The purpose of this document is to provide enterprises with network requirements for firewall and web proxy configuration to ensure that cloud-based Message Video Phone (MVP) unified communication services operate correctly.

2. IP supernets

The supernets (concatenated subnets) in Table 2.1 are advertised by the RingCentral cloud using the BGP routing protocol to support unified communication services over the Internet. These networks can be used to connect to the RingCentral cloud over the Internet.

Table 2.1 - Advertised IP Supernets

66.81.240.0/20

80.81.128.0/20

103.44.68.0/22

104.245.56.0/21

185.23.248.0/22

192.209.24.0/21

199.68.212.0/22

199.255.120.0/22

208.87.40.0/22

For enterprises with direct connections to RingCentral’s network (CloudConnect), additional requirements apply and RingCentral must be consulted for proper network configuration.

To ensure the proper operation of MVP services, the supernets must be accepted by the enterprise network at all locations where unified communication services are used.

These supernets must be used in the enterprise network to:

Configure firewall rules for signaling and media ports.
Configure DSCP markings in IP packet headers according to the Quality of service guidelines.
Selectively disable Layer 7 device functions such as Deep Packet Inspection for UDP traffic to/from unified communication cloud.

3. Whitelisting of domains, IP addresses, and ports

To allow the devices and applications to access supporting cloud services, domain names, IP addresses, and associated destination ports that are indicated in the following tables may need to be whitelisted in enterprise firewalls or web proxies. The destination port column indicates the port(s) on the RingCentral cloud unified communication system.

3.1 Common cloud services

Table 3.1 summarizes the domains and ports used for Common Cloud Services, which may need to be whitelisted:

Only the actual set of services that are used must be whitelisted. For example, if the Live Reports Portal is not used, the live.ringcentral.com domain does not need to be whitelisted.
The RingCentral Website, Administrator/User Account Portal, API Discovery Service, and Service Portal Domain must always be whitelisted to allow administrators and users to access general information and RingCentral services.
The RingCentral Company Website provides general information about RingCentral and products and does not require login.
The Administrator/User Account Portal is used to authenticate administrators and users to access any of the underlying communication and administration services, including MVP and Ringcentral Video (RCV).
The API Discovery Service is used for client applications to dynamically discover their correct .com and .biz API domains before the user logs in. The Discovery Service points to the Login Process service. After the Administrator/User is authenticated by the Login Service, the Discovery Service is used again to determine the appropriate API domain based on the configured account data.
Service Web Portal provides access to administration and unified communication services after authentication has been completed via the Administrator/User Account Portal.
The Analytics Login Portal provides Account Administrators insights into the RingCentral MVP system with actionable data. The corresponding domains only need to be whitelisted if this functionality is used.
The Live Report Portal gives access to an add-on service and can be used with RingCentral call queues to create a basic call center based on the MVP system.
Analytics and Live Reports Portals may be country-specific to comply with data-locality requirements.

Table 3.1 - Common Cloud Services
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Company Website	HTTPS	www.ringcentral.com	TCP\443
Service Status Portal	HTTPS	status.ringcentral.com	TCP\443
Accounts Management Portal	HTTPS	accounts.ringcentral.com	TCP\443
Administrator/User Account Portal	HTTPS	login.ringcentral.com	TCP\443
API Discovery Service	HTTPS	discovery.ringcentral.biz	TCP\443
Service Web Portal	HTTPS	service.ringcentral.com	TCP\443
Analytics Portal	HTTPS	analytics.ringcentral.com 35.190.70.192	TCP\443
Analytics Portal - Canada	HTTPS	analytics.ringcentral.ca 34.102.174.25	TCP\443
Live Reports Portal	HTTPS	live.ringcentral.com 35.190.70.192	TCP\443
Live Reports Portal - Canada	HTTPS	live.ringcentral.ca 35.201.103.66	TCP\443

3.2 Endpoints

This section provides the endpoint-specific tables for the domain names, supernets, and a range of cloud destination ports for various types of communication services traffic, including media, signaling, and registration traffic.

All sessions are initiated from an endpoint to the RingCentral cloud-based communication services. The RingCentral cloud does not initiate any session toward the customer endpoints.

