Lab / Ports
Ports and protocols
Taken from the Webex Calling port reference on 2026-10-15. The article's revision history shows the phone source range moving to 5060–5280 on September 07, 2026. IP subnets are intentionally not copied. They change, and the article says filtering by region can hurt the service.
Signaling
| Purpose | Source ports | Protocol | Destination ports |
|---|---|---|---|
| Local gateway, devices, and the app toward Calling | Gateway 8000–65535. Phones 5060–5280. Room Series and the app are ephemeral. | TCP | 5062 certificate trunk. 8934 registration trunk. |
| Calling back to a certificate local gateway | 8934 | TCP | The port you chose on the gateway. |
| Gateway toward your PSTN or Unified CM | 8000–65535 | TCP | Depends on that peer. The article's example is 5060 or 5061 for Unified CM. |
Media
| Who | Source | Toward Calling |
|---|---|---|
| Local gateway | UDP 8000–48199 | 5004, 9000, 8500–8699, 19560–65535 |
| Devices, optimized | UDP 19560–19661 | Same cloud destinations, or direct if ICE succeeds |
| Room Series | Audio 52050–52099. Video 52200–52299. | Cloud destinations |
| VG400 ATA | UDP 19560–19849 | Cloud destinations |
| Webex App, optimized | Audio 8500–8599. Video 8600–8699. | Direct when ICE succeeds |
UDP with SRTP is the production media transport. The article says TCP and TLS media are not supported in production. The PSTN media row's example cell repeats 5060 and 5061. Those are signaling ports in the row above. Do not open 5060 as RTP because that cell says so. Use the customer's media range and re-read the live row.
Emergency, DNS, time, readiness
- RedSky: port 443 to api.wxc.e911cloud.com and wxc.e911cloud.com.
- DNS: UDP and TCP 53. NTP: UDP 123.
- CScan: TCP 8934 and 443, UDP 19569–19760.
- App configuration: TCP 443 and 8443. Device configuration and firmware: TCP 443, 6970, and 80.
Ladder
SIP ALG off. NAT must translate overlapping phone source ports in 5060–5280. Default MTU 1500. Practice the ports. Open the live article.