Setting up Sonicwall for small medical office
hello everyone! I was hoping to get some help with installing a Sonicwall Tz280w for a small medical office. I'll provide some context of the environment:
- I work for an MSP and the client (medical office) requested to purchase a firewall
- Their environment is completely wireless with the exception of their Copier (they have workstations and ring cams)
- they have spectrum business internet and have a flat network (192.168.x.x)
- Geek Squad help them get set up years and years ago before they reached out to us so this a new client
The problem:
I never really had set up a firewall for anyone before; I came from environments that had everything preconfigured and installed working as a in-house IT guy or team. This is my first MSP job after I took a break to start a small business for a year.
I was tasked to set up the firewall and what I did was register and configure the firewall at the office. I set up the object profiles, created the SSID for the firewall to broadcast, and created vlans for the cams, guest network, and the staff wifi. Then once configured, I took it to the office and plugged it in and plugged a cable to spectrum router to the firewall and got all the devices to connect to the firewall. They had connectivity and I checked to make sure everyone could print and the cameras were visible in their segregated VLAN. gave the logins to the office manager and thought it was good to go.
We got a call Monday afternoon saying they couldnt scan to their folder on their desktops and needed support so i was sent over. I fogotten the copiers were on the spectrum routers IP and not the firewall but i thought it was weird that the printing still work so i assumed they could still handle everything. I attempted to change the IP of the copier but then no one could print or scan. I also plugged the copier to the firewall thinking this would do something but nothing happened. I checked the address book of the printer and turns out they have it to where the path is just going to a folder name and the direction is just the PC name. I think their printing solution company set that up so i thought maybe there is some rule preventing the lan to talk to the vlan but even changing that rule, the printer couldnt scan to folder to the IP of the firewall/router everyone was now set up in.
The Setup:
- Firewall: SonicWall TZ 280W
- LAN (Wired):
192.168.0.x(Canon MFP is here at192.168.0.199) - WLAN (Wi-Fi):
192.168.20.x(Windows 11 Target PC is here at192.168.20.67)
The Issue:
The Canon MFP fails to Scan-to-Folder (SMB) to the Windows 11 PC on the Wi-Fi. The job hangs on "Resending..." and eventually spits out a "TX Incomplete" error.
To isolate the printer, I tested basic PC-to-PC file sharing across the subnets (from a wired PC at 192.168.0.5 trying to access \\192.168.20.67). It gets instantly blocked with a "Network path not found" error.
However, pings (ICMP) between the two subnets work perfectly.
what i tried:
- SonicWall Access Rules: Created explicit ALLOW rules for both LAN ➔ WLAN and WLAN ➔ LAN (Source: Any, Destination: Any, Service: Any).
- Security Services: Turned OFF Gateway AV, Anti-Spyware, and IPS (DPI) on these specific access rules to prevent packet inspection drops.
- WLAN Zone: Verified "Enable Guest Services" is strictly disabled on the WLAN zone.
- Windows Firewall: Turned completely OFF on the target PC across all three profiles (Domain, Private, and Public).
- Third-Party AV: Verified no third-party AV or endpoint protection (McAfee, SentinelOne, etc.) is hijacking the Windows firewall.
- Windows Permissions: Share permissions set to Everyone with Full Control. Verified the SmbScanUser account has a password.
- Windows SMB Config: Disabled SMB Signing via Group Policy on the target PC just in case the firewall was mangling the modern cryptographic handshake.
My thoughts are what if I either change the IP of the firewall to the 192.168.0.x range so they are all in the same IP range. Not sure if this would fix it. OR if i should just keep the devices on the spectrum router and try to set up the firewall to just monitor and NOT act like a router.
Any and all help would be super helpful, thanks everyone!