Voice for remote and home workers

See also

Sources

1. 1
   AnyConnect dynamic split tunnelling, which decides by FQDN whether a connection uses the tunnel, was added in AnyConnect 4.6 for Windows and Mac.

   Optimize AnyConnect Split Tunnel for Microsoft Office 365/Webex · Technote 215343 > Background / dynamic split tunneling section · Checked 2026-09-25
2. 2
   Cisco technote 215343 notes that, per Microsoft as of April 2020, Office 365 FQDNs should not be split dynamically, and uses IP-network exclusions for Microsoft 365 traffic.

   Optimize AnyConnect Split Tunnel for Microsoft Office 365/Webex · Technote 215343 > configuration notes on dynamic FQDN split for Office 365 · Checked 2026-09-25
3. 3
   47 CFR 9.16(b)(1) and (b)(2) require MLTS to be configured so 911 can be dialled directly without any prefix or extra code, and to send notification at the same time as the 911 call, without delaying it, to a place where someone is likely to see or hear it.

   47 CFR § 9.16 - General obligations for MLTS (Cornell LII republication) · 47 CFR 9.16(b)(1)-(b)(2) · Checked 2026-09-25
4. 4
   Under 47 CFR 9.16(b)(3)(i), on-premises fixed MLTS telephones had to provide automated dispatchable location no later than January 6, 2021.

   47 CFR § 9.16 - General obligations for MLTS (Cornell LII republication) · 47 CFR 9.16(b)(3)(i) · Checked 2026-09-25
5. 5
   Under 47 CFR 9.16(b)(3)(ii), from January 6, 2022 an on-premises non-fixed MLTS device must give automated dispatchable location when technically feasible, and otherwise a dispatchable location based on the end user's manual update or alternative location information.

   47 CFR § 9.16 - General obligations for MLTS (Cornell LII republication) · 47 CFR 9.16(b)(3)(ii) · Checked 2026-09-25
6. 6
   Under 47 CFR 9.16(b)(3)(iii), from January 6, 2022 an off-premises device on a multi-line telephone system must give the PSAP automatic dispatchable location if technically feasible, and otherwise either a dispatchable location based on the end user's manual update or enhanced location information, which may be coordinate-based.

   47 CFR § 9.16 - General obligations for MLTS (Cornell LII republication) · 47 CFR 9.16(b)(3)(iii) · Checked 2026-09-25
7. 7
   If a remote Teams user is on a full-tunnel VPN whose egress IP is one of the tenant's trusted IPs, a subnet-based LIS lookup can match the VPN address pool, so if that pool subnet is mapped to an office address the client could receive the office emergency location rather than the home one.inferred

   Configure dynamic emergency calling · Configure network settings (trusted IP addresses) combined with Plan for emergency calling step 2 · Checked 2026-09-25
8. 8
   Because vendor QoS guidance applies only to managed links, DSCP markings from Teams or Webex clients give no guaranteed priority on a home user's consumer broadband or ISP path.inferred

   Implement Quality of Service in Microsoft Teams · Step 1 > VPN considerations (basis for the inference) · Checked 2026-09-25
9. 9
   Microsoft (Teams) and Zoom both explicitly recommend keeping real-time media off corporate VPN tunnels, and Cisco publishes split-tunnel configuration to exclude Microsoft 365 and Webex traffic, so bypassing the VPN for media is consistent vendor guidance rather than one vendor's preference.inferred

   Prepare your organization's network for Microsoft Teams · Network optimization table > Configure split-tunnel VPN (combined with Zoom KB0065998 and Cisco technote 215343) · Checked 2026-09-25
10. 10
    Public DNS must publish _collab-edge._tls.<domain> SRV records so that endpoints outside the network can discover the Expressway-E servers for MRA.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites > Public DNS (External Domains) · Checked 2026-09-25
11. 11
    Cisco Mobile and Remote Access (MRA) through Expressway gives endpoints such as Cisco Jabber registration, call control, provisioning, messaging and presence from Unified CM while they are outside the enterprise network, without a VPN.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview > About Mobile and Remote Access · Checked 2026-09-25
12. 12
    For MRA, the external firewall must allow inbound connections to the Expressway-E on TCP 5061 (SIP), TCP 8443 (HTTPS), TCP 5222 (XMPP) and UDP 36002-59999 (media).

