Firewall configuration

Firewall configuration

In this section

Version history
 Expand | Collapse

Version Date Comment
Current Version (v. 14) Jun 29, 2022 13:18 Helen Griffith:
Added fully qualified domain names (FQDN) to 'Using URL allowlisting (recommended)' section
v. 13 Feb 14, 2022 14:44 Helen Griffith
Added *.vonage.com and *.cc.vonage.com to list of URLs to allow list
v. 12 Feb 08, 2022 08:50 Helen Griffith
Renamed USA-->NAM, updated NAM section with additional addresses, removed outbound IPs
v. 11 Feb 08, 2022 08:49 Helen Griffith
Reverted from v. 8
v. 10 Feb 08, 2022 08:47 Helen Griffith
v. 9 Feb 08, 2022 08:44 Helen Griffith
v. 8 Oct 25, 2021 10:26 Helen Griffith
Removed decommissioned data centers
v. 7 Mar 15, 2021 08:52 Helen Griffith
Added *nexmo.com to list of URLs to allowlist
v. 6 Dec 15, 2020 10:51 Helen Griffith
Added version history section
v. 5 Oct 28, 2020 14:35 Helen Griffith
v. 4 Oct 19, 2020 13:23 Helen Griffith
v. 3 Oct 15, 2020 06:46 Helen Griffith
Removed ambiguous and superfluous sentence from Cloudfront section
v. 2 Oct 14, 2020 10:35 Helen Griffith
Fixing typo in Amplitude URL
v. 1 Sep 28, 2020 13:11 Helen Griffith


You must read this entire section to ensure that you configure your firewall correctly.

We recommend adding the appropriate URLs and IP addresses to any firewall rules that restrict employee access, and we request that you treat Vonage Contact Center as a business critical application. By this, we mean optimizing and prioritizing IP traffic to Vonage Contact Center over other non-critical traffic. This is to ensure real-time responses to agent requests (call steering buttons, call transfers, hold requests, and so on).

You should also review any IP packet inspection or local caching policies to optimize the user experience.

Ports

Outbound

All outbound traffic requires TCP port 443 (HTTPS). Responses are sent to a range of ephemeral ports. This requirement applies to:

  • VCC traffic, regardless of whether you use URL or IP allowlisting
  • VCC APIs
  • WebRTC traffic (see WebRTC sections later in this page for information about other ports required for WebRTC traffic)
  • All other third-party traffic (Amplitude, Cloudfront, and NewRelic)

SFTP access to call recordings requires TCP port 22.

Inbound

All inbound traffic requires access to destination TCP port 443 (HTTPS) on our servers to establish a connection. Responses are sent to a range of ephemeral ports.

Virtual private network (VPN)

We recommend using a split tunnel configuration to ensure that traffic—especially voice traffic—to Vonage services is routed directly from the end user to our platform and not through a VPN. We do not recommend tunneling voice connectivity through a VPN tunnel due to the potential adverse effect on voice quality.



Using URL allowlisting (recommended)

Depending on whether you will use wildcard or fully qualified domain names, add the following URLs to your allowlist:

You must also add the IP addresses specified in the following sections to your allowlist:

Inbound VCC traffic

Inbound IP addresses are used when Vonage Contact Center interacts with an external system where IP allowlisting is in place. Such systems include Salesforce; a customer-owned or managed server or service; and other cloud provider services.

VCC region

IP addresses (inbound)

EMEA

3.10.100.255
35.177.29.140
3.126.229.159
18.184.245.197

NAM

54.208.98.242
54.209.40.204
54.219.131.57
54.219.131.71
3.222.22.251 (new)
3.210.155.126 (new)
35.86.33.112 (new)
54.68.201.219 (new)

APAC

54.252.173.50
54.252.187.75
54.254.137.133
54.254.157.106

WebRTC traffic

Your firewall settings should allow outbound traffic as specified in the following list:

Also you must add all the IP addresses listed in the following pages to your allowlist:

If your agents use VPN clients, you must also add *.nexmo.com to your allowlist; failure to do so may result in agents not being able to use WebRTC.
Where relevant, you must also add *.nexmo.com to the VPN's proxy bypass list and then restart your agents' clients. 



Using IP allowlisting

If your firewall does not support URL or DNS allowlisting, add the following IP addresses for your region to any existing firewall permissions.

Inbound VCC traffic

Inbound IP addresses are used when Vonage Contact Center interacts with an external system where IP allowlisting is in place. Such systems include Salesforce; a customer-owned or managed server or service; and other cloud provider services.

VCC region

IP addresses (inbound)

EMEA

3.10.100.255
35.177.29.140
3.126.229.159
18.184.245.197

NAM

54.208.98.242
54.209.40.204
54.219.131.57
54.219.131.71
3.222.22.251 (new)
3.210.155.126 (new)
35.86.33.112 (new)
54.68.201.219 (new)

APAC

54.252.173.50
54.252.187.75
54.254.137.133
54.254.157.106

Outbound VCC traffic

Outbound IP addresses

Outbound IP addresses are used for standard web access, for example, agents and supervisors accessing Vonage Contact Center applications. All customers will need to allow outbound IP addresses.

If your firewall does not support URL/DNS allowlisting, add the following IP addresses for your region to any existing firewall permissions:

--Amazon Web Services (AWS)

Most of VCC uses Amazon Web Services (AWS).

Add the IP addresses for your region as described in the following page: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html.

This list of addresses is subject to change.

There might be multiple AWS regions associated with your VCC region:

VCC regionAWS region IDAWS region name
EMEA

eu-central-1Frankfurt

eu-west-2London
NAM

us-east-1North Virginia

us-west-1North California

us-west-2Oregon
APAC

ap-southeast-1Singapore

ap-southeast-2Sydney


--Amplitude

Add the IP addresses specified in the following page to any existing firewall permissions:

--Cloudfront

Add the IP addresses specified in the following page to any existing firewall permissions:

Inbound addresses

The IP addresses are all outbound addresses.

--NewRelic

Add this range of IP addresses—162.247.240.0/22—to any existing firewall permissions.

Inbound addresses

The IP addresses are all outbound addresses.

--WebRTC traffic

Your firewall settings should allow outbound traffic as specified in the following list:

Also you must add all the IP addresses listed in the following pages to your allowlist:

If your agents use VPN clients, you must also add *.nexmo.com to your allowlist; failure to do so may result in agents not being able to use WebRTC.
Where relevant, you must also add *.nexmo.com to the VPN's proxy bypass list and then restart your agents' clients.