| Function | Port range | Type | Ingoing | Outgoing | Source IP | Destination IP | Remarks | New in X8.x software |
| VCS Expressway to internet (WAN) | ||||||||
| RTP / RTCP media | 1024 – 65535 | UDP + TCP | x | VCS Expressway | Internet (WAN) | |||
| Listening port for Gatekeeper RAS | 1719 | UDP | x | VCS Expressway | Internet (WAN) | |||
| SIP | 5060 | TCP + UDP | x | VCS Expressway | Internet (WAN) | |||
| SIP (TLS) | 5061 | TCP + TLS | x | VCS Expressway | Internet (WAN) | |||
| Q.931 / H.225 / H.245 | 15000 – 19999 | TCP | x | VCS Expressway | Internet (WAN) | |||
| RTP / RTCP media | 36000 – 59999 | UDP | x | VCS Expressway | Internet (WAN) | Yes before 50000 – 54999 | ||
| Temporary port | 25000 – 29999 | TCP | x | VCS Expressway | Internet (WAN) | |||
| NTP | 123 | UDP | x | VCS Expressway | Internet (WAN) | The VCS Expressway need date and time. It could be a local NTP server. | ||
| DNS | 53 | UDP | x | VCS Expressway | Internet (WAN) | Uses for external URI calls | ||
| STUN Media (Default) | 24000 – 29999 | UDP | x | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 56000 – 57000 | |
| Internet (WAN) to VCS Expressway in DMZ | ||||||||
| Listening port for Gatekeeper RAS | 1719 | UDP | x | VCS Expressway | Internet (WAN) | |||
| Listening port for H.225 | 1720 | TCP | x | VCS Expressway | Internet (WAN) | |||
| RTP media port | 2776 | UDP | x | VCS Expressway | Internet (WAN) | |||
| Listening port for H.225 og H.245 | 2776 | TCP | x | VCS Expressway | Internet (WAN) | |||
| Listening port for H.245 | 2777 | TCP | x | VCS Expressway | Internet (WAN) | |||
| TCP media control port | 2777 | UDP | x | VCS Expressway | Internet (WAN) | |||
| Q.931 / H.225 / H.245 | 15000 – 19999 | TCP | x | VCS Expressway | Internet (WAN) | |||
| RTP / RTCP media (Cisco endpoints) – not recommended | 36000 – 59999 | UDP | x | VCS Expressway | Internet (WAN) | If endpoints from example Polycom calls in, then the media ports from the Polycom endpoints can be on ports from 1024 – 65535. So to be sure media can go into the Cisco VCS Expressway, then it’s recommended to open for all high ports | Yes before 50000 – 54999 | |
| RTP / RTCP media (Other than Cisco) – recommended | 1024 – 65535 | UDP + TCP | x | VCS Expressway | Internet (WAN) | If endpoints from example Polycom calls in, then the media ports from the Polycom endpoints can be on ports from 1024 – 65535. So to be sure media can go into the Cisco VCS Expressway, then it’s recommended to open for all high ports | ||
| SIP | 5060 | TCP + UDP | x | VCS Expressway | Internet (WAN) | |||
| SIP (TLS) | 5061 | TCP + TLS | x | VCS Expressway | Internet (WAN) | |||
| STUN Discovery | 3478 – 3483 | UDP | x | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 3478 | |
| STUN Relay | 4678 | UDP | x | VCS Expressway | Internet (WAN) | Should be used if STUN is used | ||
| STUN Media (Default) | 24000 – 29999 | UDP | x | VCS Expressway | Internet (WAN) | Should be used if STUN is used | Yes before 56000 – 57000 | |
| VCS Expressway in DMZ to VCS Control | ||||||||
| Traversel zoneport for H.323 | 6xxx | UDP | x | x | VCS Expressway | VCS Controller (not on own local network, so to WAN) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 6001. | |
| Traversel zoneport for SIP | 7xxx | TCP + TLS | x | x | VCS Expressway | VCS Controller (not on own local network, so to WAN) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 7001. | |
| Traversel zoneport for H.323 | 6xxx | UDP | x | VCS Expressway | VCS Controller (on own local network) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 6001. Waiting for outgoing link from the VCS Controller | ||
| Traversel zoneport for SIP | 7xxx | TCP + TLS | x | VCS Expressway | VCS Controller (on own local network) | This port is set on the VCS Expressway and VCS Controller. Zone 1 starts with 7001. Waiting for outgoing link from the VCS Controller | ||
| Remember H.323 ALG/Application support should be off on the firewall !! |
Firewall Cisco VCS Expressway to WAN
Updated on 29.05.2024
