Xerox 3550 Ports 161, 162, Snmp, Port 389, Ldap, Port 396, Netware, Port 427, SLP, Port 443, SSL

XEROX WorkCentre 3550 Information Assurance Disclosure Paper

2.8.2.7.Ports 161, 162, SNMP

These ports support the SNMPv1, SNMPv2c, and SNMPv3 protocols. Please note that SNMP v1 does not have any password or community string control. SNMPv2 relies on a community string to keep unwanted people from changing values or browsing parts of the MIB. This community string is transmitted on the network in clear text so anyone sniffing the network can see the password. Xerox strongly recommends that the customer change the community string upon product installation. SNMP is configurable, and may be explicitly enabled or disabled in the Properties tab of the device’s web pages.

SNMP traffic may be secured if an IPSec tunnel has been established between the agent (the device) and the manager (i.e. the user’s PC).

The device supports SNMPv3, which is an encrypted version of the SNMP protocol that uses a shared secret. Secure Sockets Layer must be enabled before configuring the shared secret needed for SNMPv3.

2.8.2.8.Port 389, LDAP

This is the standard LDAP port used for address book queries in the Scan to Email feature.

2.8.2.9.Port 396, Netware

This configurable port is used when Novell Netware is enabled to run over IP.

2.8.2.10. Port 427, SLP

When activated, this port is used for service discovery and advertisement. The device will advertise itself as a printer and also listen for SLP queries using this port. It is not configurable. This port is explicitly enabled / disabled in the Properties tab of the device’s web pages.

2.8.2.11. Port 443, SSL

This is the default port for Secure Sockets Layer communication. This port can be configured via the device’s web pages. SSL must be enabled before setting up either SNMPv3 or IPSec. SSL must also be enabled in order to use any of the Web Services (Automatic Meter Reads, or Network Scanning Validation Service).

SSL should be enabled so that the device can be securely administered from the web UI. When scanning, SSL can be used to secure the filing channel to a remote repository.

SSL uses X.509 certificates to establish trust between two ends of a communication channel. When storing scanned images to a remote repository using an https: connection, the device must verify the certificate provided by the remote repository. A Trusted Certificate Authority certificate should be uploaded to the device in this case.

To securely administer the device, the user’s browser must be able to verify the certificate supplied by the device. A certificate signed by a well-known Certificate Authority (CA) can be downloaded to the device, or the device can generate a self-signed certificate. In the first instance, the device creates a Certificate Signing Request (CSR) that can be downloaded and forwarded to the well-known CA for signing. The signed device certificate is then uploaded to the device. Alternatively, the device will generate a self-signed certificate. In this case, the generic Xerox root CA certificate must be downloaded from the device and installed in the certificate store of the user’s browser.

The device supports only server authentication.

2.8.2.12. Port 515, LPR

This is the standard LPR printing port, which only supports IP printing. It is a configurable port, and may be explicitly enabled or disabled in the Properties tab of the device’s web pages.

2.8.2.13. Port 546, DHCPv6

This port is used only when performing DHCPv6, and is not open all of the time. To permanently close this port, DHCPv6 must be explicitly disabled. This is done via the TCP/IP page in the Properties tab on the WebUI.

2.8.2.14. Port 631, IPP

This port supports the Internet Printing Protocol. It is not configurable. This is disabled when the http server is disabled.

	19
Ver. 1.3, March 2011	Page 19 of 32