The network path is part of the product

About five minutes of reading

Connect's softphone is WebRTC in the agent's browser. A firewall designed for a desk phone will block it.

Option 1 is a domain allow list: the instance on TCP 443, telemetry, transport, and TurnNlb on UDP 3478. Option 2 is the AWS IP ranges and is documented as not recommended. Test more than 200 calls. An error rate above 2 percent points at proxy or DNS resolution.

Media should not hairpin through a VPN. Stateless firewalls also need the browser's ephemeral UDP range, because there is no lasting 'pin' the way people imagine.

• The usual failure string names turn:TurnNlb and port 3478.
• ice_collection_timeout means the browser never gathered candidates.
• A custom CCP can be media-less, but then you still do not have a softphone.
• Video adds a Chime subnet and does not support VDI.

Number on this page: UDP 3478. Outbound to TurnNlb

Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.

Picture from this room.

1. Allow. Domains and 3478.
2. Avoid. VPN on the media path.
3. Test. Endpoint Connectivity tool.
4. Count. Errors under 2 percent.

What usually goes wrong: Opening TCP 443 and declaring the softphone done.

Set up your network to use the Connect Customer Contact Control Panel (CCP) - Amazon Connect Customer AWS docs. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Glossary

• Contact One interaction: a call, chat, task, or email. A transfer usually creates another contact linked by PreviousContactId and NextContactId.
• Connect Customer The name used from 28 Apr 2026 for the contact center product previously called Amazon Connect.
• CloudWatch Metrics and flow logs. Alarm at 80 percent of a quota, which is the operations guidance in the email quota note.
• Kinesis Data Streams The durable stream for CTRs and agent events when more than one consumer must read them.

Mind map

Open the Foundations mind map

Sister technologies

A flow fails in IAM, a Region, a log group, or a network rule long before it fails as a 'Connect bug'.

Config and troubleshooting

Opening TCP 443 and declaring the softphone done.

IAM, Lambda, S3, Kinesis, and CloudWatch are not inside the instance. This stack creates the instance and turns on flow logs and Contact Lens.

CfnInstance AWS::Connect::Instance

AWSTemplateFormatVersion: "2010-09-09"
Description: Connect instance with flow logs and Contact Lens
Resources:
  CampusInstance:
    Type: AWS::Connect::Instance
    Properties:
      IdentityManagementType: SAML
      InstanceAlias: campus-demo
      Attributes:
        InboundCalls: true
        OutboundCalls: true
        ContactflowLogs: true
        ContactLens: true

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.