Off-Network Print (ONP): Customer-Hosted Gateway

Last Updated: April 07, 2026

ONP is designed for today's evolving workforce and Zero Trust (ZT) network environments. Keep your printers on secure networks while still allowing all users to print, no matter which network they use. Give printer access to remote employees and contractors without the need for a virtual private network (VPN) or web portal. The steps below guide you through configuring ONP with a customer-hosted external gateway.

Key Points

Review the following key points:

  • This feature requires additional licensing. Contact your Vasion representative for details and pricing.
  • This feature exclusively uses RAW printing on both Windows and macOS platforms.
  • This feature does not support Line Printer Remote (LPR).
  • You can use your own asymmetric key pair for additional print-job encryption security. For more details refer to Asymmetric Key Pair Configuration.

Requirements

Review the following requirements:

  • You need at least one Service Client running the Internal Routing Service (IRS). For more details refer to Service Client Setup.

  • For Windows Service Clients, ensure that Visual C++ Redistributable for Visual Studio 2015 or later is installed.

    You must install both the x86 and x64 redistributable packages. You can download these packages from the Windows Download Center.

  • The Service Client that is running the IRS must be able to reach the printers over the network and requires the latest Client version.
  • You need a Secure Sockets Layer (SSL) certificate from a trusted certificate authority (CA) in PEM and KEY formats for the external gateway.
    • The certificate must be a Base64 Privacy Enhanced Mail (PEM) full chain unencrypted file.
    • The key must be in unencrypted Public Key Cryptography Standards (PKCS) #8 format, and it must correspond to the PEM certificate.
    • The certificate must match the external Domain Name System (DNS) or IP address of the external gateway.

  • Printers using ONP cannot have the SNMP Status option selected on the printer's Port tab.

    The SNMP Status option is different from SNMP Status Monitoring.

  • For redundancy purposes, you can add multiple Service Clients.

External Gateways

Review the following requirement:

  • The Vasion Print external gateways are regionally based. Select the appropriate gateway for your region. Self-hosted configurations should use the external gateway that you configured. Failover options include the following:

    • PrinterLogic U.S.-NOW Gateway: printercloudnow.

      Note that the PrinterLogic U.S.-NOW Gateway is only for Vasion Now instances. U.S.-based Scheduled Release SaaS (SRS) customers must use the PrinterLogic U.S. Gateway.

    • PrinterLogic U.S. Gateway: printercloud.
    • PrinterLogic EMEA Gateway: printercloud5.
    • PrinterLogic ASIAPAC Gateway: printercloud10.
    • PrinterLogic CANADA Gateway: printercloud15.
    • PrinterLogic SE-ASIAPAC Gateway (Singapore): Singapore printercloud20.
    • Customer-Hosted External Gateway.

Port Information

ONP printing occurs over TCP port 443 from the device to the external gateway and from the external gateway to the IRS. Review the following requirements:

  • The Service Client for the customer-hosted external gateway requires a public-facing IP address that is reachable over TCP port 443.
    • The external gateway device needs to resolve the Domain Name System (DNS) name for the gateway to its own internal IP address. The best practice is to use a routable DNS name for the external IP address.

Routing from the IRS to the printer occurs over TCP port 9100 or port 631 for IPPS.

Process Overview

You perform these high-level procedures:

  1. Turn On ONP.

  2. Turn On the IRS.

  3. Configure the External Gateway.

  4. Add an External Gateway & IRS Service.

1. Turn On ONP

The steps below guide you through configuring ONP with a customer-hosted external gateway:

  1. In the Admin Console, go to Tools then Settings then General, and scroll down to the Off-Network Printing section.
  2. Select the checkbox for Allow Off-Network Printing.
  3. You can select the following optional settings:
    1. Use customer provided public/private keypair for print job encryption: For more details refer to Asymmetric Key Pair Configuration.
    2. Allow Cloud Printing: Cloud Print is a separate configuration. For more details refer to Off-Network Cloud Print (ONCP).
  4. Select Save in the upper-right corner.

Admin Console showing General settings and Off-Network Printing section.

