Oce colorwave 300 ошибки

Copyright

© 2014, Océ

All rights reserved. No part of this work may be reproduced, copied, adapted, or transmitted in any form or by any means without written permission from Océ.

Océ makes no representation or warranties with respect to the contents hereof and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose.

Further, Océ reserves the right to revise this publication and to make changes from time to time in the content hereof without obligation to notify any person of such revision or changes.

Contents

Contents

Chapter 2

Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300

The Océ Security policy

Definition

At Océ, security is an integral part of system development, and the company is taking a proactive approach to the improvement of security-related issues. Océ is working to address security requirements across all of its digital document systems.

For its printing systems connected to the network, Océ strives to ensure the:

—Security of the system on the network

—Security of the data sent to the printers, with a focus on protecting sensitive documents from being captured by un-authorised persons

—Security of the configuration and data on the controller

NOTE

See the Table of the security features on page 13 to get an overview of the security features available per Océ system.

System security and security on the network

Faced with system vulnerabilities, viruses, worms and in order to maximise the protection of the Océ print systems from hackers and networking attacks, Océ has reinforced the security of the Océ systems by:

•Introducing the Océ Security levels to offer network security protection against virus / worm attacks or system vulnerabilities (on Windows Operating Systems).

Once the Security Interface is activated, you can define the level of security according to your system needs. Notice that the higher level of security you set, the fewer printing and scanning functionalities you get.

•Implementing network protocols protection features (by use of the Océ Security levels filtering or by configuring each network protocol for firewall filtering)

•Protecting the system roles and passwords. The main network and system settings are protected against change. Only authorised users can configure or change these settings

•Regularly checking the relevance of Microsoft flaws and delivering security patches whenever it is necessary.

•Providing OS and software protection mechanism. The internal system software is protected against alteration

•Make the USB connection secure (on systems with USB slot)

•Restricting the access to the printer to allowed stations only

•Allowing the installation of an Antivirus software on the Océ system controller

•Being compliant with IPv6 and then benefiting from IPv6 secured assets

NOTE

The availability of the security features depends on the products. See the Overview of the security features available per Océ System on page 13.

Data security on the network

To ensure the security of the print data sent on the network, Océ has implemented:

•The HTTPS (HTTP over SSL) protocol to encrypt the configuration management data, submitted print data and saved scan data:

Find all information about Use the Océ self-signed certificate with Internet Explorer on page 56.

The Océ Security policy

•The e-shredding feature to overwrite any user data (print/copy/scan) when it is deleted from the system.

This feature prevents the recovery of any deleted user data.

•The IPsec configuration, that provides authentication, data confidentiality and integrity in the network communication between devices.

A strong mechanism of encryption guarantees the confidentiality of the user print and scan data on the network.

•The Smart Inbox and Job protection by:

—Limiting and restricting the access to the print and scan job data with the Smart Inbox management capability

—Managing the visibility of jobs and their availability through job submission tools with the job management settings

Downloads and support for your product

Downloads

User guides, printer drivers and other resources can change without prior notice. To stay up-to- date, you are advised to download the latest resources from:

«http://downloads.oce.com»

Before you use your product, you must always download the latest safety information for your product: make sure that you read and understand all safety information in the manual entitled ‘Safety Guide‘ .

Support

For support information please contact your Canon local representative.

Find your local contact for support from:

«http://www.canon.com/support/»

Overview of the security features available per Océ System

Overview of the security features available per Océ System

Security features in the Océ PlotWave and Océ ColorWave 300 systems

Overview of the security features available per Océ System

Security features in the Océ ColorWave systems (except Océ ColorWave 300)

Overview of the security features available per Océ System

Security on Océ PlotWave 300/350, PlotWave 900 R1.x and ColorWave 300

Security on Océ PlotWave 300/350, PlotWave 900 R1.x and ColorWave 300

Overview

Security overview for the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and the Océ ColorWave 300 systems

Introduction

The Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 are equipped with the following security features:

Security overview

* Except on Océ PlotWave 900 R1.2.

System and Network security

System and Network security

Ports — Protocols

Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems

Printing applications: security levels, ports and protocols used by the Océ systems

Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems

Notes:

•* Levels: N: Normal — M: Medium — H: High

•(**) Océ back-channel is an Océ proprietary protocol used to retrieve information from the printer (status, media loaded…) and to display it in the application or driver.