The endpoint tables must be used as follows for firewall and web proxy configuration:

The endpoint tables specify the use of domain names, supernets, and a range of cloud destination ports for various purposes, including media, signaling, and registration traffic. Source ports are not specified since the port range is operating system dependent, and ports are dynamically selected.
The tables provide modular sets of requirements for firewall control to support different mixes of RingCentral endpoint deployments. The tables do not necessarily match 1-1 with RingCentral product definition since, e.g., RingCentral Video can be used as a stand-alone product and with RingCentral MVP. Therefore, a separate table is specified for RingCentral Video Mobile, desktop, and Web, which factors out the specific firewall requirements for video service.
The tables for a) RingCentral Video Mobile, Desktop, and Web, b) RingCentral Video Rooms, and RingCentral Video with Rooms Connector are specified in separate tables because a) may be deployed independently of b) and c).
For firewall configuration, only the tables for the set of endpoint types that are deployed need to be considered.
Table rows indicating Signaling/Media (without the Secured modifier) can be ignored when RingCentral has administratively configured the customer account for ‘secured signaling and media.
According to QoS traffic prioritization, the port table rows are generally organized from top to bottom, with media requiring the highest priority and supporting data service traffic at the lowest priority.
Different endpoint tables may contain the same domain names or port ranges. This is necessary because some port ranges may be shared among hard or soft endpoints. In addition such multiplicities are needed to ensure that each endpoint can be deployed independent of other endpoints types. If multiple endpoints are deployed which require the same domain to be whitelisted or a set of ports to be opened, then only one whitelisting or access rule instance needs to be configured in the firewall.
For a given voice or video call, a stateful firewall will open only a small subset of the IP addresses and ports. Other IP addresses and ports may not be opened on the firewall unless involved in other calls from the same site or for business applications.
The RingCentral MVP Mobile App may be used on a mobile operator network or a WiFi network. On a mobile operator network, firewall configuration is irrelevant when traffic only traverses the Internet to RingCentral communication services. Table 3.2.1 must be taken into account for firewall configuration when MVP Mobile Application is used on an enterprise WiFi network.
In networks where a firewall and Web proxy server are deployed, the table rows indicating “IP Supernets” must be used to configure the firewall. The remaining table rows pertain to web traffic and must be configured in the Web Proxy server.

3.2.1 RingCentral MVP Mobile, Desktop, and Web Application

Table 3.2.1 - RingCentral MVP Mobile, Desktop, and Web Application
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media/Media Secured and media access control	RTP/SRTP (DTLS) and STUN	IP Supernets or *.ringcentral.com	UDP\20000-64999 and UDP\19302
Signaling Mobile App	SIP/TCP	IP Supernets	IPv4\IPv6: TCP\5091
Signaling Secured Mobile App	SIP/TLS	IP Supernets	IPv4\IPv6: TCP\5097
Signaling Secured Mobile App	SIP/WSS/TLS	IP Supernets	IPv4\IPv6: TCP\443
Signaling Secured Desktop and Web App	SIP/WSS	IP Supernets	IPv4\IPv6: TCP\8083
IOVATION SDK for 2-Factor Login	HTTPS	mpsnare.iesnare.com	TCP\443
Application File Upload and Download	HTTPS	glip-vault-1.s3.amazonaws.com glip-vault-1.s3-accelerate.amazonaws.com	TCP\443
Log File Upload	HTTPS	www.filestackapi.com	TCP\443
Application API Service	HTTPS	*.ringcentral.com	TCP\443
Messaging API Service	HTTPS	*.glip.com mvp.ringcentral.com dl.mvp.ringcentral.com	TCP\443
Presence Status, Call Log Notifications, and Voicemail Notifications	HTTPS	ringcentral.pubnubapi.com	TCP\443
Android Application Push Notifications	HTTPS	mtalk.google.com	TCP\443, 5228, 5229, 5230
iOS Application Push Notifications	HTTPS	api.push.apple.com	TCP\443, 2197, 5223
Messaging Content Support	HTTPS	api.giphy.com media0.giphy.com media1.giphy.com media2.giphy.com media3.giphy.com media4.giphy.com	TCP\443
Software and Provisioning Updates	HTTPS	*.cloudfront.net	TCP\443
RingCentral Video Mobile, Desktop, and Web Application	Add Table 3.2.2