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites > Firewall Configuration · Checked 2026-09-25
13. 13
    Since Expressway X12.5, ICE Media Path Optimization lets MRA-registered endpoints send media directly to each other, bypassing the WAN and the Expressway servers, using host, server-reflexive or TURN relay candidates.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization > Overview · Checked 2026-09-25
14. 14
    On ICE calls over MRA, media first flows through the Expressway-E and Expressway-C and only then moves to the negotiated ICE path, so endpoints without ICE keep using the traversal path.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization (fallback / call flow paragraph) · Checked 2026-09-25
15. 15
    ICE Media Path Optimization for MRA requires TURN services turned on at the Expressway-E, a TLS-encrypted Expressway-C to Unified CM connection, Unified CM 11.5 or later in Mixed Mode or SIP OAuth mode, and MRA endpoints on a TLS-encrypted Phone Security Profile.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization > Prerequisites · Checked 2026-09-25
16. 16
    Cisco says ICE Media Path Optimization is not tested or supported with Webex Hybrid Services, Jabber Guest, Collaboration Meeting Room Cloud or Business to Business calling, and that HCS Contact Center does not support it.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - ICE Media Path Optimization · ICE Media Path Optimization > Limitations · Checked 2026-09-25
17. 17
    MRA does not support VPN links between the Expressway-C and the Unified CM services or clusters.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Overview · MRA Overview > Unsupported Deployments · Checked 2026-09-25
18. 18
    Cisco warns that the Unified CM default region's Maximum Session Bit Rate for Video Calls of 384 kbps may be too low for the expected video quality on MRA-connected devices.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - MRA Requirements and Prerequisites · MRA Requirements and Prerequisites > Bandwidth Restrictions · Checked 2026-09-25
19. 19
    The MRA guide describes Wi-Fi to LTE Call Handoff, which lets soft-client users move between Wi-Fi and LTE without dropping active calls, with Unified CM 14SU1 and later.

    Mobile and Remote Access Through Cisco Expressway Deployment Guide (X15.2) - Features and Additional Configurations · Features and Additional Configurations > Session Persistency / Wi-Fi to LTE Call Handoff · Checked 2026-09-25
20. 20
    The current Optimize IP ranges and URLs can be queried from the Microsoft 365 IP and URL web service at endpoints.office.com by filtering on category Optimize.

    Implementing VPN split tunneling for Microsoft 365 · 1. Identify the endpoints to optimize (Optimize URLs / Optimize IP address ranges queries); Example: Add all Optimize subnets into the route table · Checked 2026-09-25
21. 21
    Microsoft's Optimize endpoint category is a small set of endpoints that carries around 70-80% of Microsoft 365 traffic volume and includes the latency-sensitive Teams media endpoints; these are the endpoints to divert away from the VPN tunnel.

    Implementing VPN split tunneling for Microsoft 365 · Implement VPN split tunneling > 1. Identify the endpoints to optimize · Checked 2026-09-25
22. 22
    Microsoft's recommended remote-access change for Microsoft 365 is to move VPN clients from a forced tunnel to a forced tunnel with a small number of trusted exceptions (its split tunnel model #2).

    Implementing VPN split tunneling for Microsoft 365 · Implement VPN split tunneling (opening paragraph) · Checked 2026-09-25
23. 23
    Microsoft's route-table example lists the Teams media endpoints as 52.112.0.0/14, 52.122.0.0/15 and 2603:1063::/38.

    Implementing VPN split tunneling for Microsoft 365 · 2. Implementing split tunnel for Microsoft 365 endpoints > Example: Add Teams Media IP subnets into the route table · Checked 2026-09-25
24. 24
    Calling Plan, Operator Connect and Teams Phone Mobile users in the US or Canada can call 933 to reach a test bot that reads back their calling line ID, emergency address and whether a real call would be routed to the PSAP automatically or screened first; Direct Routing customers must ask their ERSP for a test service.

    Configure dynamic emergency calling · Test emergency calling · Checked 2026-09-25
25. 25
    Microsoft lists Teams one-to-one audio bandwidth per endpoint as 10/10 kbps minimum, 58/58 kbps recommended and 76/76 kbps for best performance (up/down).

    Prepare your organization's network for Microsoft Teams · Bandwidth requirements table > Audio > One-to-one · Checked 2026-09-25
26. 26
    Microsoft's recommended initial Teams QoS setting for audio is client source ports 50000-50019 (TCP/UDP) marked DSCP 46 (Expedited Forwarding).

    Implement Quality of Service in Microsoft Teams · Step 3. Choose initial port ranges for each media type > Recommended initial port ranges table · Checked 2026-09-25
27. 27
    When bandwidth is insufficient, Teams prioritises audio quality over video quality.

    Prepare your organization's network for Microsoft Teams · Bandwidth requirements (first paragraph) · Checked 2026-09-25
28. 28
    Microsoft notes that a VPN can give remote locations a managed connection but adds packet overhead and delay to real-time traffic, and recommends against running real-time communications over a VPN.

    Implement Quality of Service in Microsoft Teams · Step 1. Make sure your network is ready > VPN considerations (second paragraph) · Checked 2026-09-25
29. 29
    For Teams media to follow the intended route in all VPN scenarios, Microsoft requires Teams client version 1.3.00.13565 or later.

