Network requirements
On this page
The unit is an ordinary host on the office network. It initiates almost everything itself; the only inbound traffic it needs is the console, the print stream for the release queue, and SNMP traps if you choose to use them.
Addressing
Static is preferred, DHCP reservation is acceptable, plain DHCP is not. Two things depend on the address staying put: every workstation’s secure release queue points at it by address or by a name that resolves to it, and printers configured to send traps have it written into their own settings.
| Interface eth0 | Site LAN. Static or reserved, single address, IPv4. |
|---|---|
| Interface eth1 | Service port, fixed 192.168.77.1/24. Cannot be changed and must never be patched into the site LAN. |
| IPv6 | Link-local only. The unit does not poll devices over IPv6 in the 3.x line. |
| MTU | 1500. The unit does not fragment SNMP requests; a path with a smaller MTU shows up as devices that time out only when their answer is long. |
Port table
“Out” means the unit opens the connection. “In” means something else opens it towards the unit.
| Port | Proto | Direction | Peer | Used for |
|---|---|---|---|---|
| 161 | UDP | Out | Printers | SNMP polling: identity, meters, supplies, status. The one that must work. |
| 162 | UDP | In | Printers | SNMP traps, if trap reporting is enabled. Optional; polling covers the same ground more slowly. |
| 443 | TCP | In | Admin workstations | Web console. |
| 9100 | TCP | Out | Printers | Sending a released job to the chosen device. |
| 9100 | TCP | In | Workstations, print server | Receiving jobs into the hold queue. |
| 631 | TCP | In | Workstations | IPP into the hold queue, as an alternative to 9100. |
| 123 | UDP | Out | NTP server | Clock. A wrong clock makes every meter reading arguable. |
| 53 | UDP/TCP | Out | DNS servers | Resolving the mail relay, the NTP name and the update host. |
| 25 / 587 | TCP | Out | Mail relay | Alert mail and scheduled meter exports. |
| 389 / 636 | TCP | Out | Directory | Optional. Looking up users for secure release by PIN or card. |
| 443 | TCP | Out | updates.printdoc.digital | Software update check, if automatic updates are enabled. Optional; USB update works offline. |
| 22 | TCP | In | Admin workstations | Shell for mluctl. Disabled by default on 3.3 and later. |
What each closed port costs
| Blocked | Symptom | Severity |
|---|---|---|
| 161/udp | Devices discovered but permanently “unreachable”; no meters at all. | fatal |
| 9100/tcp out | Jobs are held but nothing prints when released; users blame the printer. | fatal for release |
| 123/udp | Clock drifts; readings cluster at odd times and exports are rejected. | serious |
| 25 or 587 | Alerts raised but never delivered. The console still shows them. | serious |
| 162/udp in | Faults are noticed at the next poll instead of immediately. | minor |
| 443/tcp out | No automatic updates. Update by USB instead. | minor |
VLAN placement
Put the unit on the same VLAN as the printers where one exists. It is the shortest path for the protocol that matters, and it takes SNMP off the user VLAN entirely.
- Printer VLAN (preferred). SNMP stays local. You then need a rule allowing workstations to reach the unit on 9100 or 631 and admins on 443.
- Server VLAN. Works, but every printer subnet needs an SNMP path back. On a site with fourteen branch subnets that is fourteen rules, and one of them will be forgotten.
- User VLAN. Last resort. Broadcast noise costs nothing here, but the unit ends up trusted by the same rules as user machines, which nobody enjoys explaining later.
Time and name resolution
Give the unit the same NTP source as the domain controllers. Meter readings are stamped at the moment of the poll and exports are grouped by calendar day in the site time zone; a unit ten minutes ahead pushes a month-end reading into the wrong month, and that argument takes longer to settle than the install took.
DNS is used for the mail relay, the NTP name and the update host. Printers are always addressed by IP, never by name — printer DNS records are wrong often enough that we stopped trusting them.