--- schema_version: "1" id: 0bd8917e9bb49bdb844124d665c41dcf140751c690916b7cca28290c35255bff title: Allowlist Network Destinations for Agentforce Contact Center collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/afcc_sv_allowlist_network_destination.md canonical_url: https://help.salesforce.com/s/articleView?id=service.afcc_sv_allowlist_network_destination.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: ec90e726ddcbff56b6a7e20201fbcd48a4184b5003e0045752e6b725cce8da7b description: Allowlist the call-signaling and media-relay destinations and open the required ports so reps behind a firewall, proxy, or VPN can make and receive calls. products: - Service Cloud - Digital Engagement release: "264" --- # Allowlist Network Destinations for Agentforce Contact Center Allowlist the call-signaling and media-relay destinations and open the required ports so reps behind a firewall, proxy, or VPN can make and receive calls. ### Required Editions This article applies to: Salesforce Voice (Native Telephony)
View supported editions.
Confirm the Salesforce region your org uses for Agentforce Contact Center Voice, and confirm with your network or firewall team that they can update outbound and inbound allow rules. For the reasoning behind these rules, see [Network Requirements for Agentforce Contact Center Voice](https://help.salesforce.com/s/articleView?id=service.afcc_sv_network_reqs.htm&release=264.0.0&type=5 "Agentforce Contact Center Voice sends call audio over a relay connection with no fallback path. A restrictive firewall, proxy, or VPN can block the audio path and cause error E-1002."). These steps resolve and prevent error E-1002, which occurs when a restrictive network blocks the voice audio path. Complete every step for each region your org uses. 1. Identify the Salesforce region your org uses for Agentforce Contact Center Voice. Endpoints differ by region. These steps cover the United States. If your org is hosted in another region, contact Salesforce Support for the endpoints that apply to your region. 2. Allowlist the call-signaling hostname for each endpoint set in your region, by fully qualified domain name (FQDN). Don't pin these hostnames to a fixed IP address. Their IP addresses change automatically. Call-Signaling Hostnames (United States) | Endpoint Set | Hostname (FQDN) | | --- | --- | | Endpoint Set 1 | gateway.webrtc.thb01.uengage1.sfdc-yfeipo.salesforce-ccaas.com | | Endpoint Set 2 | gateway.webrtc.thb01.uengage1.sfdc-lywfpd.salesforce-ccaas.com | 3. Allowlist the media-relay IP addresses and hostname for each endpoint set. Allowlist all four IP addresses. Each endpoint set's media relay uses two static IP addresses, and calls fail intermittently when your network allows only one. Media-Relay Destinations (United States) | Endpoint Set | Hostname (Reference Only) | IP Addresses (Allowlist These) | | --- | --- | --- | | Endpoint Set 1 | aec3a52bd9dd98a81.awsglobalaccelerator.com | 15.197.88.2, 166.117.93.103 | | Endpoint Set 2 | a2f4bbf1c48de2690.awsglobalaccelerator.com | 166.117.15.73, 35.71.149.154 | 4. Open the ports that Agentforce Contact Center Voice uses for signaling and audio. Confirm that outbound UDP port 3478 is open first. It's the port that a restrictive firewall blocks most often. Required Ports | Ports | Transport | Direction | Purpose | | --- | --- | --- | --- | | 443 | TCP/TLS | Outbound | Browser voice client signaling and encrypted media relay | | 5061 | TCP/TLS | Outbound/Inbound | Encrypted voice call signaling | | 3478 | UDP | Outbound | Audio/media relay | | 1024–65280 (dynamic) | UDP | Outbound/Inbound | Audio streams | 5. Turn off proxy authentication and SSL or deep-packet inspection for traffic to these destinations. Intercepting or decrypting this traffic in transit causes call failures. 6. To confirm that error E-1002 no longer occurs, make a test call from a workstation on the corporate network. ## Configure Europe Allowlist Orgs hosted in Europe use a single endpoint set. Allowlist the following call-signaling hostname and media-relay destination in addition to the steps for the United States. | Purpose | Hostname (FQDN) | IP Addresses | | --- | --- | --- | | Call signaling — allowlist by FQDN. IP addresses change automatically. | gateway.webrtc.thb01.uengage1.sfdc-5pakla.salesforce-ccaas.com | Resolved automatically. Don't pin to a fixed IP address. | | Audio/media relay — allowlist these static IP addresses. | a047481e9761e70bc.awsglobalaccelerator.com | 3.33.135.180, 166.117.2.54 | ## Troubleshoot Remaining E-1002 Errors If error E-1002 continues after you allowlist the destinations and ports, match the symptom to a likely cause and action. | Symptom | Likely Cause | Action | | --- | --- | --- | | E-1002 on the corporate network only; calls work on a personal device or off-VPN. | A firewall or proxy is blocking the media path. | Allowlist the media IP addresses and open outbound UDP port 3478. | | Calls work at low volume but fail as volume increases. | Only one of the two media IP addresses for the endpoint set is allowed. | Allowlist all media IP addresses for your region. | | Failed to gather relay candidates within 5 seconds or THUNDERBIRD\_CONNECTOR\_ERROR appears in the browser console. | The media path is blocked, or traffic is being SSL-inspected. | Confirm that no proxy authentication or SSL inspection applies, and open outbound UDP port 3478 to the media IP addresses. | If your org uses regions outside the United States, repeat these steps using the endpoints that Salesforce Support provides for those regions. After allowlisting, monitor call volume for a few days. Calls that fail only under higher volume usually mean a media IP address is still blocked.