Forum Discussion
vrivoire_97090
Nimbostratus
NimbostratusMS Print servers
Hi all,
I am planning to use my new F5 LTM to load balance Windows Server 2003 print servers. For the moment, it doesn't work for me: I can see the shared printer but I can't map it.
Has anayone already "played" with LTM & MS print servers ?
Thanks,
Vincent
Here's the new link to the guide for creating the WMI monitor. As I recall it was pretty straightforward. I'm even using the same interval and timeout. Looking at my monitor properties, the only thing I see that is different is my alias service port is 3389 and the external program path is /usr/bin/monitors. Also, you'll need to enable remote WMI requests on the win2k8 boxes if not already enabled.
Monitoring WMI Services from Big-IP
Anonymous25Hello everyone,
I am struggling to get a 2016 MS Print Server to sit behind the F5.
I have followed a number of different threads and posts from multiple load balancing sites, but have yet to come to the proper solution. In our environment, we need to be able to map to the individual printers. I am able to get the configuration as far as being able to start mapping a printer \\printserver\printername but when I click next, I just get an error. And if I click browse, there are no printers to select.
I have done multiple registry changes, enabled and disabled NetBios, and a bunch of other things. I am hoping that there is someone here who might be able to further assist me with this project.
Thanks!
- Anonymous25
As an additional update, it does not matter if I use the NPath iApp or build a virtual server. If I map to the printer directly through the print server, I have no issues, when trying to map through the F5, either via NPath or virtual server, I get an error on the Print Server using Wireshark stating, OpenprinterEx reponse, invalid printer name. it doesn't matter if I add it through the VIP or DNS name, I always get this issue.
Thanks.
- Anonymous25
Andrew,
I made some changes to my Virtual Server and my window servers. I made the two changes you have mentioned above and tweaked the registry more and I was able to get the printer to print! Yay!
I am going to start from scratch once more with the Windows Server to see exactly what I need for the windows server. I will also post up my configuration from the F5 just in case.
Thank you for the help. I can now start working on actual testing!
Christopher_BooCirrostratus
Here's another print problem I've been noodling on for the last couple days and just figured out. Anonymous jobs going to zebra print queues (on 2008 R2) would spool, but not print. Anonymous has access to spoolss, so what could be the problem? It turned out to be driver isolation. With driver isolation enabled the drivers run in their own protected process, not the spooler process. I disabled driver isolation for the problematic driver and anonymous jobs started printing. That was an interesting one.
rduque481Chris,
Is there anyway you can send me some screenshots of the settings on your VS ? I see a couple of replies back that Brian Mayer says he just did a standard vs with snat, but id also like to do the same thing with priority groups, even though I'm not sure how to do this so if you or Brian can help me with the priority group settings. also if you provide me with the wmi string you used to monitor the servers it would be much appreciated.
- Christopher_Boo
Something interesting I found yesterday while trying to get our Optio app printing to the 2008 print server VS, the print jobs were erroring out with an error code 5. This is indicative of a permissions issue. Per Optio, the fix for 2003 server is to change local security policy to allow everyone permissions to apply to anonymous as the jobs are created by the system account on the Optio server and are treated as anonymous by the remote print server. This fix wasn't working in 2008 and Optio support was at a loss. After a bit of digging I found that you must also edit the "named pipes that can be accessed anonymously" local security policy to include SPOOLSS. After making this change, the jobs started printing successfully.
I hope someone may find this info useful as I wasn't finding much myself while trying to figure this out.
Chris
- Christopher_Boo
Here's the new link to the guide for creating the WMI monitor. As I recall it was pretty straightforward. I'm even using the same interval and timeout. Looking at my monitor properties, the only thing I see that is different is my alias service port is 3389 and the external program path is /usr/bin/monitors. Also, you'll need to enable remote WMI requests on the win2k8 boxes if not already enabled.
Monitoring WMI Services from Big-IP
Brian_Mayer_841Thanks Chris, this is a really helpful clarification. I'll look into WMI, as I vehemently despise TCP monitors for most apps in general. :) Our print server jobs are all local site LAN traffic so bandwidth should not be an issue. Also, our print servers are all running Win2k8. If you can find the WMI link that would be cool, and if you might be able to share any details on how you've configured your WMI monitor to keep tabs on print services, I'd love to see how you've done it!
