Canon printer imageCLASS MF236n User Manual

							DisablingHTTPCommunication
1469-084
HTTP is used for communications over the network, such as when you access the machine via the Remote UI. If you are using a USB connection or are otherwise not using HTTP, you can disable HTTP to block malicious third-partyintrusions via the unused HTTP port.
Disabling HTTP disables some of the network capabilities, such as the Remote UI, WSD printing, and printingwith Google Cloud Print.
1TapintheScreen.2Tap.
	 If a screen for entering a PIN is displayed, enter the PIN with the numeric keys and tap . Setting
theSystemManagerPIN(P.397)
3Select.4Tap.
  
Disables HTTP communication.
  
Enables HTTP communication.
LINKS
UsingRemoteUI(P.449)
ChangingPortNumbers(P.409)
Con4gurLng PrintingProtocolsandWSDFunctions(P.348)
Security
423             
						

							DisablingRemoteUI
1469-085
The Remote UI is useful because the machine settings can be  speci4ed by using a Web browser on a computer. To use
the Remote UI, the machine must be connected to a computer over the network. If you do not need to use the Remote
UI, you might want to disable the Remote UI to reduce the risk of having your machine controlled remotely over the
network by malicious third parties.
1TapintheScreen.2Tap.
	 If a screen for entering a PIN is displayed, enter the PIN with the numeric keys and tap . Setting
theSystemManagerPIN(P.397)
3Select.4Tap.
  
Disables the Remote UI.
  
Enables the Remote UI.
LINKS
UsingRemoteUI(P.449)
DisablingHTTPCommunication(P.423)
Security
424          
						

							ImplementingRobustSecurityFeatures
1469-086
Authorized users may incur unanticipated losses from attacks by malicious third parties, such as  sniwng, spoo4ng,
and tampering of data as it  5ows over a network. To protect your important and valuable information from these
attacks, the machine supports the following features to enhance security and secrecy.
TLSEncryptedCommunication
TLS is a protocol for encryption for data sent over a network and is often used for communication via a Web
browser or an e-mail application. TLS enables secure network communication when you access the machine
from a computer via the Remote UI. 
EnablingTLSEncryptedCommunicationfortheRemoteUI(P.426)
IEEE802.1XAuthentication
IEEE 802.1X is a standard and mechanism for blocking unauthorized access to the network by collectively managing user authentication information. If a device tries to connect to the 802.1X network, the device mustgo through user authentication in order to prove that the connection is made by an authorized user.
Authentication information is sent to and checked by a RADIUS server, which permits or rejects communication
to the network depending on the authentication result. If authentication fails, a LAN switch (or an access point)
blocks access from the outside of the network. The machine can connect to an 802.1X network as a client
device. 
Con4gurLng IEEE802.1XAuthentication(P.429)
LINKS
Con4gurLngSettingsforKeyPairsandDigital CertL4cates(P.434)
Security
425          
						

							EnablingTLSEncryptedCommunicationfortheRemote
UI
1469-087
You can encrypt communication between the machine and a Web browser on the computer by using Transport Layer Security (TLS). TLS is a mechanism for encrypting data sent or received over the network. TLS must be enabled when
the Remote UI is used for specifying settings for IEEE 802.1X authentication (TTLS/PEAP) or SNMPv3. To use TLS for the
Remote UI, you need to set a key pair and enable the TLS function. Generate or install the key pair for TLS before
enabling TLS ( 
Con4gurLng SettingsforKeyPairsandDigital CertL4cates(P.434)).
1StarttheRemoteUIandlogoninSystemManagerMode.StartingRemote
UI(P.450)2Click[Settings/[email protected][NetworkSettings@[TCP/IP[email protected]
426       
						

							4Click[KeyandCertL4cate@in[TLS[email protected][RegisterDefaultKey@ontherightofthekeypairyouwanttouse.
Viewingdetailsofa certL4cate
	 You  can  check  the  details  of  the  certi4cate  or  verify  the  certi4cate  by  clicking  the  corresponding  text  link
under [Key Name], or the  certi4cate icon. 
VerifyingKeyPairsandDigital CertL4cates(P.446)
6EnableTLSfortheRemoteUI.1Click [Security Settings]  [Remote UI Settings].2Click [Edit].
Security
427    
						

