Cisco Cisco TelePresence Video Communication Server Expressway
Appendix 3 – Firewall and NAT configuration
Cisco VCS Basic Configuration (Control with Expressway) Deployment Guide
Page 54 of 69
Appendix 3 – Firewall and NAT configuration
Internal firewall configuration
In many deployments outbound connections (from internal network to DMZ) will be permitted by the
NAT/firewall device. If the administrator wants to restrict this further, the following tables provide the
permissive rules required. For further information, see VCS IP port usage for firewall traversal.
NAT/firewall device. If the administrator wants to restrict this further, the following tables provide the
permissive rules required. For further information, see VCS IP port usage for firewall traversal.
Outbound (Internal network > DMZ)
Purpose
Source
Dest.
Source
IP
IP
Source
port
port
Transport
protocol
protocol
Dest. IP
Dest. port
Management
Management
computer
computer
VCSe As
required
>=1024
TCP
192.0.2.2 80 / 443 / 22 / 23
SNMP
monitoring
monitoring
Management
computer
computer
VCSe As
required
>=1024
UDP
192.0.2.2 161
H.323 traversal calls using Assent
RAS Assent
VCSc
VCSe Any
1719
UDP
192.0.2.2 6001
Q.931/H.225
and H.245
and H.245
VCSc
VCSe Any
15000 to
19999
19999
TCP
192.0.2.2 2776
RTCP Assent
VCSc
VCSe Any
50000 to
54999
54999
UDP
192.0.2.2 2777
RTP Assent
VCSc
VCSe Any
50000 to
54999
54999
UDP
192.0.2.2 2776
SIP traversal calls
SIP TCP/TLS
VCSc
VCSe 10.0.0.2
25000 to
29999
29999
TCP
192.0.2.2 Traversal zone
ports, e.g. 7001
RTCP Assent
VCSc
VCSe 10.0.0.2
50000 to
54999
54999
UDP
192.0.2.2 2777
RTP Assent
VCSc
VCSe 10.0.0.2
50000 to
54999
54999
UDP
192.0.2.2 2776
As VCS Control to VCS Expressway communications are always initiated from the VCS Control to the VCS
Expressway (VCS Expressway sending messages by responding to VCS Control’s messages) no ports
need to be opened from DMZ to Internal for call handling.
Expressway (VCS Expressway sending messages by responding to VCS Control’s messages) no ports
need to be opened from DMZ to Internal for call handling.
n
Ensure that any SIP or H.323 ‘fixup’ ALG or awareness functionality is disabled on the NAT firewall – if
enabled this will adversely interfere with the VCS functionality.
enabled this will adversely interfere with the VCS functionality.
n
If a Cisco TMS server and a Syslog logging server are deployed (see the
section) then the following NAT configuration is required: