What ports do I need to have open for Workpath apps

There are a Number of TCPIP/UDP ports that will need to expose for many of the HP Based Workpath application to function, to better understand which ports you need to allow please review the HP Security White Papers attached below.

If you find that the printer reports issues accessing HP Service, I would check the following.

1. Review the HP Security White Papers - Attached

2. Under EWS > HP Web Services, Check if Printer is Connected to HP Connect, if not then you will need to ensure the printer has HP-hosted Trusted Site *.id.hp.com

3. HP has a Command Line Windows based Testing tool, this tool can check you PC and the Firewall to see if it is able to communicate to the HP Eco System, and if your PC has no issues running the tool and the Printer uses the same firewall rules and is on the same LAN then all should be ok. See Diag Tools Attached, else you will need your IT people to expose the correct URL and IP/UDP Ports.

Here are some common URLs you must allow the printer to access

HP App Attestation and Token

https://*.api.hp.com

HP App Center

https://*.smartcloudprint.com

HP Command Center

https://*.smartcloudprint.com

https://lookupsvc.smartcloudprint.com

HP Web Services

https://*.avatar.ext.hp.com

http://*.avatar.ext.hp.com

UDP://*.avatar.ext.hp.com:9930

All communications between HP printers, HP cloud services, and third-party cloud services (Microsoft, Google, etc.) are initiated by the HP printer and are in a secure session via HTTPS/TLS over port 443. UDP/9930 or HTTP Port 80 with GCS encryption is used for signaling. This is an industry standard protocol used by Internet browsers.

NOTE: HP Enterprise Printers deployed in environments with HTTP Port 80 blocked with

Workpath solutions will continue to operate as long as port UDP 9930 remains available. HP Printers communicate with the HP Cloud mainly using HTTPS port 443. The exception is for “device signalling”, which uses UDP port 9930 (primary) and HTTP Port 80 (secondary) for performance reasons. Think of device signally as “quick polling” (i.e. “Are you ready?” and “Do

you have a job?”) signals. Device signalling needs to be lightweight and very fast. These signals

are further secured with GCM encryption to ensure security.

HP recommends both UDP 9930 and HTTP port 80 to be available to maximize robustness, but

should you need to operate in environments that prohibit HTTP port 80, please make sure that

UDP port 9930 is available.

HP Universal Print for Authentication Suite utilises IPP Protocol on TCP Port 631, please ensure no port blocking. 

HP Authentication Suite Azure License Server is located in Australia East Coast, found at https://license.hpauthsuite.com, else its IP Address is currently 20.211.64.13,

If you are still having connection and or permission issues, please review Azure Conditional access and Policy Tips

How to whitelist SignalR traffic?

Use Service Tags:

The recommended approach is to whitelist the AzureSignalR service tag in your firewall or NSG (Network Security Group).

Service Tags automatically include all IP ranges for SignalR across regions and update as Azure changes them.

This avoids manual IP management. 

Region-specific IP ranges:

If you cannot use Service Tags, you must whitelist Azure datacenter IP ranges for the region where your SignalR instance is deployed.

These ranges are published in the Azure IP Ranges and Service Tags JSON

Hostname-based approach:

Alternatively, whitelist the FQDN of your SignalR instance (e.g., your-signalr-name.service.signalr.net) if your firewall supports DNS-based rules.

Download Azure IP Ranges and Service Tags – Public Cloud from Official Microsoft Download Center

You may find this topic based on Azure & Firewalls etc. of some value too (Click Here)

Azure intrusion detection 

Last but not least, the HP Command Centre Web Services infrastructure could be having issues, here is a URL so you could see if any services are reported as offline HP Command Center Status