3.2.2 RingCentral Video Mobile, Desktop, and Web Application

In the following table:

The Connect Platform API is used by RCV video for user authentication and communication session control.
The Statistics Collector publishes detailed statistics about calls. The analytics portal (Table 1) makes use of a subset of the data extracted from the Statistics Collector.
The RCV Web Client Application does not need to be whitelisted if only the Desktop and Mobile version of the RCV App are used.
The Network Connectivity Test Application should be whitelisted to allow RCV Application users to test network connections.

Table 3.2.2 - RingCentral Video Mobile, Desktop, and Web Application
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media Secured	SRTP	*.v.ringcentral.com or IP Supernets	UDP\10000-19999 (default)
Media Secured	SRTP	*.v.ringcentral.com or IP Supernets	TCP\443 (when UDP is not available - should not be used routinely as it adversely impacts quality)
Signaling Secured	HTTPS/WSS/TLS	*.ringcentral.com or IP Supernets	TCP\443
RCV Web Client Application	HTTPS	v.ringcentral.com	TCP\443
Parser Configuration for Meeting Link Verification for the Mobile phones	HTTPS	media.ringcentral.com	TCP\443
Connect Platform API	HTTPS	api-meet.ringcentral.com api.ringcentral.com api-mucc.ringcentral.com (mobile device)	TCP\443
Statistics Collector	HTTPS	edr.ringcentral.com	TCP\443
Presence Status, Call Log Notifications, and Voicemail Notifications	HTTPS	ringcentral.pubnubapi.com	TCP\443
Application Configuration	HTTPS	downloads.ringcentral.com	TCP\443
Application Download and Update	HTTPS	app.ringcentral.com	TCP\443
Feature Enablement Control	HTTPS	*.launchdarkly.com which uses - additions may be in the future: app.launchdarkly.com events.launchdarkly.com clientstream.launchdarkly.com mobile.launchdarkly.com	TCP\443
Network Connectivity Test Application - Part of RCV	HTTPS	rcv.testrtc.com which uses: api.nettest.testrtc.com kong.testrtc.com .turn.testrtc.com .speed.testrtc.com	TCP\443 UDP\443

3.2.3 RingCentral Webinar

RingCentral Webinar relies on two clients. The Webinar Host Client is used by the Webinar Session Host, Co-Hosts, and Panelists. Attendees use the Webinar Attendee Client. For both types of clients, the enterprise firewall needs to be configured to apply the following whitelistings:

The RCV RingCentral Video - RingCentral Webinar is based on RingCentral Video.
Cloudfront - Note that it is not necessary to apply this again when whitelisting has already been performed for RingCentral MVP Mobile, Desktop, and Web Application (Section 3.2.1).

Table 3.2.3 - RingCentral Webinar Host Client and Attendee Client
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
RingCentral Video	Table 3.2.2
Fetch Webinar Session Live Streaming media segments	HTTPS	*.cloudfront.net	TCP\443

3.2.4 RingCentral Video Rooms

Table 3.2.4 - RingCentral Video Rooms
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media Secured	SRTP	IP Supernets	UDP\10000-19999 (default)
Media Secured	SRTP	IP Supernets	TCP\443 (if UDP is not available - should not be used routinely as it adversely impacts quality)
Signaling Secured	HTTPS	IP Supernets	TCP\443
SIP Registration Service	HTTPS/TLS	*.ringcentral.com	TCP\8085-8090
Rooms Host Device	HTTPS	Internal enterprise assigned private IP address (no WAN firewall traversal)	TCP\9520-9530
Login Portal	HTTPS	v.ringcentral.com	TCP\443
Notifications	HTTPS	ringcentral.pubnubapi.com	TCP\443
Software and Provisioning Updates	HTTPS	*.ringcentral.com	TCP\443

3.2.5 RingCentral Video with Room Connector

The Region-independent domain names always needs to be whitelisted. The other domain names only need to be whitelisted when Room Connector is used in the indicated region.

