SIP
TLS, and ports that are not universal
ITSP trunks, your SBC, gateways, bandwidth, NAT, and the ports that belong only to Studio.
SIP and carriers ยท advanced ยท 12 min full read
Unencrypted APIs are not the story. TLS 1.2 is required. TLS 1.1 is not supported. The requirements also list TLS 1.3 inbound ciphers: AES-128-GCM, AES-256-GCM, and CHACHA20.
- Require TLS 1.2
- Keep Studio ports in the Studio box
Studio portal hosts and Studio SIP ports live in the Studio section of that PDF: UDP 5060, TCP 5061 described as beta, proxy UDP 5189 and TCP 5161, a legacy UDP 5188, plus RTP ranges. Do not paste those Studio numbers onto every VCC ITSP trunk. If the trunk guide does not say them, they are not the trunk.
Studio media is not every VCC trunk.
Label the rule
Write one firewall line for TLS and one for Studio, and refuse to merge them.
- TLS 1.2
- Studio ports marked Studio
- A note that the trunk guide is separate
The two rules have different names.
- TLS floor? 1.2.
- TLS 1.1? Not supported.
- Studio 5060 on every trunk? No.
- 5061 caveat? Beta in that PDF.
- Technical requirements PDF. vendor. last checked 2026-10. Fetched for this lab in October 2026. Re-read before you buy hardware or open a firewall.
- SIP trunk options chapter. vendor. last checked 2026-10.
- IANA service names and port numbers. ports. last checked 2026-10.
- RFC 3261, SIP: Session Initiation Protocol. rfc. last checked 2026-10.
- RFC 3550, RTP. rfc. last checked 2026-10.
- RFC 3551, RTP profile for audio and video. rfc. last checked 2026-10.
- ITU-T G.711. standard. last checked 2026-10.
- RFC 8446, TLS 1.3. rfc. last checked 2026-10.
- RFC 9293, Transmission Control Protocol. rfc. last checked 2026-10.
- RFC 768, User Datagram Protocol. rfc. last checked 2026-10.
- confirm. Studio TCP 5061 is described as beta in the PDF read for this lab. Confirm before you depend on it. last checked 2026-10.
Glossary. Skill group: Agents or supervisors who can take a campaign's work. A user and a campaign can have more than one. Skill groups
Sister technologies. Zoom Phone and Microsoft Teams. Named prebuilt connections. A local UC client is also about 320 kbps. APIs and SDKs
Config. Write one firewall line for TLS and one for Studio, and refuse to merge them.
Troubleshooting. The floor is 1.2. Restore a supported TLS version.
Cross-platform bridge. A mapping to another PBX or contact center is a teaching bridge. It is not an import button.
Future hook. The guide's cloud endpoint stays unset. Confirm before relying on a dated catalog or a case-study number.