Ports and firewall
Which connections EasyUC needs inbound, outbound and between nodes, filterable by module.
This reference lists the ports to allow for EasyUC in firewalls. The Module column shows what a rule is needed for. all means every deployment. optional means only if you use the function named.
Note
Ports marked Default are defaults of K3s, Cisco or Microsoft that EasyUC does not configure itself. Everything else comes from the current EasyUC configuration.
Filter by module
Entries for all deployments and for the base system stay visible under CUCM, ACD and Teams.
Inbound to EasyUC
| Protocol | Port | Source | Purpose | Module |
|---|---|---|---|---|
| TCP | 443 | Users, admins, agents, CUCM | HTTPS: admin interface, end-user portal, agent workplace, Manager, APIs, CURRI | all |
| TCP | 80 | Users (optional) | HTTP via Traefik. No automatic redirect to HTTPS is configured. | all |
| TCP | 15222 | Admin workstation, other cluster nodes | SSH for node management. The Manager adds nodes via SSH. | Base |
| TCP | 22 | Systems uploading files | SFTP upload service (proftpd) | CUCMoptional |
| TCP | 30091–30100 | Systems uploading files | Passive FTP data ports of the upload service | CUCMoptional |
| UDP | 16384–19999 | CUCM phones, gateways, media resources | RTP for CTI ports: announcements, ACD media | ACD |
| TCP | 5061+1 per additional Teams tenant, up to 5199 | Microsoft 52.112.0.0/14, 52.120.0.0/14 | SIP over TLS (mutual TLS), Direct Routing | Teams |
| UDP | 20000–20999 | Microsoft media | SRTP media | Teams |
| No entries for this filter. | ||||
Important
The Teams SBC needs a public IP address or a 1:1 NAT to the node where teams-sbc runs. There is no shared virtual IP. Plan the NAT so that you can move it to another node after a failure, see Redundancy.
SIP connections from Microsoft come from the networks 52.112.0.0/14 and 52.120.0.0/14.
52.112.0.0/14
52.120.0.0/14Outbound from EasyUC
| Protocol | Port | Destination | Purpose | Module |
|---|---|---|---|---|
| TCP | 8443as entered in the AXL URL | CUCM publisher | AXL, RISPort (device registration), Extension Mobility | CUCM |
| TCP | 443 / 8443as entered | Cisco Unity Connection | CUPI (voicemail) | CUCM |
| TCP | 2748 Default | CUCM CTI Manager | JTAPI/CTI | CUCMACD |
| UDP | 16384–19999 | CUCM endpoints | RTP for CTI ports | ACD |
| TCP | 5061 | sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com, sip3.pstnhub.microsoft.com | SIP over TLS, OPTIONS | Teams |
| UDP | 20000–20999 | Microsoft media | SRTP | Teams |
| TCP | 443 | login.microsoftonline.com, graph.microsoft.com and Microsoft Teams admin endpoints | Automated tenant setup via PowerShell | Teams |
| TCP | 443 | acme-v02.api.letsencrypt.org | Let's Encrypt for SBC certificates | Teams |
| TCP | 443 | api.cloudflare.com | Automatic DNS-01, only if Cloudflare is used | Teamsoptional |
| TCP | 443 | registry.easy-uc.com | Loading images online. Not needed for updates by package file. | Baseoptional |
| TCP | 389 / 636 | LDAP server | Phonebook import | ACDoptional |
| TCP | as configured | SMTP server | E-mail notifications | Baseoptional |
| TCP | 22 / 2122 for SFTP, 21 for FTP and FTPS | Backup server | Remote backups: database backup and full backup | Baseoptional |
| UDP | 123 | internal NTP servers | Time synchronisation. You enter the servers in the console menu. | Base |
| UDP/TCP | 53 | DNS server | Name resolution, DNS-01 record check | Base |
| TCP | 443 | api.elevenlabs.io | Only if the optional cloud voices are enabled. Local speech synthesis needs no internet. | ACDoptional |
| No entries for this filter. | ||||
sip.pstnhub.microsoft.com
sip2.pstnhub.microsoft.com
sip3.pstnhub.microsoft.comNote
You enter the time source in the appliance's console menu under NTP Server, the same one on every node. Use internal servers; public NTP servers are not needed. Do not run the hypervisor's time synchronisation and NTP at the same time.
Between cluster nodes
You only need these connections with more than one node.
| Protocol | Port | Direction | Purpose | Module |
|---|---|---|---|---|
| TCP | 6443 | between all nodes | Kubernetes API, node join | Base |
| TCP | 2379–2380 Default | between all nodes | etcd | Base |
| TCP | 10250 Default | between all nodes | kubelet | Base |
| UDP | 8472 Default | between all nodes | Flannel VXLAN, pod network | Base |
| TCP | 15222 | between all nodes | SSH, node management | Base |
| – | further Default | between all nodes | Longhorn replication and the embedded registry use further internal ports | Base |
| No entries for this filter. | ||||
Tip
Recommendation, as in the installation guide: no firewall filtering between cluster nodes, and all nodes in the same network segment. EasyUC does not use Kubernetes NetworkPolicies.
Local on the node
These ports need no firewall rule. They must, however, be free on the node where teams-sbc and acd-media run, because both use the host network.
| Protocol | Port | Node | Purpose | Module |
|---|---|---|---|---|
| TCP | 8021 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| UDP | 9060 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| UDP | 15060 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| UDP | 15080 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| UDP | 24000–24999 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| TCP | 8099 | Node running acd-media and teams-sbc | must be free | ACDTeams |
| No entries for this filter. | ||||