Installation, updates & backup
Firewall and port overview
Which connections your firewall must allow for EasyUC, by direction and module.
What it is for
EasyUC runs in your network and talks to users, CUCM, Microsoft Teams and a few auxiliary systems. This overview lists the connections that a firewall between EasyUC and these systems must allow. Ports that are only used inside the cluster are not listed.
Which rows you need depends on the installed modules. Without the Teams module all rows for Microsoft are dropped; without ACD the media ports of the ACD media service.
Prerequisites
- The IP addresses of all nodes of the appliance.
- The installed modules (CUCM, ACD, Teams).
- The addresses of the connected systems: CUCM publisher and CTI Manager, Unity Connection, time source, DNS, mail server, backup server.
- For Teams: a public IP address or 1:1 NAT to the node the SBC runs on.
Step by step
Fields and options: inbound to EasyUC
| Field / action | Meaning and use |
|---|---|
| TCP 443 | From users, administrators, agents and CUCM. HTTPS for administration, end-user portal, agent workplace, Manager, APIs and CURRI. All modules. |
| TCP 80 | Optional. HTTP; no automatic redirect to HTTPS is configured. |
| TCP 15222 | From administrator workstations and between the nodes. SSH for node management. |
| TCP 22 | From systems that upload files, for example CUCM for CDR files. SFTP service. CUCM module, optional. |
| TCP 30091–30100 | Passive data ports of the FTP service. CUCM module, optional. |
| UDP 16384–19999 | From CUCM phones, gateways and media resources. RTP for CTI ports (announcements, ACD media). ACD module. |
| TCP 5061 (one more port per additional Teams tenant, up to 5199) | From Microsoft (52.112.0.0/14, 52.120.0.0/14). SIP over TLS for Direct Routing. Teams module. |
| UDP 20000–20999 | From Microsoft. SRTP media. Teams module. |
Fields and options: outbound from EasyUC
| Field / action | Meaning and use |
|---|---|
| TCP 8443 (as entered in the AXL address) | To the CUCM publisher. AXL, device registration, Extension Mobility. CUCM module. |
| TCP 443 / 8443 (as entered) | To Cisco Unity Connection. Voicemail administration. CUCM module. |
| TCP 2748 | To the CTI Manager of CUCM. JTAPI/CTI. CUCM and ACD modules. |
| UDP 16384–19999 | To CUCM endpoints. RTP for CTI ports. ACD module. |
| TCP 5061 | To sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com, sip3.pstnhub.microsoft.com. SIP over TLS. Teams module. |
| UDP 20000–20999 | To Microsoft. SRTP media. Teams module. |
| TCP 443 to Microsoft | login.microsoftonline.com, graph.microsoft.com and the Teams administration endpoints. Automatic tenant setup. Teams module. |
| TCP 443 to Let's Encrypt | acme-v02.api.letsencrypt.org. Certificates for the SBC. Teams module. |
| UDP 123 | To the internal time source. Time synchronisation of all nodes. |
| UDP/TCP 53 | To the DNS server. Name resolution. |
| TCP 22 (SFTP) / 21 (FTP, FTPS) | To the backup server. Transfer of backups. Optional. |
| TCP 22 (as entered) | To an SFTP server for large operating system packages and to the old system for the migration from 3.x. Optional. |
| TCP 389 / 636 | To the LDAP server. Phone book import. Optional. |
| TCP as entered | To the mail server. E-mail notifications. Optional. |
| TCP 443 to `registry.easy-uc.com` | Only for installations that obtain images online. Not needed when operating without internet access. |
Fields and options: between the nodes
| Field / action | Meaning and use |
|---|---|
| TCP 6443 | Kubernetes API and joining of new nodes. |
| TCP 2379–2380 | etcd. |
| TCP 10250 | kubelet. |
| UDP 8472 | Network of the services between the nodes (VXLAN). |
| TCP 15222 | SSH for node management. |
| Others | The storage and the image distribution use additional ports. Recommendation: do not filter between the nodes. |
Check the result and troubleshoot
- The CUCM connection can be tested successfully in the admin interface, and phones are shown as registered.
- The Manager shows all nodes as "Bereit".
- If Knoten hinzufügen fails with "Cannot establish SSH connection to …", TCP 15222 is not open between the nodes.
- If no announcements are heard on ACD calls, the media ports UDP 16384–19999 between phones or gateways and the appliance are not open.
- If the Teams trunk stays inactive, check NAT, TCP 5061 from the Microsoft networks and the certificate of the SBC.
- If time synchronisation fails in the NTP Server menu, UDP 123 to the time source is not open or the source does not answer.
- If Verbindung testen fails for the remote target, check the port to the backup server.