It seems like a massive oversight to implement segmentation like that and yet still allow the fax printer SNMP and telnet/SSH access to the firewall.

In environments I've seen, the network management network is the thing most likely to be isolated first.