Printing using Virtual Channels through FirePass

I was interested in your post as we have the problem of not being able to support each and every printer which our RDP users might have. In reading further I stumbled across this document which seems to suggest that for ActiveX clients it could work by using the ScrewDrivers plug-in. See

 

http://www.tricerat.com/support/docs/sdv4help/ScrewDrivers_v4_Help.pdf

 

 

ScrewDrivers for SSL VPN w/RDP

 

For SSL VPN devices such as SonicWall, StoneWare, Juniper, F5 Firepass, etc, these appliances must be configured properly to enable third-party plugin DLLs. For ScrewDrivers, there are two requirements to use these devices:

 

1. Clients must use the RDP ActiveX client (Terminal Services Advanced Client TSAC)

 

2. The appliance must be configured to enable the ScrewDrivers plugin DLL, sdrdp5.dll.

 

Most SSL VPN devices automatically publish an RDP clients that do not support all 3rd-party DLLs. Java clients are an example of RDP clients with limited support of 3rd-party DLLs.

 

Note: Please contact the vendor to verify that the appliance is properly configured to support 3rd-party DLLs for MSTSC

 

 

If you do manage to mke any progress with this I would appreciate an update if you could?

 

 

Best wishes,

 

Kevin

Kevin,

 

 

Thanks for looking into it. Yes, in order to pass that dll SSL device need to support RDP Virtual Channels for third party communications to flow with your RDP session. FirePass and its ActiveX and Java based RDP clients do not offer that option.

 

 

It works if you create a tunnel over 3389 and use a local native RDP client. But that option is not desirable for us since the users have to authenticate twice. The best scenario would be to have an ActiveX RDP client that supports 3rd party dlls over virtual channels.

 

 

You mentioned that you offer RDP printing with FirePass print redirection. How do you manage print drivers? Doesn't it require having matching drivers on the client and remote XP that users connect to? Do you have one to one mapping per user or do you have a pool of remote XP resources with all the known drivers?

 

 

Thank you, Oleg.

Hi Oleg,

 

 

No - we do not currently offer client printing from the TS although we are under pressure to. All we've done currently is to give the users access to a "print to PDF" driver on the TS. As we don't allow drive access, network resources etc. they have to use email to transport the PDf file to their local machine and print that. Far from satisfactory...

 

 

I had the impression from that Screwdrivers help file that the ActiveX client could be used as they specifically said "1. Clients must use the RDP ActiveX client (Terminal Services Advanced Client TSAC)". Maybe I'm not understanding something here?

 

 

Thnaks,

 

Kevin

Kevin,

 

 

You maybe right. But according to those documents you have to allow 3rd party dll to be passed. And you configure it on your SSL VPN - Juniper, SonicWall, StoneWare. That makes me think that this functionality is built into the SSL device itslef and not just a feature of the native Advanced RDP client. Otherwise all you would need is a tunnel over 3389 and native RDP would take care of the rest.

 

 

Please share your thoughts and development on the printing through FirePass. Printing is a major objective for us. And so far we do not have a solution.

 

 

Thanks, Oleg.

Posted By Oleg Sayakov on 09/21/2009 1:13 PM

 

 

Hey FirePass users,

 

 

We are trying to get Screwdrivers RDP printing product from TriCerat http://www.tricerat.com/screwdrivers to work with the FirePass. Unfortunately Screwdrivers, like other thin printing solutions, uses Virtual RDP Channels. ActiveX RDP client on the FirePass does not support VC. Has anybody tried this combination or similar anything similar to this?

 

 

We are trying to come up with a solution for printing through FirePass from a VM session back to a home/remote office printer. Using FirePass printer redirection will require management all the print drivers and doesn’t seem like a good option.

 

 

Anyone has any ideas on how we could implement it? Are there any thoughts outside the box? Any workarounds? Has anybody customized their F5 RDP client to facilitate this?

 

 

Greatly appreciate all the responses.

 

Thank you, Oleg.

 

 

 

This is what I would do, it is a long shot but...

 

 

Package your application.

 

Have the user's download the application.

 

Create an application tunnel to point to the desired terminal server with the desired package application.

 

 

So we are using VMware, the users are forced to download the package. Once installed, log back on to the Firepass. An application tunnel is then launched kicking off the program, it will then use our specific pararamters into the application. This should allow you to use the customized screwdriver settings.

Hi Oleg and Mike,

 

 

I should have posted an update here so sorry....

 

 

Our situation is that we now have remote printing working as we need but we've done that by giving up on Screwdrivers and we are using the Windows 2008R2 version of terminal server. That has a feature known as EasyPrint - where the Terminal server is able to have access to the remote client printers. This is discussed in a blog at

 

http://blogs.msdn.com/rds/archive/2009/09/28/using-remote-desktop-easy-print-in-windows-7-and-windows-server-2008-r2.aspx

 

which talks about Windows 7 but we have this working fine with XP too in the 2008R2 version (the standard Server 2008 also worked with an XP client but the printing was distorted, hence the move to R2).

 

 

We initially got this working through an app tunnel and I couldn't get it to work with the ActiveX connection but the error there was that I didn't have the "Redirect local resources (drives, printers, COM ports):" setting enabled in the RDP connection. Once that was enabled then it printed back through the virtual channel absolutely fine - so even with screwdrivers check to make sure that's enabled.

 

 

Also make sure that you have the latest version of the RDP client, the MSTSCAX.DLL. My Win XP version shows version 6.0.6001.18266 and is dated 10th June 2009.

 

 

I hope that may help if all you are trying to do is to get remote printing enabled.

 

 

Best wishes!

 

Kevin

EasyPrint? Really? I tried that when I first deployed Server 2008 and my users still had a lot of complaints about printing (missing printers after login, bad printouts, apps not working right). I've since gone back to ScrewDrivers and don't have to think about printing, again, anymore.

 

 

As for the FirePass issue, if you are having problems you should probably call F5 support before you start changing your environment to fit the device. Or heck, even the ScrewDrivers support team can probably help if they reference using it with f5 in their help doc.

 

Hi Jkae,

 

 

We had a couple of niggles when we first tested on Server 2008. Things like a user printing a doc with a sans-serif font only to find that the print came out in a serif font and looking squished and faint. It only seemed to affect some users and some printers. As 2008R2 had just been released we installed that and all of the problems were resolved.

 

 

Kevin S.

For anybody who stumbles across this thread and is looking to use Tricerat Screwdrivers then I've just been doing an evaluation on the FirePass version 7.0 software and I've noticed that support for the plug-ins is now included. Have a look at Application Access : Terminal Servers : Master Group Settings and there's a new section called "MS Terminal Server Plugins"on that page.

 

 

As recorded above the Windows EasyPrint with a Win2008R2 server is working well for us.

 

 

Kevin S.