How to Manage Wi-Fi Printer in a VLAN Environment

[White Bear]

What's a practical best networking practice for a seldom used, usually offline printer, using an RT6600ax with VLANs.

We currently have two VLANs:
- 'Primary' for 9xApple devices and 3xNAS, as well as the printer
- 'IoT' for Kasa lighting controls and doorbell cameras, smart TVs, and Internet radio

Does the printer on 'Primary' VLAN pose a security risk worthy of action?

If so, what is the most straightforward (easy to maintain) way to mitigate that risk (e.g. leave in 'Primary' and create firewall rules, add a 'Printer' VLAN, or move to 'IoT' VLAN)?

Edit: Or would it be best to use one of the Mac Studios as a print server?

This post includes affiliate links. As an Amazon Associate, SynoForum.com may earn a commission if you make a purchase — at no extra cost to you.
It helps support our community! Learn more...

 

[Telos]

With the qualifier that I do not use RTs or Mac... My wireless printer is on the IOT VLAN. My primary devices (Trusted VLAN) can reach the IOT VLAN. The IOT VLAN devices can respond to, but not initiate contact with devices on my Trusted VLAN. By default, the IOT VLAN is blocked from external traffic (Internet), and my gateways. Printer firmware updates (quite rare), are done locally.

 

[fredbert]

I would say that it depends how you access the printer. If it is accessed using Bonjour '.local' then it may be that it won't work with discovery across VLANs. If you are using IP addresses then it probably should work. I have given up and have my HP Envy and Denon HEOS on the primary VLAN, it was too hit and miss getting it work reliably with it on the IOT VLAN. This is even with the prinary VLAN being allowed access to the IOYT VLAN, but not initiated the other way around.