Firewall Ports

[AdamBirch]

I have 2 network printers that I have installed behind a WatchGuard Firewall, I can not find the correct information about which firewall ports to open each post says different and none of them fully work, there is no details about this in the manual either. Please can someone advise?

The 2 printers are:

HP OfficeJet Pro 276dw

HP Color LaserJet MFP M277dw

Thank you

Adam

[John_Getzke]

What are you trying to do that requires firewall port configuration?  Please describe in detail what you are trying to achieve and the machines involved so that we have some context to answer your question.

Normally firewalls and ports are only necessary for remote access to something from another network.  This is normally a chore of discovering the protocol you are using for remote access and then setting up a port forwarding rule on the firewall so that it can make it to the destination. 

For regular LAN use no firewall configurations are necessary.  You may be having some other kind of problem if this is a LAN to LAN scenario.

[noooooooooo]

To minimize development cost most printer/MFC products are enegineered for the lowest common denominator use-case, where there is a single LAN with no malicious hosts on them ever.

In practice it is quite normal to have multiple network segments with a firewall between them, especially in enterprises where embedded devices might exist well beyond their support lifecycle for firmware and security updates. 

I found one article which lists firewall ports:

https://support.hp.com/us-en/product/hp-jetdirect-2900nw-print-server-series/8362163/document/c02480...

You are going to have to review logs on your watchguard and figure out what is really happening. Alternatively if you aren't recording syslogs you could run Wireshark from the client and try to pick ports out of there. 

We ran HP Print and Scan Doctor 5.1 and observed it using the following undocumented ports/services

icmp-echo

TCP 8080 (some alternate web service port to fetch config in xml format)

UDP 161 (SNMP, which if you've disabled it on the printer will cause Doctor to give up and completely fail, even though the printer responds with an ICMP unreachable) so, SNMP must be enabled on the printer for this utility to work)

TCP 5357 (no idea what this is, I didn't get a chance to pcap it and my client eventually stopped attempting it)

When actually printing, we found undocumented ports being used which had to add to the firewall rule:

TCP 53048 (WSD-SOAP, seems necessary for client status updates)

TCP 3910 (WSD-SOAP, started using this port instead of 53048 after Doctor automatically fixed a "port match" problem and seems to also be using it for print job submission instead of TCP 9100.)

Good luck!