    Securing Teams media traffic for VPN split tunneling · Configuration > Important callout · Checked 2026-09-25
30. 30
    Microsoft states that cloud proxy service deployments that modify the source IP addresses of Teams clients do not support network configuration setting lookups.

    Configure dynamic emergency calling · Configure network settings > Important callout · Checked 2026-09-25
31. 31
    For Teams Direct Routing emergency calls, the SBC must have PidfloSupported set to True, and the tenant must connect to an Emergency Routing Service provider (US and Canada) or configure the SBC for an ELIN application.

    Configure dynamic emergency calling · Emergency calling prerequisites for Direct Routing; Set up an Emergency Routing Service provider · Checked 2026-09-25
32. 32
    Microsoft Calling Plans, Operator Connect partners and Teams Phone Mobile partners provide dynamic emergency routing for users in the United States and Canada.

    Configure dynamic emergency calling · Plan for emergency calling (closing paragraphs) · Checked 2026-09-25
33. 33
    The Microsoft article says Microsoft Edge 96 and later supports VPN split tunnelling for peer-to-peer traffic, and that the Teams web client on Edge needs an extra step involving the Edge WebRtcRespectOsRoutingTableEnabled policy (the article says to disable it).

    Securing Teams media traffic for VPN split tunneling · Configuration > Note (Edge 96 and above) · Checked 2026-09-25
34. 34
    Teams dynamic emergency calling matches the client's network against the Location Information Service in this order and uses the first match: wireless access point, Ethernet switch/port, Ethernet switch, subnet.

    Configure dynamic emergency calling · Plan for emergency calling, step 2 · Checked 2026-09-25
35. 35
    Microsoft says Teams media can still traverse the VPN tunnel even with the correct routes in place, and that a firewall rule blocking the Teams IP subnets or ports from using the VPN should then suffice.

    Securing Teams media traffic for VPN split tunneling · Configuration (third paragraph) · Checked 2026-09-25
36. 36
    Teams media traffic has no URL, so VPN split-tunnel routing for Teams media must be controlled by IP subnets rather than URL- or FQDN-based rules.

    Securing Teams media traffic for VPN split tunneling · Configuration (second paragraph) · Checked 2026-09-25
37. 37
    Microsoft's security argument for split tunnelling Teams media is that the media is already encrypted with SRTP, using a session key exchanged over the TLS-secured signalling channel.

    Securing Teams media traffic for VPN split tunneling · Configuration > Security · Checked 2026-09-25
38. 38
    Some changes to Teams network settings, such as a new address or network identifier, can take up to four hours to reach Teams clients.

    Configure dynamic emergency calling · Configure network settings (paragraph before the subnet Note) · Checked 2026-09-25
39. 39
    Teams QoS works as expected only when it is implemented on every link between callers; when a user signs in remotely, traffic can be prioritised only within the organisation's own managed network.

    Implement Quality of Service in Microsoft Teams · Step 1. Make sure your network is ready > VPN considerations · Checked 2026-09-25
40. 40
    Mac, iOS and Android Teams clients use fixed, non-configurable DSCP values, but QoS marking must still be turned on globally in the Teams admin center ('Insert Quality of Service (QoS) markers for real-time media traffic').

    Implement Quality of Service in Microsoft Teams · Step 4. Implement QoS settings (bullets 1 and 3) · Checked 2026-09-25
41. 41
    Microsoft recommends giving Teams traffic an alternate path that bypasses the VPN (split-tunnel VPN), saying this improves Teams quality and reduces load on VPN devices.

    Prepare your organization's network for Microsoft Teams · Network optimization table > Configure split-tunnel VPN · Checked 2026-09-25
42. 42
    Teams signalling runs over HTTPS, is categorised Allow rather than Optimize, and Microsoft says it can safely be routed through the VPN.

    Securing Teams media traffic for VPN split tunneling · Configuration (paragraph after the Important callout) · Checked 2026-09-25
43. 43
    Microsoft suggests three ways to confirm Teams media is using the local internet path: the Microsoft 365 connectivity test, a tracert to worldaz.tr.teams.microsoft.com that shows the local ISP path, and a packet capture showing UDP to an IP in the Teams Optimize range during a call.

    Securing Teams media traffic for VPN split tunneling · Configuration > Testing · Checked 2026-09-25
44. 44
    Teams attempts subnet-based dynamic policy or location lookups only when the user's external IP address matches one of the tenant's trusted IP addresses; switch/port and wireless access point BSSID lookups are made regardless of that match.

    Configure dynamic emergency calling · Configure network settings (Trusted IP addresses paragraph and following Note) · Checked 2026-09-25
45. 45
    Microsoft advises that firewalls must not change the mapped NAT addresses or ports for UDP during a Teams session.

