Who this is for: Any office with a firewall that limits outbound traffic, and any IT person setting up firewall rules.
What goes wrong
- Desk phones show as offline or never finish setting up.
- The app signs in but calls fail, or connect with no audio.
- Video meetings won't start or have no audio or video.
- Calls work on cell data but not on the office network.
Why it happens
Phones and apps need to reach Cannon VoIP's servers on certain ports. A port is like a numbered door that a certain kind of traffic uses.
If your firewall only allows web browsing out, or blocks unknown traffic, the phones can't connect or the audio is blocked.
How to fix it
- Allow OUTBOUND traffic from your office network to the server names and ports in the table below.
- Allow the replies to come back in. Most firewalls do this automatically for traffic that started inside your office. You should not need to open any inbound ports.
- Set rules by server name, not by IP address. Our addresses can change. If your firewall only accepts IP addresses, call support at 888-973-0515 for the current list.
- Turn off SIP ALG or SIP inspection. Don't let the firewall inspect or rewrite call traffic. See Turn Off SIP ALG.
- Give UDP sessions at least 300 seconds before they time out. See Set UDP Timeouts.
- Save the changes and restart the phones.
| Allow outbound to | Ports | What it's for |
|---|---|---|
| app.cannonvoip.com | TCP 443 | Portal, apps, desk phone setup and updates |
| app.cannonvoip.com | TCP 8443 | App and browser calling |
| sip.cannonvoip.com | UDP and TCP 5060, TCP 5061 | Desk phone call setup (5061 is the encrypted one) |
| Cannon VoIP servers | UDP 30000 to 39999 | Call audio |
| turn.cannonvoip.com | UDP and TCP 3478, UDP 40000 to 49151 | Keeps app calls working on strict networks |
| Cannon VoIP servers | UDP 50000 to 50999 | Video meetings |
Allow by server name, not IP address, because our addresses can change. If your firewall needs IP addresses, call support at 888-973-0515 for the current list.
Notes for common router types
- On most home and small office routers, outbound traffic is allowed by default, so this page usually only matters if someone has added blocking rules.
- On most business firewalls, add an outbound rule (sometimes called a policy or access rule) from your LAN to the server names above, using an address object or FQDN object (a rule based on a name instead of an IP address).
- If your firewall has app control or intrusion prevention, make sure it isn't blocking or slowing SIP or voice traffic. Exclude the phones or Cannon VoIP's servers if needed.
How to tell it worked
- Run the free Net Checker. It checks that your network can reach Cannon VoIP and that the needed ports are open.
- Desk phones show as online in the Cannon VoIP portal.
- A call from the app on office Wi-Fi has clear audio both ways.
Still having trouble? Contact Cannon VoIP support at 888-973-0515 or support@cannonvoip.com.
More router settings that affect call quality
- Turn Off SIP ALG
- Set UDP Timeouts to at Least 300 Seconds
- Fix Double NAT (Two Routers in a Row)
- Prioritize Voice Traffic with QoS
- Fix Bufferbloat with Smart Queue Management
- Stop Wi-Fi Band Steering and Roaming from Dropping Calls
- Guest and Isolated Wi-Fi Blocking the App
- DNS and Content Filtering Blocking Cannon VoIP
- VPNs and Security Software Interfering with Calls
- Mesh Wi-Fi Systems and Calls Cutting Out
- Wi-Fi Power Saving Causing Missed Calls
- Mobile Hotspots and Carrier-Grade NAT
See all router settings · What makes call quality good or bad