Canon printer imageCLASS MF236n User Manual

							ProtectingtheMachinefromUnauthorizedAccess
1469-07A
Prevent unauthorized third parties from accessing and using the machine. You can implement multiple security
measures, such as using  4rewalls and changing port numbers.
Security
393 
						

							PreventingUnauthorizedAccess
1469-07C
This section describes the security measures on how to prevent unauthorized access from the external network. This is a must-read for all users and administrators before using this machine, other printers, and multifunction machinesconnected to the network. In recent years, a printer/multifunction machine connected to the network can offer you a
variety of useful functions, such as printing from a computer, operating from a computer using the remote function,
and sending scanned documents via the Internet. On the other hand, it is essential to take security measures to
reduce the security risk for information leakage, as a printer/multifunction machine has become more exposed to
threats, such as unauthorized access and theft, when it is connected to the network. This section explains necessary
settings you need to specify to prevent unauthorized access before using a printer/multifunction machine connected
to the network.
SecurityMeasurestoPreventUnauthorizedAccessfromtheExternalNetwork
AssigningaPrivateIPAddress(P.394)
UsingFirewalltoRestrictTransmission(P.395)
SpecifyingtheTLSEncryptedCommunication(P.395)
SettingPINtoManageInformationStoredintheMultifunctionMachine(P.395)
Assigning a Private IP Address
An IP address is a numerical label assigned to each device participating in a computer network. A "global IP address" is used for the communication connecting to the Internet, and a "private IP address" is used for the communication within a local area network, such as a LAN in the company. If a global IP address is assigned, your printer/
multifunction machine is open to the public and can be accessed via the Internet. Thus, the risk of information leakage
due to unauthorized access from external network increases. On the other hand, if a private IP address is assigned, your printer/multifunction machine is closed to a local area network and can be accessed by only users on your localarea network, such as a LAN in the company.
 GlobalIPAddress
Can be accessed from the external networkPrivateIPAddress
Can be accessed from the users within a local area network
Basically, assign a private IP address to your printer/multifunction machine. Make sure to  con4rm the IP address,
assigned to the printer/multifunction machine you are using, is a private IP address or not. A private IP address is
found in one of the following ranges.
RangesforPrivateIPaddresses
	 From 10.0.0.0 to 10.255.255.255
	 From 172.16.0.0 to 172.31.255.255
	 From 192.168.0.0 to 192.168.255.255
For information on how to  con4rm the IP address, see 
SettingIPv4Address(P.337) .
	
If a global IP address is assigned to a printer/multifunction machine, you can create a network environment
to reduce the risk of unauthorized access by installing security software, such as a  4rewall that preventsSecurity
394                
						

							access from the external networks. If you want to assign a global IP address to and use a printer/multifunction machine, contact your network administrator.
Using Firewall to Restrict Transmission
A  4rewall  is a system that prevents unauthorized access from the external networks and protects against attacks/
intrusions to a local area network. You can use a  4rewall on your network environment to block access from the
external network that appears to be dangerous, by restricting communication from  speci4ed IP address of the
external network. The function installed to a Canon printer/multifunction machine enables you to set up the IP
address  4lter. For information on how to set up an IP address  4lter, see 
SpecifyingIPAddressesforFirewall
Rules(P.402) .
Specifying the TLS Encrypted Communication 
For information on the TLS Encrypted Communication, see 
ImplementingRobustSecurityFeatures(P.425) , and
on the procedures to specify, see 
EnablingTLSEncryptedCommunicationfortheRemoteUI(P.426) .
Setting PIN to Manage Information Stored in the Multifunction Machine
If a malicious third party attempts to gain unauthorized access to a printer/multifunction machine, setting PIN to information stored in the machine will reduce the risk of information leakage. Canon printer/multifunction machine
enables you to protect various type of information by setting PIN.
SettingPINtoEachFunction
	 Setting PIN for Using Remote UI
For more information, see 
SettingaRemoteUIPIN(P.399) .
	 Setting PIN for the System Manager Settings
For more information, see  
SettingtheSystemManagerPIN(P.397) .
	 Address Book PIN
For more information on setting a PIN, see 
SettingaPINforAddressBook(P.415) .
Listed above are some examples of security measures for preventing unauthorized access. For more information on
the other security measures, see 
Security(P.392)  and take necessary security measures for preventing
unauthorized access to suit your environment.
Security
395                      
						

