Polycom G7500 Administrator's Manual page 59

3. Select Enable H.460 Firewall Traversal.
4. Verify the firewalls that you traverse allow your system to use outbound TCP and UDP
connections.
▪ Firewalls with a stricter rule set must allow the system to use at least the following outbound
TCP and UDP ports: 1720 (TCP), 14085-15084 (TCP), 1719 (UDP), and 16386-25386
(UDP).
▪ Firewalls must allow inbound traffic to the TCP and UDP ports used for outbound traffic.
5. Configure the following settings:
Setting
Fixed Ports
TCP Ports
UDP Ports
Polycom, Inc.
Description
Defines which TCP and UDP ports your system
uses for firewall traversal.
Enable this option if your firewall isn't H.323
compatible. The system assigns a port range
starting with the TCP and UDP ports you specify
(port 3230 is where the range begins by default).
Note: For the fixed ports you configure, you must
open the corresponding ports on your firewall. For
H.323, open TCP port 1720. For SIP, open UDP
port 5060, TCP 5060, or TCP 5061 depending on if
you're using UDP, TCP, or TLS, respectively, as the
SIP transport protocol.
Disable this option if your firewall is H.323
compatible or the system isn't behind a firewall.
The starting value for the range of TCP and UDP
ports the system uses. The system automatically
configures the range based on the beginning value
you set here.
To allow H.323 traffic, you need two TCP and eight
UDP ports per connection. You must also open
TCP port 1720 on the firewall.
To allow SIP traffic, you need TCP port 5060 and
eight UDP ports per connection.
UDP port range: Because systems support ICE,
the range of fixed UDP ports is 32. The system
cycles through the available ports from call to call.
Fixed ports range and filters: You might notice
that the source port of a SIP signaling message is
not in the fixed ports range. When your firewall is
filtering on source ports, in the system web
interface, go to the SIP page and enable Force
Connection Reuse. When enabled, the system
uses port 5060 and 5061 for the source and
destination port (these must be open on the
firewall).
Securing the System
57