•(1) LPR printing with back-channel and advanced accounting

•(2) LPR printing. No back-channel. No advanced accounting

•(3) Océ Publisher Mobile v 2.2 and later for Android, and for Océ Publisher Mobile v 2.3 and later for iOS

•(4) Only for Océ Publisher Mobile v 2.0 to v 2.2 for iOS

•(5) FTP active mode only

•(6) Data channel for FTP passive mode

Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems

Scanning / copying applications: security levels, ports and protocols used by the Océ systems

Notes:

•* Levels: N: Normal — M: Medium — H: High

•(1) FTP passive mode only: the FTP server on the remote workstation must support FTP passive mode

•(2) FTP active mode only

•(3) Data channel for FTP passive mode

Control management: security levels, ports and protocols used by the Océ systems

Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems

Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems

Notes:

•* Levels: N: Normal — M: Medium — H: High

•(**) The name resolution is mainly used to determine the IP address of the scan destination during Scan fo File operation

•(1) FTP active mode only

•(2) Data channel for FTP passive mode

•(3) TCP/IP port 443 must be opened and must allow response back on the IT infrastructure firewall.

Security Patches

Security Patches

Install the Océ Remote patch (on Océ PlotWave 300/350, PlotWave 900 R1.x and Océ ColorWave 300)

Introduction

You can install the Océ Remote patches (Security patches) in the following versions of the systems:

•Océ PlotWave 300 1.2.1 and higher

•Océ PlotWave 350 1.0 and higher

•Océ PlotWave 900 1.x

•Océ ColorWave 300 1.2.1 and higher

Before you begin

Find the Océ Security patch from the Océ Downloads website on http://downloads.oce.com:

Open the product page and go to the Security tab to download the available security patches.

Install the Océ Remote patch

Procedure

1.Open the Océ Express Webtools

2.Open the ‘Support’ tab

3.Select ‘Update’

The Authentication window opens.

Install the Océ Remote patch (on Océ PlotWave 300/350, PlotWave 900 R1.x and Océ ColorWave 300)

4.Log in as the System administrator or Power user

All the patches successfully applied (when any) are displayed

5.Click on the ‘Update’ icon (top right corner) to open the wizard

6.Click OK

7. Browse to the Océ Remote patch and click OK to install it

8.Click OK to confirm the update

The system restarts to apply the patch.

Security levels

Security levels

Security levels presentation

Introduction

Océ defined 3 levels of security according to the customer needs. The presentation below can help you to select the most suitable level.

High security level

The High level is the most secure mode for printing and scanning.

The compliant applications are based on:

•the LPR protocol for printing

•the HTTPS protocol (Océ PlotWave 900 only) for printing

•the FTP protocol for scanning.

Target:

•This level provides you the most secure mode while using the basic feature for printing and scanning. Only some Océ applications are available. See the security levels supported per application/functionality on page 19.

•This security level may also be used when you want to be protected whenever a vulnerability has been discovered and the corresponding patch cannot be yet installed. As soon as the patch can be installed, you can go back to the original security level.

Medium security level

The Medium level is compliant with all the Océ applications available for printing and scanning which do not present a high risk (as reported by most popular network scanners).

Target:

This level is recommended if you need to be secured while you want to use the Océ applications for printing and/or scanning (you can use the system including more functions than with the High security level).

Normal security level

This mode offers all the functionalities.

Target:

•You can select this level if you want to use some features not covered by MEDIUM security level.

•This level is more dedicated for small network infrastructure where security is less required versus features.

Set the security level in Océ PlotWave 300, Océ PlotWave 350 and Océ ColorWave 300

Introduction

The [Security] wizard on the printer user panel gives the option to check or change the security level of the system.

Protect the security level by a password

Before you begin

The System Administrator or a Power User can protect the security settings with a password.

When the protection is activated, you must type the password in the printer user panel before you can change the security level.

Procedure

1.From the [HOME] screen select the [System] tab.

2.Select the [Setup] tab.

3.Use the scroll wheel to go to the [Security]([Configure settings]) wizard.

4.Open this section with the confirmation button.

