Skip to content

Network & Firewall Requirements

Purpose and Audience

This document lists the network and firewall changes required before Zoom Phone endpoints are deployed on your network. It is written for the network or security team that will implement the rules, and it should be completed and returned before device staging begins.

Firewall validation is the single most common cause of avoidable rework in a phone deployment. Blocked ports, SIP ALG interference, and unstable DNS or NTP produce registration failures, one-way audio, and unexpected device reboots — all of which are considerably more expensive to diagnose after phones are on desks than before.

If outbound traffic to the Internet is allowed by default, make sure your enterprise firewall DISABLES SIP ALG, SIP Inspection, SIP Fixup or any other protocol modification.

How Zoom Phone Traffic Behaves

Zoom Phone is cloud-hosted. Endpoints — desk phones, the Zoom Workplace app, ATAs, and paging devices — always initiate connections outbound to Zoom's data centers. Understanding this saves a great deal of unnecessary work:

  • All rules below are outbound only. No inbound rules or port forwards are required.
  • No SIP trunk terminates on your network, so there is no static peer address to permit.
  • Endpoints traverse NAT normally. A public IP per phone is not required.
  • Every network segment carrying voice — each VLAN, guest network, load balancer path, and remote site — needs the same outbound access. Rules applied only to the primary LAN are a frequent cause of site-specific failures.

Exception

Bring Your Own Carrier – Premises Peering (BYOC-P) deployments use an on-premises SBC that requires bi-directional connectivity. If BYOC-P is in scope, treat the rules below as a starting point only and see Bring Your Own Carrier (BYOC) for the SBC's requirements.

Firewall Rules for Zoom Phone

The following outbound rules must be permitted from every subnet that will carry Zoom Phone endpoints or softphones.

Protocol Port(s) Purpose Destination
TCP 443 Core service connectivity, provisioning, portal and client traffic Zoom Phone IPv4 and IPv6 ranges
TCP 5091 Zoom Phone signaling (SIP over TLS) Zoom Phone IPv4 and IPv6 ranges
TCP 390 Company directory search on desk phones 134.224.0.0/16, 170.114.0.0/16
UDP 3478 TURN — NAT traversal support 144.195.0.0/16, 147.124.96.0/19, 170.114.0.0/16, 173.231.92.0/24, 206.247.0.0/16
UDP 20000–64000 Voice media (RTP/SRTP) Zoom Phone IPv4 and IPv6 ranges

Note

Outbound TCP 390 is required specifically for company directory search on desk phones. It is commonly missed because it is not a standard voice port, and the resulting symptom — directory lookups failing while calling works normally — is easy to misattribute.

Zoom Phone destination IP ranges

Zoom publishes and maintains authoritative range files. Wherever your firewall supports it, reference these files or an equivalent dynamic object rather than pasting static ranges — Zoom adds ranges over time, and a hardcoded list will silently drift out of date.

Zero-Touch Provisioning: Manufacturer Firewall Rules

Zero-touch provisioning (ZTP) is the preferred deployment method: a phone added to the Zoom portal contacts its manufacturer's cloud service on first boot, validates its MAC address, and is redirected to Zoom's provisioning server. That first hop goes to the manufacturer, not to Zoom, so the Zoom ranges above are not sufficient on their own.

Permit outbound access to the provisioning services for every manufacturer present in the deployment:

Manufacturer Firewall / ports and protocols documentation
Poly info.ztp.poly.com/docs/begin/ports-and-protocols
Yealink support.yealink.com — ZTP firewall requirements
Cisco cisco.com — ZTP firewall settings
Grandstream grandstream.com/support/ztp-firewall-rules
Mitel wiki.unify.com — Firewall rules for Mitel IP phones

Note

ZTP typically pulls a firmware update on first boot, so phones may reboot several times during initial setup. This is expected and must not be interrupted. Keep the path to the manufacturer's provisioning servers open for the duration of the rollout, not just the first day.

Supporting Network Requirements

DHCP options 66 and 161

DHCP options 66 and 161 can interfere with zero-touch provisioning on some devices. Zoom's guidance is to leave these options unconfigured where ZTP is used extensively or where multiple phone manufacturers share a network. If the site previously ran an on-premises PBX, these options are very likely still set from the legacy system and must be removed.

SIP ALG and SIP transformations

Disable SIP ALG, SIP inspection, or SIP transformation features on all firewalls in the voice path. These features rewrite SIP headers on the assumption of a traditional trunk and are a recurring cause of registration failures and one-way audio with cloud voice platforms.

Important

Disabling SIP ALG is critical to reliable, predictable system performance.

Bandwidth planning

Zoom Phone uses the Opus codec between Zoom endpoints. Opus is adaptive and consumes approximately 60–100 kbps per concurrent call. Size the internet circuit against the expected peak of simultaneous calls, not the total user count, and confirm headroom remains for Zoom Meetings and other business traffic.

LLDP-MED and switch configuration

LLDP-MED lets phones report switch-port identity and VLAN tagging to Zoom Phone's emergency location services, which is what enables floor-level and room-level dispatchable address accuracy. Confirm LLDP-MED is enabled on access switches serving voice, and that PoE budget is sufficient for the planned device count.

Testing with the Zoom Network Connectivity Tool

The Zoom Workplace desktop app for Windows and macOS includes a built-in Network Connectivity Tool with a dedicated Phone Test that confirms an endpoint can reach Zoom Phone's data centers. Run it from a device on each voice VLAN and at each physical site once firewall rules are in place — before phones are deployed.

Requires Zoom Workplace desktop version 5.13.10 or higher.

Windows

  • Open the Zoom Workplace app on the desktop.
  • Press Ctrl + Alt + Shift + D** to open the Network Diagnostics Tool.
  • Click Phone Test.
  • Click **Test.
  • Review the results once the test completes.

macOS

  • Open the Zoom Workplace app on the desktop.
  • Press Cmd + Option + Shift + D** to open the Network Diagnostics Tool.
  • Click Phone Test, then **Test.
  • Review the results once the test completes.

Where to run the test

A single pass from one workstation proves very little. Run the Phone Test from at least one endpoint on each of the following, and record the result:

  • Each voice VLAN, at each physical site
  • Any data VLAN that will host softphone users
  • Guest or restricted wireless, if staff will use Zoom Phone on it
  • A remote worker connection, both with VPN active and split-tunnelled

Scope limits

The tool tests connectivity from the host machine to Zoom's services. It does not test desk phones directly, and where Zoom Phone is integrated with a third-party PBX — Mitel or Avaya, for example — it cannot see or test call paths that traverse that vendor's network. A clean result confirms the network path from that machine is open; it does not prove a desk phone on a different VLAN will register.

References

  • Zoom — Network firewall or proxy server settings for Zoom (Firewall Rules for Zoom Phone): KB0060548
  • Zoom — Using the Zoom Network Connectivity Tool: KB0058114
  • Zoom Phone Blue Paper — Network Configuration: library.zoom.com
  • Zoom Phone Blue Paper — Desk Phone Provisioning & Customization Field Guide: library.zoom.com
  • Zoom — Certified hardware list: KB0060242

Port, protocol, and IP range data in this document reflects Zoom's published guidance as of the date above. Verify against the live Zoom documentation before implementation.