Allowlist the call-signaling and media-relay destinations and open the required ports so reps behind a firewall, proxy, or VPN can make and receive calls.
Required Editions
This article applies to:
Salesforce Voice (Native Telephony)
| View supported editions. |
Confirm the Salesforce region your org uses for Agentforce Contact Center Voice, and confirm with your network or firewall team that they can update outbound and inbound allow rules. For the reasoning behind these rules, see Network Requirements for Agentforce Contact Center Voice.
These steps resolve and prevent error E-1002, which occurs when a restrictive network blocks the voice audio path. Complete every step for each region your org uses.
- Identify the Salesforce region your org uses for Agentforce Contact Center Voice. Endpoints differ by region. These steps cover the United States. If your org is hosted in another region, contact Salesforce Support for the endpoints that apply to your region.
- Allowlist the call-signaling hostname for each endpoint set in your region, by fully
qualified domain name (FQDN). Don't pin these hostnames to a fixed IP address. Their IP
addresses change automatically.
Call-Signaling Hostnames (United States) Endpoint Set Hostname (FQDN) Endpoint Set 1 gateway.webrtc.thb01.uengage1.sfdc-yfeipo.salesforce-ccaas.com Endpoint Set 2 gateway.webrtc.thb01.uengage1.sfdc-lywfpd.salesforce-ccaas.com - Allowlist the media-relay IP addresses and hostname for each endpoint set. Allowlist all
four IP addresses. Each endpoint set's media relay uses two static IP addresses, and calls
fail intermittently when your network allows only one.
Media-Relay Destinations (United States) Endpoint Set Hostname (Reference Only) IP Addresses (Allowlist These) Endpoint Set 1 aec3a52bd9dd98a81.awsglobalaccelerator.com 15.197.88.2, 166.117.93.103 Endpoint Set 2 a2f4bbf1c48de2690.awsglobalaccelerator.com 166.117.15.73, 35.71.149.154 - Open the ports that Agentforce Contact Center Voice uses for signaling and audio. Confirm
that outbound UDP port 3478 is open first. It's the port that a restrictive firewall blocks
most often.
Required Ports Ports Transport Direction Purpose 443 TCP/TLS Outbound Browser voice client signaling and encrypted media relay 5061 TCP/TLS Outbound/Inbound Encrypted voice call signaling 3478 UDP Outbound Audio/media relay 1024–65280 (dynamic) UDP Outbound/Inbound Audio streams - Turn off proxy authentication and SSL or deep-packet inspection for traffic to these destinations. Intercepting or decrypting this traffic in transit causes call failures.
- To confirm that error E-1002 no longer occurs, make a test call from a workstation on the corporate network.
Configure Europe Allowlist
Orgs hosted in Europe use a single endpoint set. Allowlist the following call-signaling hostname and media-relay destination in addition to the steps for the United States.
| Purpose | Hostname (FQDN) | IP Addresses |
|---|---|---|
| Call signaling — allowlist by FQDN. IP addresses change automatically. | gateway.webrtc.thb01.uengage1.sfdc-5pakla.salesforce-ccaas.com | Resolved automatically. Don't pin to a fixed IP address. |
| Audio/media relay — allowlist these static IP addresses. | a047481e9761e70bc.awsglobalaccelerator.com | 3.33.135.180, 166.117.2.54 |
Troubleshoot Remaining E-1002 Errors
If error E-1002 continues after you allowlist the destinations and ports, match the symptom to a likely cause and action.
| Symptom | Likely Cause | Action |
|---|---|---|
| E-1002 on the corporate network only; calls work on a personal device or off-VPN. | A firewall or proxy is blocking the media path. | Allowlist the media IP addresses and open outbound UDP port 3478. |
| Calls work at low volume but fail as volume increases. | Only one of the two media IP addresses for the endpoint set is allowed. | Allowlist all media IP addresses for your region. |
| Failed to gather relay candidates within 5 seconds or THUNDERBIRD_CONNECTOR_ERROR appears in the browser console. | The media path is blocked, or traffic is being SSL-inspected. | Confirm that no proxy authentication or SSL inspection applies, and open outbound UDP port 3478 to the media IP addresses. |
If your org uses regions outside the United States, repeat these steps using the endpoints that Salesforce Support provides for those regions. After allowlisting, monitor call volume for a few days. Calls that fail only under higher volume usually mean a media IP address is still blocked.