About the deployment connections and ports

• Trunk connections between Microsoft infrastructure elements not shown.

• Media/signaling connections required for Microsoft client to client calls not shown.

• Microsoft port ranges may vary from those shown here; check the Microsoft documentation to determine the port ranges defined for your infrastructure.

• Cisco Unified Communications Manager and collaboration endpoint connections not shown (for clarity). You can see an example of those on MRA Connections.

• Multiple media paths are possible because there are two TURN servers in the DMZ. "Any" source IP address is listed because ICE negotiation could mean the media path uses a relay address provided by one of the TURN servers, or a reflexive address from the egress side of a firewall/NAT.

• The Microsoft Interoperability service on the gateway Expressway has a shared pool of media ports (default 56000-57000). The service can use any port in the range for media connection on either TCP or UDP transport.

• The drawing shows two IP addresses on the Expressway-E because you may have one or two NICs enabled on the Expressway-E. The address you enter for the TURN server (on the Microsoft interoperability configuration of the gateway Expressway) is the one that should listen on 3478 (TCP and UDP).