5.The screen displays the security level and the active network access options:

6.Two options are possible:

•Press the [Back] key in case you only want to check the security settings.

•Press the [Next >] key in case you want to adapt the security level.

Enter the password if requested and follow the wizard to adapt the security level.

Protect the security level by a password

Procedure

1.Open the Océ Express Webtools in a web browser (http://Printer IP address or hostname)

2.In the ‘Preferences’ tab, select ‘System settings’

3.In the ‘Printer Properties’, goes to ‘Password to change security level’

4.Click on the value to edit it

5.Log in as the System Administrator or as a Power User

6.Select ‘New’

7.Type and re-type a numeric password

8.Confirm to activate the password.

Result

You must type the password in the printer user panel when you want change the security level.

Set the security level in Océ PlotWave 900 R1.1 and higher R1.x versions

Introduction

The security user interface is available through the Océ Express WebTools application.

NOTE

You need to be logged on as the System Administrator to access the security level interface and change the security levels.

Procedure

1.Open the Océ Express Webtools in a web browser (http://Printer IP address or hostname)

2.On the [Configuration] tab, select [Connectivity]

3.Go to the Security section

4.Click on ‘Edit’ or double click on the value to open the [Security level] window

5.Set the security level and click ‘OK’

6.Restart the printer when prompted

Result

After you set the Security level to ‘High’, you must open Océ Express Web Tools by means of the HTTPS protocol: type https://Printer IP address or hostname in the web browser.

Prevent any outgoing connection to the Internet

Prevent any outgoing connection to the Internet

Introduction

Some features of the following systems allow or request a connection over the Internet to work properly:

•Océ PlotWave 300 R1.5 and higher

•Océ PlotWave 350 R1.5 and higher

•Océ ColorWave 300 R1.5 and higher

When the Security Policy in a company prevents any outgoing network traffic over the Internet, perform all the following actions in Express WebTools:

Security of the USB connection (Océ PlotWave 300/350, Océ ColorWave 300)

Security of the USB connection (Océ PlotWave 300/350, Océ ColorWave 300)

The USB connection on the Local user interface

Introduction

A USB connection is available on the Océ PlotWave 300, Océ PlotWave 350 and Océ ColorWave 300 Local user interface.

This USB connection is used to:

•Install and upgrade the controller software

•Backup and restore the controller configuration

•Scan to the USB storage device

•Print from the USB storage device

Security on the USB port

General USB port protection:

•Booting from the USB device is not possible.

•Executing any programme present on the USB device is not possible

The Autorun is disabled and no operation on the controller can execute a programme on the USB device.

•Propagating on network any infected file present on the USB device plugged on the USB port is not possible

Read from / write to USB device protection

•Protection of the USB READ operation:

— when restoring a controller configuration from the Local User Interface.

In that case, any file infected by a virus appears as an invalid backup file. The controller software detects it and rejects the restore operation.

— when printing from the USB device.

Any print file infected by a virus will never compromise controller’s software integrity.

•Protection of the USB WRITE operation:

— during the backup of the controller configuration, from the Local User Interface.

The backup is performed by the internal controller software. It cannot contaminate the USB device by any threat.

— when making a Scan To File to the USB device:

The Scan To File operation to USB device is performed by the internal controller software. It cannot contaminate the USB device by any threat.

Disable the USB features

You can disable:

•The direct printing operation from USB. See How to prevent ‘Print from USB’ on page 54

•The scanning operation to USB. See 1- Disable any ‘USB stick’ scan destination on page 54

Antivirus

Antivirus

Compatibility and recommendations

The following 2 antivirus programmes can be installed on your Océ systems:

•Symantec AntiVirus Endpoint Protection

•McAfee VirusScan Enterprise Edition / ePolicy Orchestrator for AntiVirus update

Contact your Canon representative to know which antivirus version to install on your Océ systems and get the installation procedure.

NOTE

Canon/Océ shall not be liable for damages of any kind attributable to the use of an antivirus on its controllers.

Roles and Passwords

Roles and Passwords

Roles and profiles in the Océ PlotWave 300/350, Océ Plotwave 900 R1.x and Océ ColorWave 300

Roles description

In the system, the main network and system settings are protected against change. Only authorised users can configure/change these settings.