							SettingAccessPrivileges
1469-07E
Protect the machine from unauthorized access by only allowing users with access privileges to use the machine. When privileges are set, the user must enter a PIN to change settings or access the Remote UI.
Access privileges are divided into two types: System Manager Mode and General User Mode. System Manager Modehas full access privileges, and a System Manager PIN can be set to restrict logon in this mode. And by setting a Remote
UI Access PIN, you can restrict use of the Remote UI in General User Mode and in System Manager Mode without a
System Manager PIN set.
SystemManagerPIN
System Manager PIN is intended exclusively for Administrators having full access privileges. If you specify thisPIN, you need to log on to the machine using this PIN in order to access  or . Set the System Manager PIN when you need different access privilege levels for administrators and general users.
SettingtheSystemManagerPIN(P.397)
RemoteUIPIN(RemoteUIAccessPIN)
This is a PIN for using the Remote UI. Only users who know the PIN can access the Remote UI.
SettingaRemoteUIPIN(P.399)
Security
396       
						

							SettingtheSystemManagerPIN
1469-07F
Set a System Manager PIN that is intended exclusively for Administrators. You can access , , etc. only when the PIN has been entered correctly. It is recommended that only
Administrators know the PIN.
1TapintheScreen.2Tap.3Select.4SpecifytheSystemManagerPIN.
	 Enter a number of up to seven digits using the numeric keys, and tap .
	 When 
						

							Con4gurLngsettingsviatheRemoteUI
	 Start the Remote UI and log on in System Manager Mode. Click [Settings/Registration] 
 [System
Management] 
 [Edit] and specify the necessary settings on the displayed screen.
	 By using the Remote UI, you can register a variety of information, including contact information,
Administrator comments, the installation location of the machine, as well as to the settings that you can register by using the operation panel. The registered information can be viewed on the [Device Information]page of the Remote UI. 
CheckingSystemManagerInformation(P.459)
IfPINisforgotten 	 Do not forget your PIN. If you forget your PIN, contact your authorized Canon dealer or the Canon help line.
IfaSystemManagerPINisSet
	 If you try to access , , etc., the following screen is displayed. Enter the set PIN.
	 Entering a PIN is also required when logging on in System Manager
Mode in the Remote UI. 
StartingRemoteUI(P.450)
 
Security
398       
						

							SettingaRemoteUIPIN
1469-07H
You can set a PIN for access to the Remote UI. All users use a common PIN.
1StarttheRemoteUIandlogoninSystemManagerMode.StartingRemote
UI(P.450)2Click[Settings/[email protected][SecuritySettings@[RemoteUI[email protected][[email protected]
399    
						

							5Selectthe[UseRemoteUIAccessPIN@checkboxandsetthePIN.
[UseRemoteUIAccessPIN@
If you select this check box, you must enter a PIN to access the Remote UI.
[Set/ChangePIN@To set a PIN, select the check box and enter a number of up to seven digits both in the [PIN] and  >Con4rm@
text boxes.
6Click[OK@.
IfPINisforgotten
	 Set a new Remote UI Access PIN in the settings menu on the operation panel. 
RemoteUISettings(P.532)
IfRemoteUIsettingsareinitialized 	 The Remote UI Access PIN is also initialized. After an initialization, reset the PIN. 
InitializingMenu(P.624)
LINKS
SettingAccessPrivileges(P.396)
SettingtheSystemManagerPIN(P.397)
Security
400             
						

							RestrictingCommunicationbyUsingFirewalls
1469-07J
Without proper security, unauthorized third parties can access computers and other communication devices that are connected to a network. To prevent this unauthorized access, specify the settings for packet  4lter, a feature that
restricts communication to devices with  speci4ed IP addresses or MAC addresses.
Security
401 
						

							SpecifyingIPAddressesforFirewallRules
1469-07K
You can either limit communication to only devices with  speci4ed IP addresses, or block devices with  speci4ed IP
addresses but permit other communications. You can specify a single IP address or a range of IP addresses.
	 Up to 4 IP addresses (or ranges of IP addresses) can be  speci4ed for both IPv4 and IPv6.
	 The packet  4lters described in this section control communications over TCP, UDP, and ICMP.
1StarttheRemoteUIandlogoninSystemManagerMode.StartingRemote
UI(P.450)2Click[Settings/[email protected][SecuritySettings@[IPAddress[email protected][Edit@forthe 4ltertypethatyouwanttouse.Security
402