Off-Network Priority

Off-Network Priority controls where the Vasion Print Client tries to send the job first, either directly to the printer or to the ONCP or ONP service.

Off-Network Only
The Client sends the print job using only the ONCP or ONP service and does not try to send the job directly to the printer, which is direct IP printing.
Direct IP Primary
The Client sends the print job directly to the printer, which is direct IP printing. If unsuccessful, the Client sends the print job using the ONCP or ONP service.
Off-Network Primary
The Client sends the print job using the ONP service. If unsuccessful, the Client sends the print job directly to the printer, which is direct IP printing.

ONCP does not support the Off-Network Primary option.

Turn On as Default

The following steps guide you through configuring ONP as the default for all printers. Turning on the global settings makes all printers off-network printers. This action forces all print jobs to follow the flow of ONP, regardless of whether you are on the network. If you want to turn on ONP for specific printers, refer to the "Turn On for Specific Printers" section further below.

Follow these steps:

  1. From the Default Global Setting menu, select Off-Network.
  2. In the Off-Network Priority section, select the default print priority:
    1. Off-Network Only.
    2. Direct IP Primary.

    3. Off-Network Primary.

      The Off-Network Priority section applies to only computers and not to mobile devices using ONCP or ONP.

  3. Select Save.

Admin Console showing General settings, Default Global Setting, and Off-Network Priority section.

Turn On for Specific Printers

Follow these steps:

  1. From the Default Global Setting menu, select Disabled.
  2. In the Off-Network Priority section, select the default print priority:
    1. Off-Network Only.
    2. Direct IP Primary.

    3. Off-Network Primary.

      The Off-Network Priority section applies to only computers and not to mobile devices using ONCP or ONP.

  3. Select Save.

Admin Console showing General settings, Default Global Setting, and Off-Network Priority section.

For the printer-specific configuration, complete the following steps on each printer object to turn on ONP:

  1. Go to the printer object's Off-Network tab.
  2. For the Off-Network Enabling setting, select Use printer-specific Off-Network Printing setting.
  3. From the Select off-network printing method dropdown menu, select Off-Network.

  4. Use the default off-network priority option, or select the printer-specific option, and select from the following:

    1. Off-Network Only.
    2. Direct IP Primary.

    3. Off-Network Primary.

      The Off-Network Priority section applies to only computers and not to mobile devices using ONCP or ONP.

  5. Select Save.
  6. Repeat these steps for any other printer objects.

Admin Console showing printer object's Off-Network tab.

2. Turn On the IRS

The IRS Service Client is a designated device on the printer network that monitors the external gateway, immediately retrieves print jobs, and routes them to the correct printer. Follow these steps to turn on the IRS:

  1. Go to the Service Client object in the tree structure.
  2. Select the Internal Routing tab.

  3. Select Enable Internal Routing Service.

    Admin Console showing Enable Internal Routing Service option.

  4. Select Save.
  5. On the device designated as the IRS Service Client, use the Vasion icon in the system tray or the Start menu to refresh configurations.
  6. Open the Task Manager, and select the Details tab.
  7. Search for "printer" to locate the Client services.
  8. Confirm that the following services are running:
    1. Client services, which include PrinterInstallerClient.exe, PrinterInstallerClientInterface.exe, and PrinterInstallerClientLauncher.exe..
    2. PrinterLogicServiceManager.exe.

    3. PrinterLogicServiceInternalRouter.exe.

      Other active services on the Service Client also appear.

Task Manager showing Service Client services running.

3. Configure the External Gateway

A customer-hosted external gateway requires an SSL certificate and key. You can store the certificate and key on the Service Client and add the file path to the configuration page, or you can copy them and paste them in the fields in the Admin Console, which stores them in your instance's database. You need the following:

  • An SSL certificate from a trusted CA in PEM and KEY formats for the external gateway.
    • The certificate must be a Base64 PEM full chain unencrypted file.
    • The key must be in unencrypted PKCS #8 format, and it must correspond to the PEM certificate.
    • The certificate must match the external DNS or IP address of the external gateway.

The following steps guide you through both methods of applying the SSL certificate and key.