Table 3.2.5 - RingCentral Video with Room Connector
Purpose*	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media	RTP/SRTP	IP Supernets	UDP\10000-19999
Signaling	SIP	Region-independent: sip.rcv.com US West: ws.rcv.com US East: es.rcv.com Netherlands: nld.rcv.com Germany: deu.rcv.com South Africa: zaf.rcv.com Singapore: sgp.rcv.com Australia: aus.rcv.com Japan: jpn.rcv.com	UDP\5060 or TCP\5060
Signaling Secured	SIP/TLS	Region-independent: sip.rcv.com US West: ws.rcv.com US East: es.rcv.com Netherlands: nld.rcv.com Germany: deu.rcv.com South Africa: zaf.rcv.com Singapore: sgp.rcv.com Australia: aus.rcv.com Japan: jpn.rcv.com	TCP\5061

* Secured versus unsecured connectivity is controlled by the customer video device settings.

3.2.6 RingCentral Desk, Conference, and Cordless Phone

Some 3rd party devices, such as the Polycom / Poly IP7000 speakerphone, do not support signaling or media encryption. They should be avoided in a deployment requiring complete security.
No separate ports are specified for Busy Lamp Appearance (BLA) since it uses the signaling ports and standard SIP NOTIFY packets.

Table 3.2.6 - RingCentral Desk, Conference and Cordless Phone
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media and Media Secured	RTP/SRTP	IP Supernets	UDP\20000-64999
Signaling	SIP	IP Supernets	TCP\5090, TCP\5099 UDP\5090, UDP\5099
Signaling Secured	SIP/TLS	IP Supernets	TCP\5096, TCP\5098**
Network Time Service	NTP	ntp1.ringcentral.com and ntp2.ringcentral.com (within the Supernets)	UDP\123
LDAP Directory Service	LDAP	cd.ringcentral.com (within the Supernets)	TCP\636
Polycom/Poly Desk Phones and Conference Phones	HTTPS	Provisioning: pp.ringcentral.com ztp.polycom.com	TCP\443
Polycom/Poly Desk Phones and Conference Phones	HTTPS	Firmware Update: pp.s3.ringcentral.com	TCP\443
Cisco Desk Phones Provisioning and Firmware Update	HTTPS	cp.ringcentral.com	TCP\443
Yealink Desk Phones Provisioning and Firmware Update	HTTPS	yp.ringcentral.com rps.yealink.com	TCP\443
Unify Desk Phones	HTTPS	unf.ringcentral.com	TCP\443
Unify RS Provisioning Server	HTTPS	cloud-setup.com	TCP\18443

**Ports 5098 and 5099 only need to be opened for Busy Lamp Appearance when line sharing is used.

3.2.7 RingCentral Desktop Softphone Application

Table 3.2.7 - RingCentral Desktop Softphone Application
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media and Media Secured	RTP/SRTP	IP Supernets	UDP\20000-64999
Signaling	SIP	IP Supernets	TCP\5091
Signaling Secured	SIP/TLS	IP Supernets	TCP\5097
Presence Status, Call Log Notifications, and Voicemail Notifications	HTTPS	.pubnub.com .pubnub.net *.pndsn.com V21.1 or higher: ringcentral.pubnubapi.com	TCP\443
Software and Provisioning Updates	HTTP/HTTPS	*.ringcentral.com	TCP\80 TCP\443
Platform API for user Authentication and Call Features	HTTPS	api-sp.ringcentral.com	TCP\443
Platform API for Media Service (for transferring media files: voice recordings, faxes, transcriptions, profile and contact information)	HTTPS	media.ringcentral.com	TCP\443
Google Services (Contacts and Calendar)	HTTPS	accounts.google.com www.google.com www.googleapis.com	TCP\443

3.2.8 RingCentral Mobile Softphone Application

The next table applies to the Mobile Phone Application when used on a WiFi network.

