LLDP/WS-Discovery on managed switches — enable discovery safely

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Managed switches (UniFi/Omada/Aruba/MikroTik/Cisco small business/Netgear), VLAN design, LLDP/LLDP‑MED, WS‑Discovery/WSDD

Enable LLDP and WS‑Discovery securely — VLAN‑aware discovery, printers/PCs find each other without exposing your LAN

Technician

Hey! We’ll get device discovery working without weakening security. Tell me your switch platform — UniFi, TP‑Link Omada, Aruba Instant On, MikroTik, Netgear, or Cisco small business. We’ll enable LLDP/LLDP‑MED and WS‑Discovery correctly, keep mDNS/SSDP flowing where needed, and apply VLAN isolation + ACLs so discovery stays LAN‑only.

Customer

Windows 11 PCs can’t find printers or scan stations after we moved to separate VLANs. The switches are Omada. We want WS‑Discovery and LLDP turned on but kept secure.

Technician

Got it. After a VLAN redesign, broadcasts and multicasts don’t cross boundaries by default. WS‑Discovery (WSD) uses multicast for Windows printers/scanners, while LLDP is a link‑layer neighbor protocol (useful for inventory, VoIP phones via LLDP‑MED). The goal: allow discovery between specific VLANs (e.g., Users ↔ Printers) using IGMP snooping, mDNS/WSD relays, or ACL‑based helpers — without opening the whole network.

Customer

Where do I switch on LLDP and WS‑Discovery in Omada? And how do I keep it LAN‑only so it never hits the WAN?

Technician

TP‑Link Omada — enable discovery safely:
1) Switches → Profiles → LLDP → set a profile with LLDP = Enabled, advertise system name, VLAN, port description; apply to access ports. For VoIP ports, enable LLDP‑MED with voice VLAN policy.
2) For WS‑Discovery (Windows discovery of printers/scanners): enable IGMP snooping on the users and printers VLANs and add a Multicast Policy to allow 239.255.255.250:3702 between those VLANs only.
3) Create ACLs: allow WSD multicast and the printer TCP ports; deny other inter‑VLAN traffic by default; block multicast to WAN/Uplink so discovery stays internal.
4) Verify with Get‑Printer (PowerShell) and Windows Add Printer; printers should appear without exposing the rest of the network.

Customer

We also have UniFi switches at another site and Macs. Does this change anything for mDNS and WS‑Discovery?

Technician

UniFi + macOS:
• Enable LLDP globally in Network Application.
• For Apple devices and AirPrint, turn on the mDNS Reflector for selected VLANs only (do not reflect to Guest/WAN).
• For Windows discovery, allow WS‑Discovery multicast between Users and Printers VLANs using a multicast exception or firewall rule for 239.255.255.250:3702.
• Keep IGMP snooping enabled to prevent multicast floods; pair with storm control on access ports.

Customer

Is LLDP safe to expose across trunks? Any reason to disable it?

Technician

LLDP best practices: keep LLDP enabled on access ports for inventory and auto‑VLAN (with LLDP‑MED for phones). On WAN/Untrusted ports, disable LLDP/CDP to avoid leaking details (hostname, VLAN, firmware). Across trusted trunks it’s fine — just avoid advertising sensitive port descriptions.

Customer

Can we do discovery across VLANs without opening full traffic? Which ports should I allow?

Technician

Minimal, safe ruleset:
• Multicast: allow 239.255.255.250:3702 UDP (WS‑Discovery) from Users → Printers VLAN only.
• Printer services: allow the vendor ports (e.g., 9100/TCP, 631/IPP, 515/LPD) from Users → Printers.
• Block all other inter‑VLAN traffic by default; deny multicast to WAN.
• Optional: use a WSD relay/forwarder (like wsdd) if your firewall can’t pass the multicast between VLANs.

Customer

What about MikroTik or Aruba Instant On? We have a small branch with those switches.

Technician

MikroTik: enable LLDP on bridge; use IGMP snooping per VLAN and firewall inter‑VLAN rules to allow WSD multicast only.
Aruba Instant On: toggle LLDP on ports, enable Multicast optimization; for cross‑VLAN discovery, use router/firewall policies to pass 3702/UDP between selected VLANs.

Customer

How do we prove it’s working and still secure?

Technician

Validation:
1) On Windows: run Get-Printer / Test-NetConnection -ComputerName printer -Port 631. Devices should appear in Add a printer via WS‑Discovery.
2) On macOS/iOS: verify AirPrint via mDNS if reflected; otherwise IPP by address.
3) On switches: check LLDP neighbors table and confirm VLAN, port, PoE data.
4) Security: confirm your ACL default deny is intact, multicast not forwarded to WAN, and only allowed VLAN pairs can discover.

Customer

Great. We also have VoIP phones failing to pick up the voice VLAN.

Technician

LLDP‑MED voice VLAN: on ports for IP phones, enable LLDP‑MED Network Policy and advertise the voice VLAN, DSCP, and priority. Keep PoE on, and restrict phones with MAC Authentication Bypass (MAB) or sticky MAC if available. This speeds provisioning without broadening access.

Customer

Perfect — discovery works and inter‑VLAN access is still locked down.

Technician

Summary: Safely enable LLDP and WS‑Discovery on managed switches with IGMP snooping, mDNS/WSD relay where needed, and VLAN/ACL controls. You’ll restore Windows printer/scanner discovery and LLDP‑MED voice provisioning without exposing the LAN. Need hands‑on help? Open the chat.

Quick answer: the accepted fix

Accepted fix to enable discovery safely: turn on LLDP/LLDP‑MED on access ports; enable IGMP snooping; allow WS‑Discovery (239.255.255.250:3702) only between Users and Printers VLANs; use mDNS reflector for AirPrint if needed; keep ACL default‑deny and block multicast to WAN.

FAQ

Step‑by‑step (switch platform examples)

1. Enable LLDP (and LLDP‑MED for phones) on access ports; disable on WAN/ISP.
2. Turn on IGMP snooping on Users and Printers VLANs.
3. Create ACLs to allow WS‑Discovery (239.255.255.250:3702 UDP) and printer TCP ports from Users → Printers only.
4. Optionally enable mDNS reflector for AirPrint between selected VLANs.
5. Test discovery from Windows/macOS; verify LLDP neighbors and audit logs.

Step‑by‑step (Windows/macOS client checks)

1. Windows: ensure Function Discovery Provider Host and Function Discovery Resource Publication services are running.
2. macOS/iOS: verify AirPrint/mDNS; if printers are IPP‑only, add by address.
3. Confirm firewall rules allow outbound WSD and IPP from clients in the Users VLAN.

Sources

• WS‑Discovery (spec overview) / Microsoft docs
• LLDP / IEEE 802.1AB references
• UniFi — LLDP, mDNS Reflector, Multicast/IGMP
• TP‑Link Omada — ACL & Multicast
• MikroTik — Bridge IGMP snooping & LLDP

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.