---
title: Firewall Cisco VCS Expressway to WAN
description: "| Function | Port range | Type | Ingoing | Outgoing | Source IP | Destination IP | Remarks | New in X8.x software | | --- | --- | --- | --- | --- | --- | --- |…"
url: "http://vikanvideo.dk/findsvar/firewall-cisco-vcs-expressway-to-wan/"
updated: "2024-05-29"
category: Firewall
---

# Firewall Cisco VCS Expressway to WAN

| Function | Port range | Type | Ingoing | Outgoing | Source IP | Destination IP | Remarks | New in X8.x software |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |  |  |
| VCS Expressway to internet (WAN) |  |  |  |  |  |  |  |  |
| RTP / RTCP media | 1024 - 65535 | UDP + TCP |  | x | VCS Expressway | Internet (WAN) |  |  |
| Listening port for Gatekeeper RAS | 1719 | UDP |  | x | VCS Expressway | Internet (WAN) |  |  |
| SIP | 5060 | TCP + UDP |  | x | VCS Expressway | Internet (WAN) |  |  |
| SIP (TLS) | 5061 | TCP + TLS |  | x | VCS Expressway | Internet (WAN) |  |  |
| Q.931 / H.225 / H.245 | 15000 - 19999 | TCP |  | x | VCS Expressway | Internet (WAN) |  |  |
| RTP / RTCP media | 36000 - 59999 | UDP |  | x | VCS Expressway | Internet (WAN) |  | Yes before 50000 - 54999 |
| Temporary port | 25000 - 29999 | TCP |  | x | VCS Expressway | Internet (WAN) |  |  |
| NTP | 123 | UDP |  | x | VCS Expressway | Internet (WAN) | The VCS Expressway need date and time. It could be a local NTP server. |  |
| DNS | 53 | UDP |  | x | VCS Expressway | Internet (WAN) | Uses for external URI calls |  |
| STUN Media (Default) | 24000 - 29999 | UDP |  | x | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 56000 - 57000 |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
| Internet (WAN) to VCS Expressway in DMZ |  |  |  |  |  |  |  |  |
| Listening port for Gatekeeper RAS | 1719 | UDP | x |  | VCS Expressway | Internet (WAN) |  |  |
| Listening port for H.225 | 1720 | TCP | x |  | VCS Expressway | Internet (WAN) |  |  |
| RTP media port | 2776 | UDP | x |  | VCS Expressway | Internet (WAN) |  |  |
| Listening port for H.225 og H.245 | 2776 | TCP | x |  | VCS Expressway | Internet (WAN) |  |  |
| Listening port for H.245 | 2777 | TCP | x |  | VCS Expressway | Internet (WAN) |  |  |
| TCP media control port | 2777 | UDP | x |  | VCS Expressway | Internet (WAN) |  |  |
| Q.931 / H.225 / H.245 | 15000 - 19999 | TCP | x |  | VCS Expressway | Internet (WAN) |  |  |
| RTP / RTCP media (Cisco endpoints) - not recommended | 36000 - 59999 | UDP | x |  | VCS Expressway | Internet (WAN) | If endpoints from example Polycom calls in, then the media ports from the Polycom endpoints can be on ports from 1024 - 65535. So to be sure media can go into the Cisco VCS Expressway, then it's recommended to open for all high ports | Yes before 50000 - 54999 |
| RTP / RTCP media (Other than Cisco) - recommended | 1024 - 65535 | UDP + TCP | x |  | VCS Expressway | Internet (WAN) | If endpoints from example Polycom calls in, then the media ports from the Polycom endpoints can be on ports from 1024 - 65535. So to be sure media can go into the Cisco VCS Expressway, then it's recommended to open for all high ports |  |
| SIP | 5060 | TCP + UDP | x |  | VCS Expressway | Internet (WAN) |  |  |
| SIP (TLS) | 5061 | TCP + TLS | x |  | VCS Expressway | Internet (WAN) |  |  |
| STUN Discovery | 3478 - 3483 | UDP | x |  | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 3478 |
| STUN Relay | 4678 | UDP | x |  | VCS Expressway | Internet (WAN) | Should be used if STUN is used |  |
| STUN Media (Default) | 24000 - 29999 | UDP | x |  | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 56000 - 57000 |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
| VCS Expressway in DMZ to VCS Control |  |  |  |  |  |  |  |  |
| Traversel zoneport for H.323 | 6xxx | UDP | x | x | VCS Expressway | VCS Controller (not on own local network, so to WAN) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 6001. |  |
| Traversel zoneport for SIP | 7xxx | TCP + TLS | x | x | VCS Expressway | VCS Controller (not on own local network, so to WAN) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 7001. |  |
| Traversel zoneport for H.323 | 6xxx | UDP |  | x | VCS Expressway | VCS Controller (on own local network) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 6001. Waiting for outgoing link from the VCS Controller |  |
| Traversel zoneport for SIP | 7xxx | TCP + TLS |  | x | VCS Expressway | VCS Controller (on own local network) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 7001. Waiting for outgoing link from the VCS Controller |  |
|  |  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |  |
| Remember H.323 ALG/Application support should be off on the firewall !! |  |  |  |  |  |  |  |  |