Table 3.2.8 - RingCentral Mobile Softphone Application
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Media	RTP/SRTP	IP Supernets	UDP\20000-64999
Signaling	SIP	IP Supernets	TCP\5091 UDP\5091
Signaling Secured	SIP/TLS	IP Supernets	TCP\5097 TCP\443
Signaling (IPv6 client)	SIP/TLS	IP Supernets	TCP\5090-5098 TCP\443
SIP Registration Service	HTTPS	*.ringcentral.com	TCP\443
Application Presence Status, Call Log Notifications, and Voicemail Notifications - Used in Android, not in iOS	HTTPS	.pubnub.com .pubnub.net *.pndsn.com V19.4.20 or higher: ringcentral.pubnubapi.com	TCP\443
Data Sync with RingCentral backend (e.g., call log info, presence, and voicemails)	HTTPS	api-mob.ringcentral.com	TCP\443
Soft Clients Software and Provisioning Updates	HTTPS	*.cloudfront.net	TCP\443

3.3 RingCentral archiver

The RingCentral Archiver is a cloud-side integration to allow administrators to copy call content, including recordings, voicemail, fax, and SMS to a long-term enterprise-owned repository. The Archiver can be used to ensure that call data is retained over a long period of time and to meet data residency and regulatory retention requirements.

Table 3.3.1 - RingCentral Archiver
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Content Archiving	HTTPS	For Box, Dropbox, Google Drive, and Smarsh archiving systems	TCP\443 (does not traverse enterprise network)
Content Archiving	SFTP	For archiving to an enterprise SFTP server, the following SFTP client IP addresses must be whitelisted: 3.211.163.136 3.223.170.110 34.225.218.68 34.226.29.169 34.234.210.244 34.236.210.8 34.239.13.99 35.172.123.110 52.87.7.127 54.80.51.95 54.147.91.15 Any of these IP addresses may dynamically be selected by the RingCentral SFTP client to connect to an enterprise SFTP server.	TCP\22

3.4 SIP trunks

Table 3.4.1 - SIP Trunks

Purpose

Application Protocol

Domain Name/IP Addresses

Destination Ports

Media

RTP

Public IP addresses to be provided by RingCentral during project definition

UDP\1024-65535

Signaling

SIP

UDP\5060

TCP\5061-5065

3.5 Communication integration services

Enterprises can use MVP and RCV Communication Integration Services to develop soft-endpoint communication clients.

The next table summarizes the programmatic Communication Integration Services which allow enterprises to build their own soft endpoint clients. These services may need to be whitelisted in a firewall or web proxy:

1. Only the actual set of services that are used must be whitelisted. For example:

a. If no Integration Services are used, then these domains do not need to be
whitelisted.

b. The Embeddable Application API only needs to be whitelisted if applications
based on this API are actually implemented.

2. The Integration API Service is the foundation API on which all Communication
Integration Services rely and must be whitelisted.

3. The Endpoint Registration Service is needed to register all Integration Services
(WebRTC) endpoints with the RingCentral Cloud Communication Service and,
therefore, must be whitelisted.

4. The RCV Scheduling Service is used for creating and manipulating RCV
meetings.

5. The Microsoft Teams (Slack) Integration Service integrates services including
MVP and RCV into Teams (Slack).

6. The Platform API can be used to develop applications such as an outbound
dialer that are separate from or integrated into existing business applications.

Table 3.5.1 - Communication Integration Services
Purpose	Application Protocol	Domain Name/IP Addresses	Destination Ports
Integration API Service	HTTPS	api-rcapps.ringcentral.biz api-rcapps.ringcentral.com	TCP\443
Endpoint Registration Service	HTTPS	sip*.ringcentral.com	TCP\8083
RCV Scheduling Service	HTTPS	api-meet.ringcentral.com	TCP\443
Microsoft Teams Integration Service	HTTPS	teams.ringcentral.com	TCP\443
Slack Integration Service	HTTPS	slack.ringcentral.com	TCP\443
Platform API to Develop Separate Applications	HTTPS	platform.ringcentral.com	TCP\443
Platform API to Develop Embedded Applications	HTTPS	platform.ringcentral.com	TCP\443

4. DNS

All endpoints and services require Internet-based DNS to function properly. In the case where private DNS is used, it must perform forward-lookups to Internet-based DNS.

