MS Print servers

Hi again,

 

I have to make a little correction on my second last post. Today we realized again problems and it wasn't working anymore (not sure why this happens today).

 

But we found the critical option on the LB, it's the Address Translation, which is enabled by default. It needs to be disabled for the MS printing service. All other settings can stay on its default values, no TCP- or fastL4 profile modifications and also SNAT can be used.

 

Based on the findings from Meena, that the IP-address in the TCP-data part will be used I thought it shouldn't matter if this option is enabled or not (so I choose the default setting).

 

To summarize my findings:

 

- we are using 9.3.1 and w2k3

 

- print server with loopback adapter (same IP as the VS)

 

- enable "Client for MS networks" and "File and Printer Sharing" on the loopback adapter

 

- the two Registry tweaks are NOT implemented

 

- VS and poolmembers with the "any"-port option

 

- disable Address Translation on the VS

 

- all other settings on the LB can stay at its default value or can match you individual preferences

 

- if the Default Gateway of the print server is not pointing to the LB, I prefer to enable SNAT to have a clear traffic flow and no asynchronous routing (makes things complicated especially during troubleshooting), but it will also work with SNAT disabled (doesn't matter from a technical point of view)

 

 

Ciao Stefan :)

 

I'm in the process of building a new 2008 print server environment and wanted a better health monitor for print services. Following the instructions in the article below, you can create a health monitor for anything that can be queried via WMI (windows service state, cpu, memory, etc.). The title is kind of misleading as the benefits go much further than just terminal services monitoring, but the info is huge for me. Figured it was worth pointing out....

 

 

http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086419/Monitoring-Windows-Terminal-Services-from-BIG-IP.aspx

 

Stuck at the moment. I can map the printer fine if I connect through the VIP (eg. \\192.168.0.10 and double-click on the printer). But if I map the FQDN (eg. \\virtualserver.mydomain.com and double click on the printer) I get the error "Operation could not be completed (error 0x00000709). Double check the printer name and make sure that the printer is connected to the network."

 

 

This is Win2K8. Registry settings DisableLoopbackCheck, DisableStrictNameChecking, and OptionalNames are set. F5 Service Ports 0 (All services) are set on the Virtual Server and Pool config. Not sure what to do at this point, would appreciate any help! I have access to the F5 and the servers.

 

 

Ryan,

 

The only thing I recall tripping me up with 2008 was having to enable weak host send/receive. See here...

 

http://technet.microsoft.com/en-us/...leguy.aspx

 

Let me know if this doesn't fix your problem. I'll take a closer look at my config.

 

 

Chris

 

Also have a look at this. I don't have DNSOnWire enabled on any of my print servers, but every environment is different. Perhaps this is the fix for you.

 

http://forums.citrix.com/thread.jsp...tstart=165

 

Chris

 

IMPORTANT: This thread has confused quite a few people - npath is not necessarily required to get MS file and printer sharing to work. It is entirely possible to set up a simple network topology, not Npath, and use a SNAT (automap etc).

 

 

The following config worked once the Microsoft server requirements were satisfied:

 

 

- Standard virtual using SNAT automap, mapped for all ports, no port translation, to a pool with members mapped on all ports. You can use a custom tcp monitor with an aliased port (click "Advanced" in the monitor config) to monitor the all ports pool.

 

 

MS server configuration requirements (was Windows Server 2003 in this case - would appreciate feedback in this thread regarding requirements identified on other Windows versions):

 

 

- Disable Strict Name Checking

 

- Configure Optional Names (the DNS Name of the Virtual Server)

 

 

I suspect kerberos to be involved and I would like to see packet captures before and after the change but do not have time to do a repro.

 

 

If using npath, this will likely be needed: Disable Loopback Check

 

 

Details of the registry settings:

 

 

Locate and click the following key in the registry:

 

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

 

On the Edit menu, click Add Value, and then add the following registry value:

 

Value name: DisableStrictNameChecking

 

Data type: REG_DWORD

 

Radix: Decimal

 

Value: 1

 

 

Disable Loopback Check

 

 

1. Click Start, click Run, type regedit, and then click OK.

 

2. In Registry Editor, locate and then click the following registry key:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

 

3. Right-click Lsa, point to New, and then click DWORD Value.

 

4. Type DisableLoopbackCheck, and then press ENTER.

 

5. Right-click DisableLoopbackCheck, and then click Modify.

 

6. In the Value data box, type 1, and then click OK.

 

7. Quit Registry Editor, and then restart your computer.

 

 

Configure Optional Names (the DNS Name of the Virtual Server)

 

 

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters,

 

then create the OptionalNames value, you can enter a list of names. (This should be the DNS name setup for the VIP.)

 

Restart the computer, and the server will then respond to any of the names you listed.

Hey guys,

 

We've just implemented a print server "load balancing" solution using our LTMs where, instead of distributing print jobs across 2-3 print servers, we used priority groups to ensure traffic always goes to a certain print server if it's online. The other server (pool member) with a lower priority would only get the print jobs if the primary was down.

 

Anyway, I'm using SNAT as the pool members are not on the same VLAN as the LTM. We're also using a simple tcp health monitor on port 515 to determine service health. Everything seems to be working. I didn't have to do a lot of the extra effort I noticed many others went through on the articles I read here on DevCentral.

 

We went with priority groups as the goal was to understand which printer would get any given pick slip out of our ERP print jobs, so we're not running around the warehouse looking for the printer where a job may have been sent. I'm not uber-thrilled with the health monitor, and have seen some WMI-type monitors that might come in useful.

 

I guess I'm wondering why I didn't have to deal with all the trouble many others have had? Are my print servers misconfigured, or do those registry changes only come into play when using nPath routing?

 

Thanks! B

 

Brian

 

I think some of the confusion is in the objective. Some just need to send a print job to a load balanced print server. Others need end users to be able to map to print queues, download drivers, print, etc. Also every environment is different. I'm sure that is a factor as well. I'd strongly suggest using the WMI monitor. The TCP port check just isn't sufficient, or at least wasn't for us. I posted a link to the how-to a few years ago, but it looks like the site update broke it. I'll try to find it again. Believe it or not, I still have my Win2K print server VIP (NPath) in production as well as the Win2K8 print Server VIP (standard). They are both rock solid. I will say if bandwidth might be an issue, I'd go with Npath. But we haven't had a print server outage in years with either vs. multi-hour outages using Windows Print Clustering previously.

 

Chris

 

Thanks Chris, this is a really helpful clarification. I'll look into WMI, as I vehemently despise TCP monitors for most apps in general. :) Our print server jobs are all local site LAN traffic so bandwidth should not be an issue. Also, our print servers are all running Win2k8. If you can find the WMI link that would be cool, and if you might be able to share any details on how you've configured your WMI monitor to keep tabs on print services, I'd love to see how you've done it!

 

Thanks much, B