Thanks much, B
- Christopher_Boo
Brian
I think some of the confusion is in the objective. Some just need to send a print job to a load balanced print server. Others need end users to be able to map to print queues, download drivers, print, etc. Also every environment is different. I'm sure that is a factor as well. I'd strongly suggest using the WMI monitor. The TCP port check just isn't sufficient, or at least wasn't for us. I posted a link to the how-to a few years ago, but it looks like the site update broke it. I'll try to find it again. Believe it or not, I still have my Win2K print server VIP (NPath) in production as well as the Win2K8 print Server VIP (standard). They are both rock solid. I will say if bandwidth might be an issue, I'd go with Npath. But we haven't had a print server outage in years with either vs. multi-hour outages using Windows Print Clustering previously.
Chris
- Brian_Mayer_841
Hey guys,
We've just implemented a print server "load balancing" solution using our LTMs where, instead of distributing print jobs across 2-3 print servers, we used priority groups to ensure traffic always goes to a certain print server if it's online. The other server (pool member) with a lower priority would only get the print jobs if the primary was down.
Anyway, I'm using SNAT as the pool members are not on the same VLAN as the LTM. We're also using a simple tcp health monitor on port 515 to determine service health. Everything seems to be working. I didn't have to do a lot of the extra effort I noticed many others went through on the articles I read here on DevCentral.
We went with priority groups as the goal was to understand which printer would get any given pick slip out of our ERP print jobs, so we're not running around the warehouse looking for the printer where a job may have been sent. I'm not uber-thrilled with the health monitor, and have seen some WMI-type monitors that might come in useful.
I guess I'm wondering why I didn't have to deal with all the trouble many others have had? Are my print servers misconfigured, or do those registry changes only come into play when using nPath routing?
Thanks! B
Skye_85590IMPORTANT: This thread has confused quite a few people - npath is not necessarily required to get MS file and printer sharing to work. It is entirely possible to set up a simple network topology, not Npath, and use a SNAT (automap etc).
The following config worked once the Microsoft server requirements were satisfied:
- Standard virtual using SNAT automap, mapped for all ports, no port translation, to a pool with members mapped on all ports. You can use a custom tcp monitor with an aliased port (click "Advanced" in the monitor config) to monitor the all ports pool.
MS server configuration requirements (was Windows Server 2003 in this case - would appreciate feedback in this thread regarding requirements identified on other Windows versions):
- Disable Strict Name Checking
- Configure Optional Names (the DNS Name of the Virtual Server)
I suspect kerberos to be involved and I would like to see packet captures before and after the change but do not have time to do a repro.
If using npath, this will likely be needed: Disable Loopback Check
Details of the registry settings:
Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
On the Edit menu, click Add Value, and then add the following registry value:
Value name: DisableStrictNameChecking
Data type: REG_DWORD
Radix: Decimal
Value: 1
Disable Loopback Check
1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer.
Configure Optional Names (the DNS Name of the Virtual Server)
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters,
then create the OptionalNames value, you can enter a list of names. (This should be the DNS name setup for the VIP.)
Restart the computer, and the server will then respond to any of the names you listed.- Christopher_BooKeep in mind when this thread was created about 90% of Devcentral focused on load balancing web servers. There was nothing from F5 and next to nothing on the net regarding hardware load balancing print servers. Based on Meena's thread and what I had found elsewhere, that config worked for me. Considering how many hits this thread gets, I dare say it has helped more than it has confused. You are correct though, npath is not necessarily required. I had more control in the design of our 2008 print environment and don't use npath in it. As with anything, test and see what works best for you.
- Christopher_Boo
Also have a look at this. I don't have DNSOnWire enabled on any of my print servers, but every environment is different. Perhaps this is the fix for you.
http://forums.citrix.com/thread.jsp...tstart=165
Chris
- Christopher_Boo
Ryan,
The only thing I recall tripping me up with 2008 was having to enable weak host send/receive. See here...
http://technet.microsoft.com/en-us/...leguy.aspx
Let me know if this doesn't fix your problem. I'll take a closer look at my config.
Chris