4 roles are available:

•Key operator:

The Key operator can manage the jobs and the device settings

•System administrator

The System administrator can manage the Configuration settings such as the Network settings, scan destinations settings, security settings (e-shredding, IPsec), and the hardware/software configuration settings…

•Power user

The Power user has both the rights of the Key operator and the System administrator

•Service

This role is used exclusively by the Canon Service technician

Passwords policy and behaviour in the Océ PlotWave 300/350 and Océ ColorWave 300

Introduction

There are 2 groups of passwords:

•The passwords used in Océ Express WebTools

•The passwords used in the printer user panel (also named Local User Interface)

Passwords used in Océ Express WebTools

In Océ Express WebTools the passwords protect:

•The roles

•The Scan to File remote user name

•The security settings (preshared key for IPsec)

Password modification table for Océ PlotWave 300/350 and Océ ColorWave 300

Password policy

A password can be made of 256 characters maximum.

Passwords policy and behaviour in the Océ PlotWave 300/350 and Océ ColorWave 300

For Océ PlotWave 300 v1.2.1 and higher, Océ PlotWave 350 and Océ ColorWave 300 1.2.1 and higher, all MS Windows characters are allowed in a password.

For previous versions of Océ PlotWave 300 and Océ ColorWave 300 the passwords can be made of:

•Any number [0-9]

•Any letter lowercase/uppercase [a-z][A-Z]

•the following special characters:

Passwords used on the Océ printer user panel (Océ Plotwave 300/350 and Océ ColorWave 300)

Important: These passwords can only be made of numbers.

NOTE

Keep these passwords. The loss of these passwords may require the intervention of Canon Service.

Printer panel passwords modification table for Océ PlotWave 300/350 and Océ ColorWave 300

Password backup/restore policy with the ‘Save Set’/’Open Set’ features

Some passwords are stored into the backup set made with the ‘Save Set’ feature of Océ Express WebTools (the passwords for the printer panel)

Password backup table for Océ PlotWave 300/350 and Océ ColorWave 300

Passwords policy and behaviour in the Océ PlotWave 900 R1.x

(1):

—When a password is configured as ‘No password’, the information ‘Auto’ (meaning ‘No password’) is stored in the backup file. It is not encrypted

—The passwords are stored in the backup file whatever the login used when making the ‘Save Set’ operation (System administrator, the Key operator, or the Power user)

(2)

—The passwords are restored only when the System administrator or the Power user makes the ‘Open Set’ operation

—When a password has been stored with ‘Auto’ value, it is restored with the ‘No password’ value

Passwords policy and behaviour in the Océ PlotWave 900 R1.x

Passwords used in Océ Express WebTools

In Océ Express WebTools the passwords protect:

•The roles

•The Scan to File remote user name

Password modification table for Océ PlotWave 900 R1.x

Password policy

•256 characters maximum

•Any ‘Microsoft Windows’ characters

Password backup/restore policy with the ‘Save Set’/’Open Set’ features

None of the passwords for Power user, System administrator, Key operator, ScanToFile remote user, Preshared key, Mobile printing or Remote Service proxy setting is stored in the back up file with the ‘Save Set’ feature.

Data Security

Data Security

E-Shredding

E-shredding presentation

Introduction

The e-shredding feature is a security feature which allows to overwrite any user data (print/copy/ scan) when it is deleted from the system.

This feature prevents the recovery of any deleted user data (files’ content and attributes)

A deleted job is a job that cannot be retrieved from any user interface.

When is a job deleted?

A job is deleted either:

•When it is manually deleted from a Smart Inbox

•After it was successfully printed and was not saved in a Smart Inbox (‘Save printed jobs in a Smart Inbox’ system setting is disabled in the Océ Express Webtools)

•After a ‘ScanToFile to remote destination’ has been successfully performed

•After a ‘ScanToFile to USB stick’ has been performed successfully or not (only on Océ PlotWave 300/350 and Océ ColorWave 300)

•When it is automatically deleted after a timeout:

—When the end of the job lifetime in the Smart Inbox is reached (‘Save printed jobs in a Smart Inbox’ system setting is enabled in the Océ Express Webtools and the ‘Printed jobs in Smart Inbox: job lifetime’ is set)

—When the time for the cleanup of the ‘Scans in Smart Inbox’ is reached

•When a ‘Clear system Remove all jobs’ is performed on the printer local interface

E-shredding algorithms

Select one of the three e-shredding behaviours:

•DOD 5220.22-M: 3-pass overwriting algorithm (compliant with the US Department of Defense directive):

•Gutmann: 35-pass overwriting algorithm with random data

•Custom: set the number of passes, from 1 to 35.

