Network Requirements for Agentforce Contact Center

Why Restrictive Networks Block Calls

Agentforce Contact Center Voice separates call signaling, which sets up and tears down a call, from the audio, or media, path, which carries the actual voice traffic. The audio path uses a relay connection with no direct fallback. When a network blocks the relay destinations or ports, call setup can succeed while the audio path still fails.

When this happens, the softphone shows "Connecting" and then displays: "We couldn't accept the call. Ask your Salesforce admin for help with code E-1002." The browser console can also show Failed to gather relay candidates within 5 seconds or THUNDERBIRD_CONNECTOR_ERROR. Both messages point to the same root cause: The network blocked the audio (media) path, not the call signaling.

Because the relay connection has no fallback, allowlisting the destinations and ports in this topic is required, not optional, for reps on restrictive networks.

General Rules for Allowlisting Voice Traffic

Apply these rules when your network team configures firewall or proxy rules for Agentforce Contact Center Voice.

• Allow traffic to the required destinations without proxy authentication.
• Don't apply SSL inspection or deep-packet inspection to this traffic. Real-time voice traffic breaks when it's intercepted or decrypted in transit.
• Allowlist the call-signaling hostname by its fully qualified domain name (FQDN). Its underlying IP addresses change automatically, so don't pin firewall rules to a fixed IP address.
• Allowlist the media-relay IP addresses directly. These IP addresses are stable and don't rotate under normal operation. The media hostname is for reference only and can change if the underlying accelerator is recreated, so don't build firewall rules on that hostname.
• Include every media-relay IP address for a region. Each region's media relay uses two static IP addresses, and calls fail intermittently when your network allows only one.

Endpoint Sets and Regions

Agentforce Contact Center Voice distributes call traffic across multiple endpoint sets so that traffic can use any available path in your org's region. Each endpoint set pairs a call-signaling hostname with its own media-relay IP addresses and hostname. Because traffic can use any endpoint set in your region, calls fail intermittently when even one set is missing from your allowlist.

Orgs hosted in the United States use two endpoint sets, and both require allowlisting. Endpoints differ for orgs hosted outside the United States. For the specific hostnames, IP addresses, and ports to allowlist for your org's region, see Allowlist Network Destinations for Agentforce Contact Center .

Common Misconfigurations

Most E-1002 cases trace back to one of these misconfigurations.

• Only one media IP address allowed. A broad IP range sometimes covers just one of a region's two static media addresses. Calls then work at low call volume and start failing as volume increases, because traffic shifts unpredictably between the two addresses.
• Only one endpoint set allowed. Orgs that allowlist a single US endpoint set instead of both see intermittent failures, because Agentforce Contact Center Voice can route a call through either set.
• Media allowlisted by hostname instead of IP address. The media hostname can change if the underlying accelerator is recreated. Allowlisting by IP address avoids breakage from that change.
• Unrelated IP addresses flagged in logs. When your network team finds connections to addresses that aren't in your allowlist reference, those addresses aren't part of the Agentforce Contact Center Voice media path. Some come from other services that your own applications contact, such as fraud or device-intelligence providers. Review those separately with your security team.