posted 28 August 2014 - 18:01

I read through the articles concerning mDNS, and the .local TLD but I aam not entirely sure what I am supposed to do about it? I tried googling mDNS configuration, but got nothing of much use. Is mDNS just a fancy way of saying I should forward .local to local.[xxxxxxx].org?

 

Thanks for the help!



#11 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 96
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 28 August 2014 - 21:01

no mDNS is multicast dns, and its whole reason is to resolve stuff where there not a actual nameserver.

So these apple boxes you have - they are running in your windows AD network? If so then the .local is useless in a real network. Apple boxes will send out queries for this stuff sure.

Unless you can set them up not too, which would would think you could -- they should be aware that they are in your .[xxxxxxx].org domain.

If you don't fix them from asking for stuff in .local, then you might want to have your local nameserver(s) be authoritative for .local so that it doesn't forward it on to the internet 8.8.8.8 dns is all.