User printing onsite — multi-site with a WAN connection

This page covers how PaperCut Hive and Pocket provide serverless cloud print management for organizations operating across multiple locations with full WAN interconnectivity. It also outlines the end-to-end technical workflows for job submission and release in two primary scenarios:

• when cross-site communications between computers and printers are fully allowed
• when cross-site communications are allowed but there is a need to minimize print related traffic over the WAN connection.

Examples of multi-site environments with full WAN interconnectivity

This environment is typical in larger businesses with interconnectivity between multiple offices. Each office can connect to and use resources from all offices. For example, it might consist of a central head office and smaller to larger offices around the state, country, or globe. All offices have constant direct connectivity back to the head office via a VPN connection (hub and spoke).

Another setup involves each site having a constant direct connection with all others. For example, a head office in Melbourne has direct connectivity with offices in Portland, Oregon, and Bracknell, England. There is also a direct connection between Portland and Bracknell (full interconnectivity).

These business environments often use a mixture of SaaS solutions and services hosted on internal servers, migrating services to SaaS solutions when they make the most sense for security, flexibility, and cost.

Typical customers include:

• universities
• medium to large businesses
• healthcare organizations.

Recommended solutions for printing in multi-site environments with a WAN connection

There are a couple of common methods to set up printing in these environments. The right method depends on how you want print traffic to flow across the network.

Method 1: Allow anyone to print and release to any printer

If you want users to print and release to any printer in the organization, allow edge nodes to communicate across all sites and subnets. Ensure you open the required communication ports between the edge nodes across your WAN connections, for example, your VPN tunnels. This port configuration allows the edge nodes to transfer print jobs across the WAN to your other sites. A user can submit a job from anywhere in the network and release the job to any printer in the network.

Method 2: Minimize VPN traffic

Many organizations run VPN connectivity for critical internal systems, such as VOIP traffic, server redundancy, and database access. Some organizations prefer to keep print traffic local to each site, reserving VPN bandwidth for those critical systems. Other organizations require that print traffic never crosses the WAN between sites. Restricting print traffic between sites typically does not impact users as in most cases users will print to printers located at the site they occupy.

To limit printing bandwidth across your VPN connection, configure PaperCut Hive and Pocket to keep print traffic within each site’s local network. Consider the following configuration options to achieve this.

Job storage location and replication

When a user submits a print job, the system stores it on an initial Windows or macOS device (usually the device the user prints from). By default, the system then securely replicates two encrypted copies to other Windows or macOS devices in the environment. These replicated copies provide redundancy if the device holding the original copy is unavailable when the user releases the print job.

If every edge node can communicate across the WAN, print jobs might occasionally replicate to edge nodes at other sites. You can configure PaperCut Hive and Pocket to prefer replicating jobs to other edge nodes on the same network. These edge nodes are within the same subnet as the device of origin and connect to the same network gateway. For instructions on adjusting the Job storage location, refer to Advanced configurations.

Print Delivery Profiles

When a user releases a print job, PaperCut Pocket and Hive select an edge node to retrieve a stored copy of the job and submit it to the printer. If every edge node can communicate across the WAN, the system might select an edge node at one site to submit the job to a printer at another site.

You can apply Print Delivery Profiles to dictate which edge nodes deliver jobs to specific printers. These profiles can specify individually selected edge nodes, edge nodes presently connected in certain network locations, or both.

For each site, create a Print Delivery Profile and apply it to all printers at the location. This profile dictates that only edge nodes at the same location deliver the print jobs, which prevents released jobs from relaying across the VPN.

Pull Delivery

For supported printer brands integrated with the Full Embedded App, you can enable the Cloud Node and configure Pull Delivery as the primary delivery method for print jobs. The printer can then download jobs from the Cloud Node, and the job prints directly. This avoids scenarios where the printing edge node retrieves a print job from an edge node at another site, or prints a job to a printer at another site.

If public internet bandwidth utilization is not a concern, enable Pull Delivery to help minimize cross-site traffic between edge nodes and from edge nodes to printers.

Network controls

You can use firewalls and ACLs to restrict edge node communications between sites while still allowing edge node connectivity between subnets at each local site. Combined with Print Delivery Profiles, this enforces that print traffic does not traverse the WAN between sites. For information on the relevant ports, refer to System requirements.

If users will need to print at one site and release the job at another site, enable the Cloud Node.

Cloud Node

If you enable the Cloud Node, the system replicates all print jobs to PaperCut Cloud Services in addition to other edge nodes on-premises. An edge node can download the replicated copy from the Cloud Node to deliver it to the printer. Enabling the Cloud Node allows users to print at one site and release at another site, even if firewall or ACL controls block edge node communications between sites.

In these environments, if a user submits a print job at one site and releases it at another, the Cloud Node accepts the print job over the public internet from the site of origin. An edge node at the destination site retrieves the job over the public internet, bypassing the WAN interconnectivity. Printers that support Pull Delivery can also retrieve and print jobs directly from the Cloud Node.

If public internet bandwidth and site-to-site bandwidth are concerns, leave the Cloud Node disabled. This prevents job replication and retrieval over the public internet. However, if you disable the Cloud Node:

• users cannot print from remote network locations without a VPN connection and release to a printer on the main network
• printing from iOS devices requires you to promote one or more edge nodes to Super Node status.

How printing with PaperCut Hive and Pocket works

For detailed information on print job submission and release with multiple WAN interconnected sites, including ports and communications, refer to Job submission process and Find-Me job release process below.

Pros and cons PaperCut Hive and Pocket in multiple site environments with full WAN interconnectivity

Network diagrams

Method 1: Allow anyone to print and release to any printer

Method 2: Minimize VPN traffic

Ports

If you run the Full Embedded Printer App, some MFD platforms need additional ports opened between edge nodes and the MFD to facilitate certain device tasks. For the complete list of ports, refer to System requirements.

Job submission process

The following sections explain the process when a user prints in an environment with multiple sites interconnected by WAN.

Process for Find-Me printing from Windows, macOS, ChromeOS, and Android

Process for Find-Me printing from iOS

Process for Direct printing from Windows and macOS

Find-Me job release process

When a user releases a Find-Me print job, they can use two methods:

• MFD release
• Mobile device release

After the user releases their job, how you configure PaperCut Hive or Pocket determines the job’s route to the destination printer.

To have the printer retrieve and print jobs directly from PaperCut Cloud Services, configure Pull Delivery for a supported destination printer and enable the Cloud Node. The printer will retrieve and print jobs directly from the Cloud Node.

If Pull Delivery is not configured, at least one edge node on the network needs access to the printer to route and print the job. For more information, refer to Pull Delivery in PaperCut Hive.

When Pull Delivery cannot be used, PaperCut Hive or Pocket selects an edge node to relay the job to the destination printer. By default, the Autopilot algorithm attempts to select the most reliable client device to deliver the print job, which then relays the job.

Alternatively, if you want to control the route that remote jobs take through the network, apply a Print Delivery Profile to a printer to specify which clients can be selected to deliver print jobs to that printer. For more information, refer to Autopilot - Overview and About Print Delivery Profiles.

Releasing jobs at the MFD

Releasing jobs from a mobile device

Releasing jobs from a mobile device using Print Offline

If the link to PaperCut Cloud Services is unavailable (for example, an Internet Service Provider outage), users can still release print jobs using their mobile device if:

• the Print Offline feature is enabled
• the mobile device is connected to Wi-Fi on the organization’s main network
• the mobile device can communicate with nearby edge nodes
• a nearby edge node stores a replicated copy of the job.

For more information, refer to About printing offline.

​​​​​​