    Prepare your organization's network for Microsoft Teams · Network optimization table > Maintain session persistence · Checked 2026-09-25
46. 46
    Microsoft's reasons for keeping Teams off the VPN are that VPNs are usually not designed for real-time media, some do not support the UDP that Teams requires, they add a second layer of encryption, they hairpin traffic, and they can send traffic to a service front door further from the user.

    Prepare your organization's network for Microsoft Teams · Network optimization table > Configure split-tunnel VPN (Other reasons list) · Checked 2026-09-25
47. 47
    Teams dynamic emergency calling, including security desk notification, is not supported on the Teams web client; Microsoft suggests a calling policy with Web PSTN calling turned off for web-client users.

    Configure dynamic emergency calling · Supported clients > second Note · Checked 2026-09-25
48. 48
    For Wi-Fi carrying Teams media, Microsoft advises QoS or Wi-Fi Multimedia (WMM), preferring the 5 GHz band over the congested 2.4 GHz band, band steering on dual-band networks, and non-overlapping channels on neighbouring access points.

    Prepare your organization's network for Microsoft Teams · Network optimization table > Optimize WiFi · Checked 2026-09-25
49. 49
    For Webex Calling, Webex App audio uses source ports UDP 8500-8599 marked Expedited Forwarding (DSCP 46), and MPP phones and Room Series devices use UDP 19560-19661 for media.

    Port Reference Information for Webex Calling · Quality of Service (QoS)/Type of Service (ToS) table · Checked 2026-09-25
50. 50
    Webex Calling enhanced emergency calling applies to US and Canada locations; locations in other countries keep using PSTN-based emergency calling.

    Enhanced Emergency Calling for Webex Calling · Availability / country scope · Checked 2026-09-25
51. 51
    HELD+-capable Webex devices, including the Webex App, report their network environment for emergency location using the upstream LLDP switch, wireless access point BSSID, IP address or upstream gateway default MAC address; devices without HELD rely on the Caller ID asserted in the call.

    Enhanced Emergency Calling for Webex Calling · Dynamic location detection (HELD+ capable and non-HELD devices) · Checked 2026-09-25
52. 52
    Webex services use ports 5004 and 9000 with SRTP over UDP for encrypted audio, video and content sharing, and fall back to TCP and then TLS when UDP cannot be used.

    Network Requirements for Webex Services · Webex Services - Port Numbers and Protocols table · Checked 2026-09-25
53. 53
    Cisco's Webex Calling enhanced emergency calling integration does not support VPN-based location detection; Webex desktop ignores VPN and virtual network interfaces, and wiremap entries should use network elements other than VPN configurations.

    Enhanced Emergency Calling for Webex Calling · Network discovery notes (VPN note) and wiremap configuration guidance · Checked 2026-09-25
54. 54
    With Webex Calling enhanced emergency calling, when a nomadic user takes the Webex App off-premises, the app prompts the user to enter a dispatch address, and it reuses that address automatically when the user reconnects to the same network.

    Enhanced Emergency Calling for Webex Calling · Nomadic E911 service description · Checked 2026-09-25
55. 55
    If the Webex Calling E911 service cannot find a dispatchable location for a device that places an emergency call, the call goes to an emergency calling relay center.

    Enhanced Emergency Calling for Webex Calling · Unknown-location call handling · Checked 2026-09-25
56. 56
    Cisco recommends UDP for Webex media, with a preference order of UDP, then TCP, then TLS, and strongly recommends against TLS for media in production because of possible quality loss, including proxy bottlenecks.

    Network Requirements for Webex Services · Media traffic; Disadvantages of using TLS as a media transport protocol · Checked 2026-09-25
57. 57
    Zoom says that sending Zoom traffic through the VPN makes it enter the corporate network only to leave again for the Zoom cloud, adding significant load to corporate internet links and VPN concentrators and often overloading or congesting them.

    VPN Split Tunneling Recommendations · VPN Split Tunneling Recommendations (rationale paragraphs) · Checked 2026-09-25
58. 58
    Zoom recommends split tunnelling Zoom traffic around the VPN, allowing UDP 8801-8810 and TCP 443 to *.zoom.us and *.zoom.com, or to Zoom's IP ranges where the firewall needs them.

    VPN Split Tunneling Recommendations · VPN Split Tunneling Recommendations (allowed ports and destinations) · Checked 2026-09-25

Documents

Cite this page

WarmTransfer. (2026, September 25). Voice for remote and home workers. WarmTransfer. https://warmtransfer.net/knowledge/remote-worker-voice

@misc{warmtransfer-remote-worker-voice,
  title  = {Voice for remote and home workers},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/remote-worker-voice},
  note   = {Verified 2026-09-25}
}