All active Lifesize IP addresses are also listed in the admin console (manage.lifesizecloud.com) under Advanced Settings > Network.
Lifesize also announces new server locations and node addresses via the Lifesize Cloud Status Page located at status.lifesizecloud.com. Please subscribe so you’re always in the know.
Hi Robert,
will all traffic of Web App use automatically these gateways via TCP port 443 or are there additional ports/IP's necessary, e.g. Front-End cloud servers for authentication and signaling? What about chat?
I'm also interested in, if this will work in a browser via proxy or do we have to allow traffic to this gateways directly?
Is there a different behavior between IE and Chrome Web App?
Hi Martin,
Today Chrome and IE have a variation on how TCP443 tunneling works. Chrome is the easy one since it natively supports the WebRTC technology, anytime the Web App makes a call it will try to determine the best route for traversing a firewall, the final attempt will be pushing signaling and media over port 443 using TCP.
With the same scenario we found that in some instances the IE11 plug-in is only tunneling the signaling and sending the media directly to the node servers, if the node servers are blocked this will results in a temporary connection for ~60 seconds, black screen, then disconnect. We are in the process of analyzing this behavior and should know more soon.
For the time being, the recommended design is to allow the Node Server and TURN Server IP addresses via 443 if you are running into issues with the IE11 Web App.
Hi Robert,
we typically just have the cloud node IP's (front end servers) in our packet shaper and we have a rule for recording from Lifesize Cloud to our UVC Video Centre appliance again just using the cloud node IP's. Should we also be adding the ip's for the tunnel and turn servers for the desktop client and webapp? We allow outbound traffic through our firewall which allows us to use Lifesize Cloud easily. Just making sure that I'm not missing anything.
Hi jwinterbottom, I know you've asked this specifically of rmaloney, so I'll leave him to reply if he feels it's necessary. But in short, no you don't need the Tunnel GW or TURN servers defined if you permit access towards the Lifesize Cloud node IPs (front end servers) along with the recommended TCP & UDP ports.
These are only used in the event that the clients (Desktop + WebApp) are being used from restrictive network environments, which means they may be forced to fall-back to TCP 443 for media traversal. Most guest and corporate networks will permit outbound initiated access on this port, so calls are far more likely to connect this way when users are "on the go".
With this in-mind, one could argue that these IPs really are only published for your information, however we have many customers who consciously choose to further restrict their desktop machines from using outbound UDP and/or also restrict the destination IPs to really lock-down their security policy to defined hosts. There are potential draw backs to this, as TCP isn't quite as good for traversal of real-time media, but for those customers their security policies outweigh the potential drawbacks.
Anyway, I hope this helps?
Matt
Lifesize Se - UK, Ireland, BeNeLux and Nordics
Hi all,
I need some clarification on this. I was told that all I needed was the front end servers in our firewall rules but the latest versions or the webapp and desktop client will not allow us to record back to our video centre appliance. The previous desktop client has always been able to get to video centre with the rules we have in our firewall. I am missing a couple of the latest servers but I can't see how adding a node in paris and austin will make things start working when we are in Southern Ontario, Canada. None of our clients on the webapp have ability to record to our video centre now
Hi Jon,
There are some underlying changes in the architecture of the new Apps and how the calls are being routed/handled by our cloud infrastructure that may or may-not be having an impact here, but I'd kindly request that you raise a case with our support team to investigate further. Fortunately as you're likely already aware, the "old" Apps are still available for you and your colleagues in the meantime until our support team can dig deeper and help you to resolve the problem you're experiencing.
Contact the Lifesize Customer Support Team
Best regards,
Matt
Lifesize SE - UK, Ireland, BeNeLux and Nordics
Over here you showing 3 columns off IP's for different purposes, in the Cloud admin console where you are pointing at underneath the picture only the Node IP addresses are mentioned, isn't it helpful to show this diagram in total at the admin portal also?
Uunderneath an image how it is shown in the cloud admin console.
Patrick
Also useful would be to tell where this IP's are located so you can look if there are nodes near by. Is it possible to share the information where the new IP's / Nodes are located?
Hi, I am a little confused. Isn't the cloud web app and the cloud client using the same firewall ports? Just wanted to clarify so that I have a better understanding of how and if these lists of IPs are needed to be added to the firewall. Thanks.
MT, yes the thick client and web app do use the same network ports but if they are blocked they will use different tunneling mechanisms which require separate servers with different IP addresses. If all of the required ports are open the tunnel servers are not needed.
Hello,
We blocked the following ports to force the application to tunneling but it does not work.
- Tcp 35060/35061
- Udp 10000-28000
The bandwidth remains free.
The tunnel will be created over web ports TCP 80/443. Is there a proxy or other device inspecting web traffic? Are you able to log into the client at all?
I have make this post too fast without reviewing.
I think that we succeeded the tunneling but the bandwidth exceeds the 320Kbits which we put on manage.lifesizecloud.com. It is possible?
It would be more easy for our small customer if as in the client Clearsea we had the possibility of restraining the brandwidth in the application.
@Kevin : I don't know for a device inspecting web traffic.
Yes, the client connects.
Do you happen to have a full list of outbound ports required, divided by each of the four IP categories shown here? There is already a list on the support section of the website, but it doesn't easily line up with the four categories here, and when I pass this information to our system administrators in our offices then I need to be extra sure that it's precise and correct.
Stuart, if the system administrators permit the outbound ports listed in the "systems and apps connected to cloud" section of the support link Opening ports to the IP addresses in the first column (front end server) no other action would be required (for Icons, 220's, and Lifesize apps). The desktop and web app tunnel servers would only be used if the front end server ports are blocked. The SFB/Lync list is for callers using that technology to call into Lifesize Cloud.
Just to add to kpinkham's comments, there's more detailed information contained within our "Lifesize Technical Specialist" training notes, LTS - 6 Reference Documentation might be helpful in this regard.
Are changes to this communicated out to customers via Email / notification lists?
Hi Mike,
I would suggest you Follow the document, then you will be notified each time it is updated.
To follow this doc, click Actions at the top right of the window and then click Follow in: and check Inbox. That will make sure you are notified in your Inbox of the community. If you have not modified your settings, you will also be notified by email.
Hope that helps,
Michael
Subscribing to this document is recommended as mentioned by Michael. Additionally Lifesize has communicated the addition of node IP addresses via a banner at the top of the management console (manage.lifesizecloud.com) a few months before they were put into service.
Thank you for the reply. I'm hoping to add a company distro list to be notified so following this post under my account isn't really what I'm looking for.
Although routinely checking management consoles is doable, it would be appreciated to have a notification sent to customers which would allow us to be proactive , as the changes are made on Lifesize's end and relevant documentation is updated.
You could join the community with the distro account. Though, you'd want to update the profile of that account to limit the times it receives the digest. Not everyone on that list will probably appreciate a weekly digest update.
Hi Michael,
I would like to expand your list of IP addresses to support the Web App firewall traversal methodologies. Web App uses a different method for traversing a firewall than the desktop app does.
In some situations it might be necessary for the Web App to traverse over a single secure port (443 TCP), in these events the call will hand off to a new set of servers / IP addresses to accommodate the traversal method. These IP addresses are listed below.
- Robert