Genesys Cloud network and firewall requirements: domains, IP ranges and ports

Genesys's firewall guidance begins with a simple recommendation: when you restrict network access, allow client outbound access on the specified ports to any IP destination. The reason is practical. Most Genesys Cloud services run on Amazon Web Services, and Genesys notes that AWS IP addresses are subject to frequent changes, so an allowlist built from fixed addresses goes stale. Genesys owns only the address blocks it uses for public media services; everything else sits in AWS ranges that move.

Where security policy will not allow outbound access to any destination, the fallback is an allowlist built from four published sources: the domains for each region, the media CIDR blocks Genesys owns, the AWS ranges published in AWS's own ip-ranges file, and, for traffic Genesys sends to you, the ranges returned by the Genesys Cloud IP ranges API. This guide takes each in turn, then covers ports, trunks, bandwidth, quality of service and proxies. Everything here reflects Genesys's pages as of 24 October 2026; Genesys revises these articles often, so check the linked source before you change a rule.

Since January 2026 Genesys has published its firewall domains and BYOC Cloud SIP addresses in two variants: the Legacy Cloud Voice platform and the Dynamic Cloud Voice platform. Genesys states that organisations set up in the Mexico, Singapore or European Sovereign regions should use the Dynamic Cloud Voice platform requirements. Most existing regions, including London, Dublin and Frankfurt, have entries under both, and the Dynamic platform adds a BYOC domain for each region.

The difference matters most for trunks. On the Legacy platform each region has four BYOC Cloud SIP addresses, all of which must be allowed. On the Dynamic platform each region has three ingress addresses and an egress block of four addresses. Before you build carrier or SBC rules, confirm which platform your organisation uses and take the addresses from the matching tab of Genesys's article.

Two domains are needed in every region: the mypurecloud.com family, with its subdomains, and a CloudFront domain that serves static content. Genesys lists the Resource Center, Developer Center, AppFoundry and SDK download domains as optional, and adds a small set of third-party domains for maps, fonts, DNS, time and phone provisioning. The table shows the interface domain for each region; an asterisk means services may sit in any subdomain. On the Dynamic tab, Genesys adds a BYOC domain for each region, in the form *.byoc.<region>.genesys.cloud; take the exact entries from that tab.

Genesys owns a small set of CIDR blocks for public media services, and Genesys says you must add the full set to your allowlist. For commercial regions, including satellite media regions such as Paris and Cape Town, those are 52.129.96.0/20, 169.150.104.0/21, 167.234.48.0/20 and 136.245.64.0/18. FedRAMP uses 164.152.64.0/22, and the European Sovereign Region uses 158.94.160.0/22. The 136.245.64.0/18 block was added in Genesys's 2024 expansion, so older allowlists may be missing it.

For traffic that Genesys Cloud sends out to your systems, such as data actions, Open Messaging, AudioHook, Audio Connector, SMTP, IMAP and recording encryption, Genesys publishes the source ranges through the IP ranges API, GET /api/v2/ipranges, which needs an OAuth token and returns each range with its service, region and direction. Everything else runs on AWS: build from AWS's published ip-ranges file and always include the AWS global region. Genesys has also listed 21 static CloudFront addresses for inbound access to the public API, marked as coming soon.

WebRTC is how most agents now take calls, and its requirements are short. Signalling and the application run over HTTPS and secure WebSockets on TCP 443. STUN on UDP 3478 discovers the network path; Genesys warns that if it is closed, calls will have a high rate of failure. Media, the encrypted audio itself, uses UDP 16384 to 65535. Genesys notes that this media range only needs to be opened for outbound connections, and that without it audio may be intermittent or missing. WebRTC uses the Opus codec only.

The same ports apply whether calls arrive through Genesys Cloud Voice, BYOC Cloud or BYOC Premises, and the client article adds video, screen share and screen recording over the same STUN and media ports. A TURN setting can force media through Genesys's relay, which shortens call set-up but reduces resiliency, and Genesys's relay addresses now sit in its own CIDR blocks.

With BYOC Cloud, your carrier or session border controller connects to Genesys Cloud over the internet, so the carrier side must be publicly reachable and the right ports open. Genesys lists 5061 for TLS and 5060 for UDP and TCP as the common trunk ports, recommends TCP where large user-to-user headers are sent, and requires both ends of the trunk to use the same protocol. Genesys's SIP addresses do not answer ping, and media addresses may differ from signalling addresses.