Store on the Service Client

Follow these steps:

  1. Place the SSL certificate and key on the device designated to host the Service Client external gateway.
  2. Copy or note the path to the files.
  3. In the Admin Console, go to the Service Client object, and select the External Gateway tab.
  4. Select the checkbox for Enable External Gateway Service.
  5. In the External Gateway HTTPS certificate information section, select Path to Certificate.
  6. Enter the path to the PEM certificate file in the Path to certificate file field. For example, C:\Certificates\certificate.pem.
  7. Enter the path to the KEY file in the Path to key file field.

  8. Enter the external host address for the Service Client in the External Host Address field.

    Admin Console showing Service Client's External Gateway tab and Connection Details section.

  9. Adjust the External Port field if needed.
  10. Select Save.

Admin Console showing Service Client's External Gateway tab.

Store in Database

Follow these steps:

  1. Open the SSL certificate body and key files.
  2. In the Admin Console, go to the Service Client object, and select the External Gateway tab.
  3. Select the checkbox for Enable External Gateway Service.
  4. In the External Gateway HTTPS certificate information section, select Enter Certificate.
  5. (Optional) Select Hide Certificate Text. After you save the certificate and key, the content no longer appears.
  6. Copy the certificate and key files, and paste them in their respective fields.

  7. Enter the external host address for the Service Client in the External Host Address field.

    Admin Console showing Service Client's External Gateway tab and Connection Details section.

  8. Adjust the External Port field if needed.
  9. Select Save.

Admin Console showing Service Client's External Gateway tab and Certificate Details section.

4. Add an External Gateway & IRS Service

The IRS Service Client provides high availability and built-in redundancy at the root, folder, and printer levels. Configuring all levels is optional but recommended during setup. The IRS Service Client must be on the same network and able to reach assigned printers. In environments with printers on multiple networks, the IRS Service Client needs to reach printers in each network.

For most environments, it is best to configure the assignment at the folder or printer level first before configuring at the root level. If all printers use the same assignment, add it to the root level. Folders and printers inherit higher-level assignments, but lower-level ones take priority.

If a printer or folder has a root assignment and a folder or printer assignment, the service prioritizes the folder or printer assignment and uses the root assignment as a backup. The priority order appears in the folder's Services tab and on the printer's Off-Network tab.

Configure the settings based on your organization's needs.

Folder Level

Do the following to add an external gateway and IRS assignment at the folder level:

  1. Select the folder in the tree structure.
  2. Select the Services tab.
  3. Select the Add button.
  4. In the Add Services modal, select your customer-hosted external gateway or the regional PrinterLogic gateway for a hybrid configuration.
  5. Select the internal routing Service Client.
  6. Select OK.
  7. Use the Test button in the Service Status column to confirm connectivity.

Lower-level folders and printers inherit the external gateway and IRS assignment, including any set at the root level or a higher-level folder.

Admin Console showing folder's Services tab and external gateway and internal routing Service Client added.

Printer Level

Do the following to add an external gateway and IRS assignment at the printer level:

  1. Select the printer object in the tree structure.
  2. Select the Off-Network tab.
  3. Select the Add button.
  4. In the Add Services modal, select your customer-hosted external gateway or the regional PrinterLogic gateway for a hybrid configuration.
  5. Select the internal routing Service Client.
  6. Select OK.
  7. Use the Test button in the Service Status column to confirm connectivity.

These steps set the external gateway and IRS assignment for the printer object, including any assignments set at the root level or a higher-level folder.

Admin Console showing printer object's Off-Network tab and external gateways and internal routing Service Client added.

Root Level

Do the following to add an external gateway and IRS assignment at the root level:

  1. Select the company icon Company icon. at the top of the tree structure.
  2. Select the Services tab.
  3. Select the Add button.
  4. In the Add Services modal, select your customer-hosted external gateway or the regional PrinterLogic gateway for a hybrid configuration.
  5. Select the internal routing Service Client.
  6. Select OK.
  7. Use the Test button in the Service Status column to confirm connectivity.

Lower-level folders and printers inherit the external gateway and IRS assignment.

Admin Console showing company's Services tab and external gateway and internal routing Service Client added.