Off-Network Printing

Last Updated: April 07, 2026

The Off-Network Cloud Print (ONCP) and Off-Network Print (ONP) features solve two printing challenges:

  • Managing print in a Zero Trust Architecture (ZTA).
  • Providing simple and secure access to users without a virtual private network (VPN) or web portal.

Organizations can create an isolated, secure printer network that is separate from the main network used by employees, contractors, or guests. This separation adds an extra layer of security and keeps the printers in a controlled network environment. ONCP and ONP bridge the gap between networks, allowing users on the main network to print without compromising the security of the printer network.

How Off-Network Printing Works

ONCP

ONCP uses Amazon Web Services (AWS)-hosted regional external gateways and Vasion's ONCP app, which is installed on the printer, to reduce infrastructure costs and help users on other networks print. When a user on another network sends a job to an ONCP-enabled printer, the encrypted job goes to the external gateway. The ONCP app monitors the gateway, immediately retrieves the print job, and releases it at the printer.

Not all printer manufacturers support the ONCP app, so we provide an alternative method using an internal routing service (IRS). The IRS Service Client is a designated device on the printer network that acts similarly to the ONCP app. This Service Client monitors the external gateway, immediately retrieves print jobs, and routes them to the correct printer.

Diagram showing network traffic flow for ONCP.

ONP

ONP differs slightly from ONCP and allows for more redundancy in the environment. However ONP does not use the ONCP app and requires more infrastructure. ONP supports customer-hosted gateways.

Instead of an app, ONP relies on IRS Service Clients in the print network to route jobs from the gateway to the printer. Multiple external gateways and IRS Service Clients allow for failover in high-availability environments.

Diagram showing network traffic flow for ONP.

Key Details

ONCP and ONP have two main components: The external gateway and the IRS, which have multiple configuration options to fit your organization's needs. Review the following key details:

  • The external gateway receives incoming print jobs from remote devices and acts as the gateway to the secure network.
  • The IRS monitors the external gateway for print jobs. When the external gateway receives a print job, the IRS immediately downloads the print job into the organization's secure printer network and delivers the job directly to the destination printer.
  • Configuring multiple IRS Service Clients creates a failover configuration in case an issue occurs with one IRS. Priority depends on the assignment level. Printer-level assignments override folder- and root-level assignments, and folder-level assignments override root-level assignments.
  • ONCP and ONP require additional licensing. Contact your Vasion representative for details.
  • ONCP and ONP exclusively use RAW printing on the Windows platform. ONP also uses RAW printing on macOS platforms.
  • Line Printer Remote (LPR) is not currently supported.

Differences

Review the following differences:

  • ONCP currently supports Windows, macOS, and mobile for iOS and Android devices.
  • Customer-hosted external gateways are configurable with only ONP.
  • External gateways assigned at the root, folder, or printer levels apply to only ONP. ONCP automatically assigns external gateways based on the instance's region.
  • ONCP has two configuration options for the IRS: 
    • Install the ONCP app on the printer object. The app functions as the IRS and removes the need for an IRS Service Client.

    • Create an IRS Service Client to route print jobs, which removes the need for the ONCP app.

      Not all printer manufacturers support the ONCP app. Unsupported printers require the ONCP configuration using the IRS Service Client.

Off-Network Priority

Off-Network Priority controls where the Virtual Appliance Client tries to send the job first, either directly to the printer or to the ONCP or ONP service.

Off-Network Only
The Client sends the print job using only the ONCP or ONP service and does not try to send the job directly to the printer, which is direct IP printing.
Direct IP Primary
The Client sends the print job directly to the printer, which is direct IP printing. If unsuccessful, the Client sends the print job using the ONCP or ONP service.
Off-Network Primary
The Client sends the print job using the ONP service. If unsuccessful, the Client sends the print job directly to the printer, which is direct IP printing.

ONCP does not support the Off-Network Primary option.