							3Select the [Use TLS] check box and click [OK].Usingtheoperationpanel	 You can also enable or disable TLS encrypted communication from  in the  screen. 
Use
TLS(P.531)
StartingtheRemoteUIwithTLS 	 If you try to start the Remote UI when TLS is enabled, a security alert may be displayed regarding the
security  certi4cate.  In this case, check that the correct URL is entered in the address  4eld, and then proceed
to display the Remote UI screen. 
StartingRemoteUI(P.450)
EnablingTLSfore-mailing(MF249dw/MF247dw) 	 If the SMTP server and the POP3 server support TLS, you can enable TLS for communication with these
servers ( 
Con4gurLng E-MailCommunicationSettings(P.363) ). For more information about the SMTP
server and the POP3 server, contact your Internet service provider or Network Administrator.
LINKS
GeneratingKeyPairs(P.436)
UsingCA-issuedKeyPairsandDigital CertL4cates(P.443)
Con4gurLng IEEE802.1XAuthentication(P.429)
MonitoringandControllingtheMachinewithSNMP(P.386)
Security
428                      
						

							Con4gurLngIEEE802.1XAuthentication
1469-088
The machine can connect to an 802.1X network as a client device. A typical 802.1X network consists of a RADIUS server (authentication server), LAN switch (authenticator), and client devices with authentication software (supplicants). If adevice tries to connect to the 802.1X network, the device must go through user authentication in order to prove that the connection is made by an authorized user. Authentication information is sent to and checked by a RADIUS server,
which permits or rejects communication to the network depending on the authentication result. If authentication fails,
a LAN switch (or an access point) blocks access from the outside of the network.
Select the authentication method from the options below. If necessary, install or register a key pair or CA  certi4cate
before  con4guring  IEEE 802.1X authentication ( 
UsingCA-issuedKeyPairsandDigital CertL4cates(P.443)).
TLS
The machine and the authentication server authenticate each other by mutually verifying their  certi4cates. A
key pair issued by a  certi4cation authority (CA) is required for the client authentication (when authenticating the
machine). For the server authentication, a CA  certi4cate installed via the Remote UI can be used in addition to a
CA  certi4cate  preinstalled in the machine.
TTLS
This authentication method uses a user name and password for the client authentication and a CA  certi4cate for
the server authentication. MSCHAPv2 or PAP can be selected as the internal protocol. TTLS can be used with
PEAP at the same time. Enable TLS for the Remote UI before  con4guring this authentication method ( 
EnablingTLSEncryptedCommunicationfortheRemoteUI(P.426) ).
PEAP
The required settings are almost the same as those of TTLS. MS-CHAPv2 is used as the internal protocol. Enable TLS for the Remote UI before  con4guring this authentication method ( 
EnablingTLSEncrypted
CommunicationfortheRemoteUI(P.426) ).
1StarttheRemoteUIandlogoninSystemManagerMode.StartingRemote
UI(P.450)2Click[Settings/[email protected]
429             
						

							3Click[NetworkSettings@[IEEE802.1X[email protected][[email protected]the[UseIEEE802.1X@checkbox,entertheloginnameinthe[LoginName@text
box,andspecifytherequiredsettings.
[UseIEEE802.1X@
Security
430 
						

							Select the check box to enable IEEE 802.1X authentication.[LoginName@
Enter up to 24 alphanumeric characters for a name (EAP identity) that is used for identifying the user.
SettingTLS
1Select the [Use TLS] check box and click [Key and  Certi[email protected] [Register Default Key] on the right of the key pair you want to use for the client authentication.
ViewingdetailsofakeypairorcertL4cate
	 You can check the details of the  certi4cate or verify the  certi4cate by clicking the corresponding text
link under [Key Name], or the  certi4cate icon. 
VerifyingKeyPairsandDigital CertL4cates(P.446)
SettingTTLS/PEAP
1Select the [Use TTLS] or [Use PEAP] check box.
InternalprotocolforTTLS
	 You can select MSCHAPv2 or PAP. If you want to use PAP, click the [PAP] radio button.
Security
431    
						

							2Click [Change User Name/Password].	 To specify a user name other than the login name, clear the [Use Login Name as User Name] check
box. Select the check box if you want to use the login name as the user name.3Set the user name/password and click [OK].
[UserName@
Enter up to 24 alphanumeric characters for the user name.
[ChangePassword@
To set or change the password, select the check box and enter up to 24 alphanumeric characters for the new password both in the [Password] and  >Con4rm@ text boxes.
6Click[[email protected]themachine.
	Turn OFF the machine, wait for at least 10 seconds, and turn it back ON.
Security
432