Firewall ports and IP ranges for cloud calling

See also

Sources

1. 1
   Cisco states that Webex media flows in both directions using a symmetric inside-initiated 5-tuple stream outbound to the Webex cloud, where the 5-tuple is source IP address destination IP address source port destination port and protocol.

   Network Requirements for Webex Services · Webex media flows paragraph · Checked 2026-09-16
2. 2
   Cisco states that in preference order Webex apps and Cisco Video devices support UDP TCP and TLS as media transport protocols, that they fall back to TCP if UDP ports are blocked by the firewall and to TLS if TCP ports are blocked, and that it prefers and strongly recommends UDP for all Webex voice and video media streams in line with RFC 3550.

   Network Requirements for Webex Services · Webex media transport protocols, UDP preference paragraph · Checked 2026-09-16
3. 3
   A Webex Calling endpoint must use the _sips._tcp service and protocol combination as the prefix for the DNS SRV lookup that obtains the host address for TLS-based communication, must honour the host port weight and priority advertised for each host address, and must create an affinity of host to port when opening the socket for SIP registration, with selection by priority and weight following RFC 2782.

   Security requirements for Webex Calling · Requirements for endpoints, Resolution of host address from the DNS SRV address · Checked 2026-09-16
4. 4
   Cisco names AES-CM-128-HMAC-SHA1 as the cipher typically used to encrypt media to Webex services from endpoints using SRTP with SIP signalling and describes it as a mature cipher with proven interoperability between vendors, and the Webex Calling security requirements article gives AES_CM_128_HMAC_SHA1_80 as the only SRTP key supported for secure media.

   Network Requirements for Webex Services · media encryption paragraph, against the Webex Calling security requirements SRTP row · Checked 2026-09-16
5. 5
   Cisco states that where TLS is used as the media transport protocol by Webex apps and Cisco Video devices with a configured proxy server the media is routed through that proxy, which can create bandwidth bottlenecks and subsequent packet loss, and strongly recommends that TLS is not used to transport media in production environments.

   Network Requirements for Webex Services · Proxy server bottlenecks paragraph · Checked 2026-09-16
6. 6
   The Webex Calling port reference states that TCP and TLS as transport protocols for media are not supported for Webex Calling in production environments, while the Webex network requirements article describes Webex apps and Cisco Video devices falling back from UDP to TCP and then to TLS, so the same organisation's calling traffic and meeting traffic answer a blocked UDP range differently.field report

   Port Reference Information for Webex Calling · Firewall configuration transport protocol paragraph, against the Webex network requirements media transport section · Checked 2026-09-16
7. 7
   Cisco gives AES_CM_128_HMAC_SHA1_80 as the only SRTP key supported for secure media in Webex Calling.

   Security requirements for Webex Calling · Requirements for SIP and media table, SRTP row · Checked 2026-09-16
8. 8
   A certificate-based Local Gateway must be directly reachable from the internet at a public IPv4 address, using 1-to-one static NAT if the gateway itself holds a private address.

   Configure trunks, route groups, and dial plans for Webex Calling · Network and certificate requirements · Checked 2026-09-04
9. 9
   Registration-based Local Gateway signalling is established outbound only from the enterprise to Webex Calling over SIP with TLS, so no inbound firewall rule is required.

   Cisco Preferred Architecture for Webex Calling — Design Overview · Registration-based Local Gateway, pages 22-23 · Checked 2026-09-04
10. 10
    On a registration-based Local Gateway trunk the firewall opens inbound pinholes from the gateway's outbound registration messages, and Cisco recommends opening them for all Webex Calling IP addresses and ports rather than only for the address and port the gateway registers to.

    Get started with Local Gateway · Table 2 Compare trunking models, Network firewall and NAT requirements row, registration-based column · Checked 2026-09-15

Documents

Cite this page

WarmTransfer. (2026, September 16). Firewall ports and IP ranges for cloud calling. WarmTransfer. https://warmtransfer.net/knowledge/firewall-ports-uc

@misc{warmtransfer-firewall-ports-uc,
  title  = {Firewall ports and IP ranges for cloud calling},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/firewall-ports-uc},
  note   = {Verified 2026-09-16}
}