For example, endpoints rely on a DNS service to resolve the provisioning service domain name (e.g., pp.ringcentral.com).

5. NAT

Network Address Translation/Port Address Translation functionality (generically referred to as NAT) is applied at the border between two networks to translate between address spaces or prevent collision of IP address spaces.

For proper operation of hard phones, a minimum Network Address Translation time out needs to be configured. Cisco phones send a follow-up REGISTER refresh message every 4 minutes, Polycom/Poly phones every 5 minutes so that NAT entry expiration timeout must be set to greater than 5 minutes to cover hard phones.

6. Security software

Cloud-based security client software (network firewalls and web proxies) and client-firewall may need to be configured to bypass supernet and other MVP traffic when this interferes with the operation of endpoints.

7. Quality of service guidelines

To ensure that traffic is properly prioritized, the Quality of service guidelines must be followed. Otherwise, intermittent call control or media quality issues may be experienced by communication parties.

8. Unsupported devices and configurations

Some types of devices, device settings, and network configurations are not supported/recommended in an MVP communication solution as they are known to cause issues related to endpoint registration, call feature operation, or continuous or intermittent voice or video quality issues (contributing to high latency, packet loss, or jitter).

For proper operation of MVP services, the functions listed in Table 9.1 should be disabled on IP devices (Layer 3 switches, routers, firewalls) and Ethernet switches or be avoided. Disabling the mentioned functionality for the IP and higher layers can be limited to the supernets by applying policy-based control. For example, WAN acceleration can be configured to the pass-through mode for UDP traffic originating from and destined to the supernets.

Table 8.1 Functions that may impair SIP signaling and/or RTP media traffic
Layer	Function
Application	• SIP Application Layer Gateway (SIP ALG), also referred to as SIP Transformations • SIP inspection • Deep Packet Inspection (DPI) • Application Layer Access Control • Stateful Packet Inspection (SPI), also called Dynamic Packet Filtering • Intrusion Detection/Intrusion Prevention System (IDS/IPS) • Web Proxy operation • WAN Acceleration
Transport	• Port filtering
IP	• Packet-by-packet load balancing across multiple Service Providers links
IP & Data Link	• Auto-QoS, when used in combination with Polycom/Poly phones • Dynamic ARP Inspection
Physical	• Energy Efficient Ethernet (a.k.a. Green Ethernet) • Satellite (Ethernet over microwave) network connections

Specifically:

For some of the functionality mentioned under Application Layer Functions, packet content may traverse a separate processing engine, resulting in the mentioned impairments. The impact may be minimal when using advanced networking devices but could be substantial for SMB and SoHo devices.
Enabling SIP ALG may cause signaling issues resulting in non- or partially functioning call features and or one-way or no-audio.
SIP Inspection must be disabled since it may cause intermittent call control or media transport issues.
IDS/IPS functions may limit packet streams to a specific bandwidth causing intermittent audio issues across multiple calls when the number of calls exceeds a certain volume. WAN accelerators use header compression to reduce bandwidth consumption. For VoIP traffic, this can result in increased jitter.
Web proxies typically do not support QoS, so that any VoIP and video traffic passed through it may experience excessive latency and jitter.
Port filtering, such as UDP flood protection, may limit bandwidth, causing intermittent voice quality issues when many simultaneous calls occur.
Packet-by-packet load balancing across multiple internet connections is not supported because signaling and media for a single session must originate from the same IP address.
Use of Auto-QoS may cause voice quality issues (such as distortions or incorrect volume levels) with older Polycom/Poly speakerphones and older versions of desk phones.
Green Ethernet is used on switch ports to save energy by automatically setting them into low power mode after they have not passed traffic for some time. This may also cause intermittent signaling and media traffic issues.
Satellite connections introduce delays much exceeding 150 ms in each direction and, depending on the quality of the satellite connection, may also cause excessive jitter and packet loss. It depends on end-user expectations whether this is acceptable.

9. VLAN configuration guidelines

VLAN configuration guidelines must be followed to ensure that VLANs are properly configured for hard phones (section 3.2.6)

Network requirements | RingCentral MVP

Table of contents

1. Introduction