Secure trunks use SIP over TLS with SRTP. Genesys supports TLS 1.2, with listeners on port 5061 and an X.509 certificate signed by a public certificate authority. Mutual TLS is not supported, and neither is IPsec. Genesys changes the SRTP key on every re-INVITE, so the carrier must honour the new key or calls can lose audio in one direction. Media runs over UDP 16384 to 65535 on the Genesys side; your carrier provides the firewall settings for its side.

Edge devices bring their own requirements. Every connection to Genesys Cloud is initiated by the Edge, over HTTPS and secure WebSockets on TCP 443 to Genesys Cloud and AWS, using mutual TLS for client authentication, and an Edge trusts only the Genesys Cloud root certificate. Between Edges in a group, Genesys uses TLS on 8063 and SRTP on UDP 16384 to 65535. Phones register over UDP or TCP 5060 and TLS 5061, and carrier-side PSTN ports are set by the carrier.

Only the WAN port can have a default gateway, it needs external DNS, each network interface must sit on its own subnet, and VLANs are supported on the LAN port only. An Edge's HTTP proxy carries HTTP traffic only: SRTP and RTP never route through it. Genesys charges a monthly hardware usage fee for each Edge in service, shown in our cost guide, and is moving many premises customers to cloud media, which our Edge end-of-life guide covers.

Genesys's readiness guidance asks for 32 to 128 kbps of two-way bandwidth for each expected concurrent call using Opus, plus five per cent of that for SIP control traffic. It does not publish per-call figures for G.711, G.729 or G.722, and points to industry documentation instead. A screen recording typically needs 150 to 250 kbps, and a call recording on an Edge 32 kbps. Genesys also publishes a bandwidth calculator for sizing sites.

For latency and loss, Genesys sets separate targets for clients talking to Genesys Cloud, for Edges, and for the calls themselves, shown in the table. Genesys does not publish a jitter threshold, so treat any figure you see elsewhere as someone else's recommendation, and measure your own sites and home workers before go-live rather than after the first complaints.

Genesys recommends marking voice media as DSCP 46 (Expedited Forwarding), video media as DSCP 34 (AF41) and SIP signalling as DSCP 24 (CS3), and applying quality of service on every network device that carries voice or video, including WAN and MPLS links. Edge and trunk settings default to DSCP 46 for media. Genesys notes that it does not natively provide quality of service for WebRTC phones, so markings for browser-based agents depend on your own network policy, and on home networks are largely outside your control.

Inspection is the most common cause of trouble we find. Genesys states that an Edge will not allow another device to intercept its traffic: it treats SSL inspection as insecure and shuts the connection down. For home and hybrid agents behind cloud security platforms such as Zscaler, Netskope or Prisma, Genesys advises bypassing the Genesys Cloud media ranges, which avoids inspection problems, reduces latency and removes a point of failure. Antivirus software that inspects HTTPS and audio in real time can also lower WebRTC call quality.

Genesys Cloud clients have used only WebSockets for notifications since long polling was removed in July 2020, so any web proxy must pass secure WebSocket traffic; Genesys documents the proxy settings for its desktop app. Genesys supports voice and video over VPN connections, but split tunnelling media keeps it on the shortest path.

• Exclude Genesys Cloud media ranges and Edge traffic from SSL inspection.
• Allow secure WebSockets through every web proxy agents use.
• Split-tunnel Genesys Cloud media for remote agents behind security platforms or VPNs.
• Keep UDP 16384 to 65535 open outbound, including on home and guest networks.
• Re-check allowlists after each Genesys revision of its firewall articles.

QVCCS leadership has worked in contact centre technology since 1984, and network readiness is part of every design we produce. We start from Genesys's published requirements, map them to your sites, home workers, carriers and security platforms, and agree the rules with your network and security teams before go-live, not after the first complaint about audio. Where your policy will not allow outbound access to any destination, we build and document the allowlist, including the ranges Genesys sends from, and set a review against Genesys's revisions.

Our free IP ranges reference lists Genesys Cloud addresses by region, and our SIP trunk monitoring and SIP trace tools help find the cause when calls fail. Every delivery team member holds, or is completing, Genesys Cloud certification, and we work remotely unless agreed otherwise. Our pages on SIP trunks and session border controllers, and on WebRTC and headsets, cover the next steps.