Loading
Contact Center
Allowlist Network Destinations for Agentforce Contact Center

You are here:

  1. Salesforce Help
  2. Docs
  3. Contact Center

Allowlist Network Destinations for Agentforce Contact Center

Allowlist the call-signaling and media-relay destinations and open the required ports so reps behind a firewall, proxy, or VPN can make and receive calls.

Required Editions

This article applies to:

Salesforce Voice (Native Telephony)

View supported editions.

Confirm the Salesforce region your org uses for Agentforce Contact Center Voice, and confirm with your network or firewall team that they can update outbound and inbound allow rules. For the reasoning behind these rules, see Network Requirements for Agentforce Contact Center Voice.

These steps resolve and prevent error E-1002, which occurs when a restrictive network blocks the voice audio path. Complete every step for each region your org uses.

  1. Identify the Salesforce region your org uses for Agentforce Contact Center Voice. Endpoints differ by region. These steps cover the United States. If your org is hosted in another region, contact Salesforce Support for the endpoints that apply to your region.
  2. Allowlist the call-signaling hostname for each endpoint set in your region, by fully qualified domain name (FQDN). Don't pin these hostnames to a fixed IP address. Their IP addresses change automatically.
    Call-Signaling Hostnames (United States)
    Endpoint Set Hostname (FQDN)
    Endpoint Set 1 gateway.webrtc.thb01.uengage1.sfdc-yfeipo.salesforce-ccaas.com
    Endpoint Set 2 gateway.webrtc.thb01.uengage1.sfdc-lywfpd.salesforce-ccaas.com
  3. Allowlist the media-relay IP addresses and hostname for each endpoint set. Allowlist all four IP addresses. Each endpoint set's media relay uses two static IP addresses, and calls fail intermittently when your network allows only one.
    Media-Relay Destinations (United States)
    Endpoint Set Hostname (Reference Only) IP Addresses (Allowlist These)
    Endpoint Set 1 aec3a52bd9dd98a81.awsglobalaccelerator.com 15.197.88.2, 166.117.93.103
    Endpoint Set 2 a2f4bbf1c48de2690.awsglobalaccelerator.com 166.117.15.73, 35.71.149.154
  4. Open the ports that Agentforce Contact Center Voice uses for signaling and audio. Confirm that outbound UDP port 3478 is open first. It's the port that a restrictive firewall blocks most often.
    Required Ports
    Ports Transport Direction Purpose
    443 TCP/TLS Outbound Browser voice client signaling and encrypted media relay
    5061 TCP/TLS Outbound/Inbound Encrypted voice call signaling
    3478 UDP Outbound Audio/media relay
    1024–65280 (dynamic) UDP Outbound/Inbound Audio streams
  5. Turn off proxy authentication and SSL or deep-packet inspection for traffic to these destinations. Intercepting or decrypting this traffic in transit causes call failures.
  6. To confirm that error E-1002 no longer occurs, make a test call from a workstation on the corporate network.

Configure Europe Allowlist

Orgs hosted in Europe use a single endpoint set. Allowlist the following call-signaling hostname and media-relay destination in addition to the steps for the United States.

Purpose Hostname (FQDN) IP Addresses
Call signaling — allowlist by FQDN. IP addresses change automatically. gateway.webrtc.thb01.uengage1.sfdc-5pakla.salesforce-ccaas.com Resolved automatically. Don't pin to a fixed IP address.
Audio/media relay — allowlist these static IP addresses. a047481e9761e70bc.awsglobalaccelerator.com 3.33.135.180, 166.117.2.54

Troubleshoot Remaining E-1002 Errors

If error E-1002 continues after you allowlist the destinations and ports, match the symptom to a likely cause and action.

Symptom Likely Cause Action
E-1002 on the corporate network only; calls work on a personal device or off-VPN. A firewall or proxy is blocking the media path. Allowlist the media IP addresses and open outbound UDP port 3478.
Calls work at low volume but fail as volume increases. Only one of the two media IP addresses for the endpoint set is allowed. Allowlist all media IP addresses for your region.
Failed to gather relay candidates within 5 seconds or THUNDERBIRD_CONNECTOR_ERROR appears in the browser console. The media path is blocked, or traffic is being SSL-inspected. Confirm that no proxy authentication or SSL inspection applies, and open outbound UDP port 3478 to the media IP addresses.

If your org uses regions outside the United States, repeat these steps using the endpoints that Salesforce Support provides for those regions. After allowlisting, monitor call volume for a few days. Calls that fail only under higher volume usually mean a media IP address is still blocked.

 
Loading
Salesforce Help | Article