Cloud media services CIDR IP address range
Genesys Cloud’s cloud media services /20 CIDR IP range is 52.129.96.0/20. This new range is available in the majority of the AWS regions and satellite regions that Genesys supports.
| Americas | EMEA | Asia Pacific | Africa |
|---|---|---|---|
|
US-West (Oregon) US-East (N.Virginia) Canada (Central) Satellite region: South America (Sao Paulo) |
EU (Frankfurt) EU (Dublin) EU (London) |
Asia Pacific (Sydney) Asia Pacific (Tokyo) Asia Pacific (Seoul) Asia Pacific (Mumbai) |
Satellite region: Africa (Cape Town) |
Full support of Genesys Cloud’s cloud media services CIDR block feature in this region
Our cloud infrastructure provider does not support the Genesys Cloud’s cloud media services CIDR block feature in this region.
Genesys Cloud’s cloud media services CIDR block provides a smaller range of IP addresses for outbound connections to and from telephony endpoints. If you currently use any of these Genesys Cloud services:
- WebRTC stations
- Polycom stations with Genesys Cloud Voice or BYOC Cloud.
- BYOC Cloud
- ACD screen recording
- Video chat
then we recommend that you run the tests listed in the Readiness check section in this article. Doing so allows you to evaluate what you need to do to incorporate the /20 CIDR block of IP addresses for our public-facing cloud media services into your firewall’s allowlist.
- It is important to understand that Genesys is asking you to add the /20 CIDR block of IP addresses to your existing firewall allowlist. You do not need to remove access to current addresses.
- You have to allow the full /20 CIDR block of IP addresses.
Readiness check
To help you prepare to use the CIDR block of IP addresses, Genesys provides you with two ways to confirm whether you are ready to use the CIDR block of IP addresses or need to make further adjustments to your firewall settings.
- You can access the Genesys Cloud WebRTC Diagnostics app and run the automated tests found on the Network Test tab.
- You can run the set of manual tests described in this article.
Genesys provides you with a set of cloud-based network connectivity diagnostic endpoints that you can use to test against. To perform the manual tests, you can use commonly available network connectivity tools, such as netcat and nmap.
To ensure the entirety of the address range is covered, please run these checks against each one of the following destination FQDNs:
- netdiag.use1.pure.cloud
- netdiag.usw2.pure.cloud
- netdiag.cac1.pure.cloud
- netdiag.sae1.pure.cloud
- netdiag.euw1.pure.cloud
- netdiag.euw2.pure.cloud
- netdiag.euc1.pure.cloud
- netdiag.apne1.pure.cloud
- netdiag.apne2.pure.cloud
- netdiag.apse2.pure.cloud
- netdiag.aps1.pure.cloud
These tests are for guidance purposes only and are intended for use by a network and firewall expert.
| Destination protocol & port | Sample test command | Successful response | Failed response |
|---|---|---|---|
| tcp/3478 |
(Run this from the same network as Genesys Cloud client application) |
No specific response is displayed, but a successful connection handshake is indicated. | The connection times out. |
| udp/3478 | nmap -sU -p 3478 --script stun-info netdiag.use1.pure.cloud(You must be using nmap version 7.9 or later to run this command.) |
The response includes a stun-info section listing an external IP address. This will be followed by: nmap done: 1 IP address (1 host up) scanned in #.## seconds |
You receive a “host is down” response. |
| udp/16384-32768 |
(Run this from same the network as Genesys Cloud client application.) |
The response includes: GoodbyeGoodbyeGoodbyeGoodbyeGoodbye (This command sends five packets, which result in five “Goodbye” responses; one for each packet.) |
You do not receive a “Goodbye” response. |
|
tcp/8061 (Run this test if you are using hardware phones with cloud media.) |
(Run this from same network on which the hardware phones are connected.) |
The response includes: Goodbye |
You do not receive a “Goodbye” response. |
|
tcp/5061 (Run this test if you are using premises Edge appliances.) |
(Run this from same network on which the Edge devices are connected.) |
The response includes: Goodbye |
You do not receive a “Goodbye” response. |
Genesys Cloud services
Use the information in this table to gain a detailed understanding of the Genesys Cloud services that will be affected by the addition of the CIDR IP address block. This information helps you to identify the Source, Destination address, and the Destination transport protocol/port associated with each of the affected services.