NOTE

The e-shredding feature has been designed to minimise impact of the global system performance.

However the more passes selected, the more impact it has on general performance.

It is recommended to minimise the number of passes when document production is required.

Enable the e-shredding

Before you begin

You must be logged as a System Administrator or a Power user.

Enable the e-shredding

NOTE

When you enable the e-shredding, the system automatically disables the ‘Save printed jobs in a Smart Inbox’ setting. The jobs previously printed and stored in the Smart Inbox are deleted. They are not e-shredded.

Enable/disable the e-shredding (Océ Express WebTools)

Procedure

1.Open a web browser and enter the system URL: http://<hostname>, to open the Océ Express WebTools

2.Open the ‘Configuration’ — ‘Connectivity’ page and select the ‘E-shredding’ section

3.Click Edit

4.Check ‘E-shredding’ feature to enable it

5.Select the algorithm.

When you select ‘Custom’, set the number of passes

Result

When the E-shredding feature is enabled, an indication is displayed at 2 locations in the system:

•On the printer user panel (Océ PlotWave 300/350 and Océ ColorWave 300), an indication is displayed in the System menu: ‘E-shredding enabled’

•In the Océ Express WebTools window, a new icon is added to the list of icons (bottom right)

Each time data (file’s content or attributes) is deleted from the system, the e-shredding process occurs.

For a while, the E-shredding feedback returns as ‘busy’:

•On the printer user panel (Océ PlotWave 300/350 and Océ ColorWave 300), an indication is displayed in the System menu: ‘E-shredding busy’

•In the Océ Express WebTools window, roll the mouse over the e-shredding icon to display the ‘E-shredding busy’ status

Once the e-shredding data processed is complete, the status comes back to:

•‘E-shredding enabled’ in the printer user panel (Océ PlotWave 300/350 and Océ ColorWave 300)

•‘E-shredding ready’ in the Océ Express WebTools (roll over the icon)

E-shredding process and system behaviour

NOTE

In case some scanned files have a ‘Scan destination file name’ composed of more than 256 characters, on the controller or on the remote destination, they will be deleted, but they will not be e-shredded (too long name).

E-shredding process and system behaviour

When you enable the e-shredding

When you enable the e-shredding, the system starts the e-shredding process for all print/scan jobs that will be deleted.

E-shredding process will occur as a background task.

All processed jobs will be e-shredded as soon as they are deleted:

—After a manual deletion from the Smart Inbox

—After an automatic deletion of the print and scan jobs by the system (timeout, disabled Smart Inbox, cleanup)

When you disable the e-shredding

When you disable the e-shredding, the system:

•Terminates the e-shredding process for files which are being e-shredded

•Will not e-shred the new deleted files

Make sure all the scan/copy/print jobs are completely e-shredded

Once a batch of scan/copy/print jobs has been processed, perform the following actions to make sure all the files are e-shredded:

1- Unplug the system from the network

2- Check that ‘Saved print jobs in Smart Inbox’ is disabled 3- Delete any job from the ‘Scans’ Smart Inbox

4- Make a ‘Clear System’ on the Printer User interface

5- Wait until the e-shredder status comes back to ‘Ready’ (in Océ Express WebTools) 6- Restart the system

7- Wait until the e-shredder status displays ‘Ready’ (in Océ Express WebTools)

IPsec (on Océ PlotWave 300/350, Océ PlotWave 900 1.2 and higher 1.x, Océ ColorWave 300)

IPsec (on Océ PlotWave 300/350, Océ PlotWave 900 1.2 and higher 1.x, Océ ColorWave 300)

IPsec presentation

Introduction

IPsec is a protocol that provides authentication, data confidentiality and integrity in the network communication between devices.

A strong mechanism of encryption guarantees the confidentiality of the user print and scan data on the network.

