webex calling fireqll requirement question

vijayS — Fri, 13 Jun 2025 01:12:42 GMT

I have some questions regarding the firewall rules that we need to enable for webex calling.

https://help.webex.com/en-us/article/b2exve/Port-Reference-Information-for-Webex-Calling

It says,

Whitelist or open access to the following so that the Webex Calling and Webex Aware services function correctly.

The URLs/Domains mentioned under the section Domains and URLs for Webex Calling Services

IP subnets, Ports, and Protocols mentioned under the section IP Subnets for Webex Calling Services

So I am assuming that we need to enable both? or if we enabled domain and URL then IP subnets is not required?

Also one of the rule that we need to define is,

Device time synchronization (NTP)

Webex Calling devices

51494

UDP

Refer to IP Subnets for Webex Calling Services.

123

These IP addresses are needed for Time Synchronization for Devices (MPP phones, ATAs, and SPA ATAs)

This "Refer to IP Subnets for Webex Calling Services" has 3 categories. 1.IP subnets for Webex Calling services, 2.Device configuration and firmware management, 3. Webex App configuration. which category is the one for NTP here?

Re: webex calling fireqll requirement question

wajidhassan — Tue, 01 Jul 2025 16:21:24 GMT

You're right to enable both domain/URL whitelisting and IP-subnet access—they serve different purposes and both are required for full Webex Calling functionality. Here's a clearer breakdown:

1. Domains/URLs vs. IP Subnets

Domain & URL whitelisting: Needed for accessing services like authentication, cloud APIs, firmware upgrades, etc. (e.g., webex.com, wbx2.com)
IP Subnets + Ports: Required for the actual media and signaling data flow (e.g., SIP, RTP, NTP). These are the static IP ranges used by the Webex Calling cloud infrastructure

Bottom line: You need both—domain whitelists for control-plane traffic, and IP/port rules for data-plane traffic.

2. NTP Rule Clarified

From the port reference:

Purpose Applies To Source Port Protocol Destination Destination Port Notes

Device time synchronization

Webex Calling devices

51494

UDP

Webex IP subnets

123

That "Refer to IP Subnets..." directive means the destination addresses for NTP requests are those listed in the "IP Subnets for Webex Calling Services" section

So yes, this is part of the IP Subnets for Webex Calling Services category—it’s about phones syncing time to Webex's NTP servers.

What You Should Do

Whitelist domains/URLs under the "Domains and URLs for Webex Calling Services" section.
Allow specific IP ranges and ports from the "IP Subnets for Webex Calling Services" section.
Include NTP rules:
- Source: your phones
- Protocol: UDP
- Destination: Webex IP subnets
- Destination port: 123
DNS (port 53) and NTP (port 123) for internal infrastructure should also be allowed outbound if your network uses local DNS/NTP.

topic webex calling fireqll requirement question in Webex Calling

webex calling fireqll requirement question

Re: webex calling fireqll requirement question

1. Domains/URLs vs. IP Subnets

2. NTP Rule Clarified

What You Should Do