Cisco Cisco TelePresence Video Communication Server Expressway
Appendix 3: Firewall and NAT settings
Internal firewall configuration
In many deployments outbound connections (from internal network to DMZ) will be permitted by the
NAT/firewall device. If the administrator wants to restrict this further, the following tables provide the
permissive rules required. For further information, see
NAT/firewall device. If the administrator wants to restrict this further, the following tables provide the
permissive rules required. For further information, see
Ensure that any SIP or H.323 ‘fixup’ ALG or awareness functionality is disabled on the NAT firewall – if
enabled this will adversely interfere with the VCS functionality.
enabled this will adversely interfere with the VCS functionality.
Outbound (Internal network > DMZ)
Purpose
Source
Dest.
Source
IP
IP
Source
port
port
Transport
protocol
protocol
Dest. IP
Dest. port
Management
Management
computer
computer
VCSe As
required
>=1024
TCP
192.0.2.2 80 / 443 / 22 / 23
SNMP
monitoring
monitoring
Management
computer
computer
VCSe As
required
>=1024
UDP
192.0.2.2 161
H.323 traversal calls using Assent
RAS Assent
VCSc
VCSe Any
1719
UDP
192.0.2.2 6001
Q.931/H.225
and H.245
and H.245
VCSc
VCSe Any
15000 to
19999
19999
TCP
192.0.2.2 2776
RTP Assent
VCSc
VCSe Any
36002 to
59999 *
59999 *
UDP
192.0.2.2 36000 *
RTCP Assent
VCSc
VCSe Any
36002 to
59999 *
59999 *
UDP
192.0.2.2 36001 *
SIP traversal calls
SIP TCP/TLS
VCSc
VCSe 10.0.0.2
25000 to
29999
29999
TCP
192.0.2.2 Traversal zone
ports, e.g. 7001
RTP Assent
VCSc
VCSe 10.0.0.2
36002 to
59999 *
59999 *
UDP
192.0.2.2 36000 *
RTCP Assent
VCSc
VCSe 10.0.0.2
36002 to
59999 *
59999 *
UDP
192.0.2.2 36001 *
* The default media port range of 36000 to 59999 applies to new installations of X8.1 or later. The first 2 ports
in the range are used for multiplexed traffic only (with Large VM deployments the first 12 ports in the range –
36000 to 36011 – are used). The previous default range of 50000 - 54999 still applies to earlier releases that
have upgraded to X8.1.
in the range are used for multiplexed traffic only (with Large VM deployments the first 12 ports in the range –
36000 to 36011 – are used). The previous default range of 50000 - 54999 still applies to earlier releases that
have upgraded to X8.1.
Inbound (DMZ > Internal network)
As VCS Control to VCS Expressway communications are always initiated from the VCS Control to the VCS
Expressway (VCS Expressway sending messages by responding to VCS Control’s messages) no ports
need to be opened from DMZ to Internal for call handling.
Expressway (VCS Expressway sending messages by responding to VCS Control’s messages) no ports
need to be opened from DMZ to Internal for call handling.
Cisco VCS Basic Configuration (Control with Expressway) Deployment Guide
Page 51 of 65
Appendix 3: Firewall and NAT settings