CUCM 15
Firewall matrix
Direction is from the session originator toward the listener, as the port chapter draws it. Administrators can change numbers. Cisco does not recommend that. Open the chapter for the release you run.
| From | To | Port | Why it is open |
|---|---|---|---|
| Phone | CUCM | 69/UDP then ephemeral | TFTP |
| Phone | CUCM | 6970/TCP | HTTP configuration and firmware |
| Phone | CUCM | 5060 TCP/UDP, 5061/TCP | SIP and SIP TLS |
| Phone | CUCM | 2000/TCP, 2443/TCP | SCCP and secure SCCP |
| Phone | CUCM | 3804/TCP | CAPF |
| Gateway | CUCM | 2427/UDP | MGCP |
| Gateway | CUCM | 1720/TCP | H.225 |
| Phone or gateway | Phone or gateway | 16384–32767/UDP | RTP and SRTP. CUCM's own range in the chapter is 24576–32767. |
| CUCM | LDAP | 389, 636, 3268, 3269/TCP | Directory |
| Application | CUCM | 2748/TCP, 2749/TCP | CTI and CTI over TLS |
| Application | CUCM | 8443/TCP | AXL / SOAP |
| Gateway | CUCM | 8090/TCP | Gateway recording HTTP |
| CUCM | CSSM | 443/HTTPS | Smart Licensing usage |
| CUCM | NTP | 123/UDP | Time |
| Browser | CUCM | 443, 8443/TCP | Administration |
Ephemeral ports on the node are 32768–61000 and the chapter says they need to stay open for phones to remain registered. Multicast music-on-hold uses the ports you configure. They are not in this matrix on purpose.