IPsec is particularly suitable in a configuration where you need to create a dedicated secure link between the printer/copier system and a workstation which can be dedicated as a Print Server (or a Scan Server).

You can connect up to 5 IPsec stations to the printer/copier system.

In this configuration below:

•The printer/copier system is physically connected to the network but communicates only with a dedicated station (a Print Server or Scan Server for example)

•The Print Server receives the print request from the workstations via IP on the network

•The Print Server send the print requests to the printer/copier system via IPsec

•The workstations cannot communicate directly with the printer/copier system

NOTE

In this configuration, the back-channel communication between a workstation and the printer is unavailable (the back-channel information is not displayed in the Océ WPD driver).

NOTE

IPsec is compatible with IPv4 only.

Make sure IPv6 is ‘Disabled’ before you configure IPsec on the controller.

IPsec presentation

Illustration

IPsec parameters in the Océ Express WebTools (EWT)

The following IPsec parameters are available in the Océ Express WebTools :

IPsec Generic section:

* and HTTPS traffic for Océ Plotwave 900.

IPsec stations section:

You can configure a maximum of 5 IPsec communications between the printer/copier system and 5 workstations.

Configure the IPsec settings on the Océ controller

Enable and configure the parameters for each required station.

The parameters can be different for each different workstation:

—the IP address

—the preshared key (keep the generic default one or set a custom one)

Configure the IPsec settings on the Océ controller

Before you begin

You must be logged as a System Administrator or a Power user.

Activate and configure IPsec on the printer/scanner controller

Procedure

1.Open a web browser and enter the system URL: http://<hostname>, to open the Océ Express WebTools

2.Open the ‘Configuration’ — ‘Connectivity’ page

3.In ‘IPsec generic’ section, click ‘Edit’

4.Check ‘IPsec’

5.Keep ‘Failsafe option’ checked during the phase you configure the IPSec.

In case of need, this allows to be able to connect to the Océ Express WebTools from any workstation in order to be able to change parameters.

6.Keep the other parameters as they are.

Configure the IPsec settings on the Océ controller

7.In the ‘IPsec stations’ section, click ‘Edit’

8.Select ‘»IPsec station 1: Enable’

9.Enter the ‘IPsec station 1: IP address’ of the workstation

10.Create and enter the ‘IPsec station 1: Preshared key’ using the following policy:

•256 characters maximum

•Any number [0-9]

•Any letter lowercase/upper-case [a-z][A-Z]

•the following special characters:

NOTE

Write it down, this preshared key will be required during the IPsec configuration on the workstation.

NOTE

In the ‘TCP/IP: IPv6’ section, make sure TCP/IP (IPv6) is disabled.

Result

The IPsec settings are configured on the controller for a connection to a workstation (which can be a print server).

Configure the IPsec settings on a workstation or a print server

Configure the IPsec settings on a workstation or a print server

When to do

After the IPsec configuration on the controller.

Pre-requisites

Log on the workstation with the Administration rights.

Purpose

Complete the IPsec configuration for a secure connection between the printer/copier system and a workstation.

On the workstation, perform the 6 following actions:

1- Add the security snap-in on page 42

2- Create the security policy on page 43

3- Create the filter list on page 44

4- Define the filter actions and security negotiation on page 46

5- Define the security rule on page 47

6- Assign the security policy on page 49

NOTE

The procedure below shows the configuration steps on Windows server 2008.

The procedure is similar on other Operating Systems (Windows Server 2003, Windows XP, Windows Vista, Windows 7)

Add the security snap-in

Procedure

1. In the ‘Start’ — ‘Run’ window, enter ‘mmc’ to open the management console

2.In the top menu select ‘File’ — ‘Add/Remove Snap-in’

3.Select ‘IP Security Policy Management’ and click ‘Add’ to add it to the root console

Create the security policy

4.Keep ‘Local computer’ checked and click ‘Finish’ The security snap-in is added, click ‘OK’

Create the security policy

Procedure

1.In the console, right click on ‘IP Security Policies on local Computer’ and select ‘Create IP Security Policy’

2.Click ‘Next’ to open the wizard

3.Enter the name for the policy and click ‘Next’

Create the filter list

4. Uncheck ‘Activate the default response rule’

5. Uncheck ‘Edit properties’ and click ‘Finish’

Create the filter list

Procedure

1.In the console, right click on ‘IP Security Policies on local Computer’ and select ‘Manage IP filter lists and filter actions…’