| Services | Source | Destination address | Destination transport protocol/port | Description |
|---|---|---|---|---|
| WebRTC Client | ||||
| Signaling | WebRTC Client | 52.129.96.0/20 | tcp/443 | Controls plane signaling between the WebRTC Client and cloud-based XMPP Gateway. Used in both cloud media and premises Edge deployments. |
| STUN | WebRTC Client | 52.129.96.0/20 | tcp/3478 udp/3478 |
Identifies the public IP address of the WebRTC Client. |
| Media | WebRTC Client | 52.129.96.0/20 | udp/16384-32768 | Media sent to Genesys Cloud TURN or media services. |
| Managed Hardware Phone | ||||
| Signaling | Hardware Phone | 52.129.96.0/20 | tcp/8061 | SIP signaling between the hardware phone and cloud-based SIP services. |
| Media | Hardware Phone | 52.129.96.0/20 | udp/16384-32768 | Media sent to Genesys Cloud media services. |
| BYOC Cloud | ||||
| Media | Customer’s Carrier or PBX Device | 52.129.96.0/20 | udp/16384-32768 | Media sent to Genesys Cloud media services. |
| ACD Screen Recording & Video Chat | ||||
| Signaling | Genesys Cloud Client | 52.129.96.0/20 | tcp/443 | Control plane signaling between the WebRTC Client and cloud-based XMPP Gateway. Used in both cloud media and premises Edge deployments. |
| STUN | Genesys Cloud Client | 52.129.96.0/20 | tcp/3478 udp/3478 |
Identifies the public IP address of the Screen Recording and Video Chat Client. |
| Media | Genesys Cloud Client | 52.129.96.0/20 | udp/16384-32768 | Media sent to Genesys Cloud TURN or media services. |
| Premises Edge Appliance | ||||
| WebRTC Signaling | Premises Edge Appliance | 52.129.96.0/20 | tcp/5061 | Control plane signaling between the Edge device and cloud-based XMPP Gateway. |
| WebRTC TURN | Premises Edge Appliance | 52.129.96.0/20 | udp/16384-32768 | Media sent to Genesys Cloud TURN services. |
| WebRTC STUN | Premises Edge Appliance | 52.129.96.0/20 | tcp/3478 udp/3478 |
Used to identify public IP address of the Edge device. |
AWS Direct Connect & routing specific information
AWS advertises the Genesys CIDR block both publicly and within Direct Connect.
- Direct Connect customers who are not performing route filtering have no additional changes to make. Genesys recommends doing a lookup on the route table to ensure they are seeing the Genesys CIDR block (52.129.96.0/20), which includes anything greater than or equal to /20. For example, AWS may segment the block into /21’s, /22’s, /23’s, /24’s, and so on.
- Direct Connect customers who are performing route filtering must permit the Genesys CIDR block (52.129.96.0/20), which includes anything greater than or equal to /20. For example, AWS may segment the block into /21’s, /22’s, /23’s, /24’s, and so on.
For more information on AWS Direct Connect routing and filtering, see AWS Routing policies and BGP communities.
|
Date |
Revision |
|---|---|
| September 1, 2021 |
Added legend to AWS regions table Added Africa (Cape Town) / af-south-1 satellite region |
| March 31, 2021 | Asia Pacific South (Mumbai) / ap-south-1 promoted to a core region. |
| March 10, 2021 | Added a table to define which AWS regions support the new CIDR block. |
| February, 24, 2021 |
|
| January 27, 2021 |
|
| November 25, 2020 |
Modified the article to add more detail about the affected Genesys Cloud services. |
| November 04, 2020 |
Added article to the Resource Center. |