2. In the ‘Manage IP filter lists’ tab click ‘Add’

Create the filter list

3. Enter a filter name and a description and click ‘Add’

4.Click ‘Next’ to open the wizard

5.Check the ‘Mirrored’ checkbox and click ‘Next’

6.Select ‘My IP address’ as the ‘Source address and click ‘Next’

7.Select ‘A specific IP address or subnet’ as ‘Destination address’ and enter the IP address of the controller

8. Select ‘Any’ as the ‘IP Protocol Type’ and click ‘Next’

Define the filter actions and security negotiation

9.Click ‘Finish’

10.In the ‘IP filter list’ window, click OK The filter list is set

Define the filter actions and security negotiation

Procedure

1. Open the ‘Manage Filter Actions’ tab and click ‘Add’ to open the wizard.

2.Click ‘Next’

3.Give a name to the filter actions and click ‘Next’

4. Select ‘Negotiate security’ and click ‘Next’

Define the security rule

5.Select ‘Allow unsecured communication if a secure connection cannot be established’ or ‘Fall back to unsecured communication’ (depending on the Operating System) and click ‘Next’

6.Select ‘Custom’ and click on the ‘Settings…’ button

7. Configure the settings as below

8. Click ‘OK’ and ‘Next’, then ‘Finish’

Define the security rule

Procedure

1.In the console, right click on the IP security policy just created and select ‘Properties’ to open the wizard

(On Windows 7, a new window opens: check that «Use Add Wizard» is checked, then click on «Add»)

2.Click ‘Next’

3.Select ‘This rule does not specify a tunnel’, and click ‘Next’

Define the security rule

4. As the Network type, select ‘All network connections’ and click ‘Next’

5. Select the filter previously created then click ‘Next’

6. Select the filter action previously created then click ‘Next’

7.In the ‘Authentication method’ window, check ‘Use this string to protect the key exchange (preshared key)’

Assign the security policy

8.Enter the preshared key you set in Express WebTools (see Configure the IPsec settings on the Océ controller on page 40), then click ‘Next’

9.Click ‘Finish’

10.Click ‘OK’ to validate the Security rule

Assign the security policy

Procedure

1. In the console, right click on the security policy just created and select ‘Assign’

The configuration is activated on the IPsec station (workstation):

2.To test the configuration, open a ‘command’ window and issue a ‘ping’ command from this IPsec station to the printer/scanner controller

When the test works properly it is recommended to disable the ‘Failsafe mode’ on the printer/ scanner controller. So, only the IPsec station is allowed to communicate with the printer/scanner system.

NOTE

In case you use the WPD driver, see The impact of IPsec when you print using Océ WPD through a print server on page 50.

The impact of IPsec when you print using Océ WPD through a print server

Introduction

When you use WPD on a print server, with advanced accounting activated, the use of IPsec has an impact on the workflow.

When the following conditions are gathered:

•A print server is configured as an IPsec station. Océ WPD is installed on the print server.

•IPsec is activated and the ‘Failsafe mode’ is disabled on the printer controller.

•The client workstation is not configured as an IPsec station.

•The client workstation uses the Océ WPD shared driver installed on the print server (Point & Print) to print jobs.

Pre-requisites

When advanced accounting is required, make sure you configured Account Center BEFORE disabling the ‘Failsafe mode’ on the printer controller.

Consequences of the IPsec configuration on the client workstation:

The back-channel information (printer status, feed data) is not retrieved from the printer. It is not displayed in the driver interface.

On the workstation, when the job is sent with Océ WPD:

•The required accounting information is not requested when submitting the job.

•The submitted job is stored in the Smart Inbox. It is not printed since accounting information is missing.

Open the Inbox in Océ Express WebTools (on an IPsec station) to enter the required accounting information and print the job.

NOTE

To be able to enter the accounting information and print directly from the workstation, enable the ‘Failsafe mode’ on the controller.

Then, the accounting window will be displayed on the client workstation, and the accounting information can be entered to print the job.

Troubleshooting: emergency procedure to disable IPsec

Introduction

In the following case:

•IPsec is enabled and activated on the printer/scanner controller and