An agent accepts a call, a red banner appears in the Contact Control Panel (CCP), and the contact drops to Missed. The headset is fine, the queue is fine and the contact flow is fine. What failed is the browser’s path to the Amazon Connect media endpoint, and on most corporate networks the firewall is the reason.
This guide shows how to confirm that diagnosis from the CCP log, exactly what to allow (UDP 3478 to the TurnNLB hosts, plus the DNS to resolve them), how to test the fix, and which look-alike problems are not firewall problems.
Quick answer
- The media endpoint is Amazon Connect softphone media, reached at
TurnNlb-*.elb.REGION.amazonaws.comon UDP 3478, outbound. - When it is blocked, agents see Failed to establish softphone connection, or ice_collection_timeout / Call failed due to a browser-side WebRTC issue, and the CCP log shows ICE collection timed out.
- The fix: allow outbound UDP 3478 to the TurnNLB hosts for your instance’s Region (or the
AMAZON_CONNECTIP ranges) and make sure those hostnames resolve in DNS. - Open inbound ephemeral UDP ports only if your firewall is stateless.
- Verify with the AWS Endpoint Test Utility, then audit the rest of your rules with the free Allowlist Auditor.
What is the Amazon Connect media endpoint?
The CCP talks to three groups of endpoints, and each one fails in its own way.
| Endpoint type | What it does | What to allow | Port |
|---|---|---|---|
| Signalling | Sets up the call session over a WebSocket | *.transport.connect.REGION.amazonaws.com (CCP v2), rtc*.connect-telecom.REGION.amazonaws.com (CCP v1) |
TCP 443 |
| Media | Carries the voice audio (WebRTC through a TURN relay) | TurnNlb-*.elb.REGION.amazonaws.com |
UDP 3478 |
| API and static content | Sign-in, agent API, telemetry, CCP assets | INSTANCE.my.connect.aws (/ccp-v2, /api), *.telemetry.connect.REGION.amazonaws.com, *.cloudfront.net |
TCP 443 |
Replace REGION with the AWS Region where your Connect instance lives, not where your agents sit.
Most firewall policies are built around web traffic. A rule set that lets the CCP load and sign in over TCP 443 can still block the UDP media path, so the agent logs in, sees the queue, and misses every call. Working login with failing audio points straight at the media endpoint.
Symptoms: what a blocked media endpoint looks like
| Where | What you see | What it means |
|---|---|---|
| CCP banner | Failed to establish softphone connection … Browser unable to establish media channel with turn:TurnNlb-xxxx.elb.REGION.amazonaws.com:3478?transport=udp |
The browser can’t reach the TURN host: UDP 3478 is blocked, or DNS for the TurnNlb name isn’t resolving |
| CCP banner | ice_collection_timeout, Call failed due to a browser-side WebRTC issue |
The request to softphone media timed out, so the browser couldn’t collect ICE candidates |
| CCP log | softphone WARN {contact ID} SESSION ICE collection timed out |
Same failure, seen from the log |
| CCP log | SESSION No ICE candidate and ConnectSignalingAndIceCollectionState => FailedState |
Media connection never reached a usable state |
| CCP log, mid-call | softphone INFO {contact ID} SESSION Lost ICE connection |
The media path was lost during the call (idle timeouts, VPN, packet loss) |
| Contact record | Missed contact, no ring | The agent never got a working softphone session |
Read the log before you touch the firewall, because the other two endpoint types produce different errors:
- Signalling failures (
Failed connecting to signaling server Timeout,signalling_connection_failure) mean TCP 443 or the WebSocket upgrade is blocked. - API failures (
acceptContactfailed withNetworkingError,Network Failure) mean the API endpoints are blocked.
Three endpoint types, three different fixes. Our guide on how to download and read Amazon Connect CCP logs shows how to get the log, and the free CCP Log Parser groups ICE failures, media timeouts and lost connections for you in the browser.
Step-by-step: confirm and fix a blocked media endpoint
Step 1: Pull the CCP log from the affected agent
Open the CCP on the machine where the problem happened, select the Settings (gear) icon, and choose Download logs. Search for ICE. If you see ICE collection timeouts around the failed call, you are on the media path and can move on. (Or check this article to know, how to download the ccp logs)
Step 2: Run the AWS Endpoint Test Utility from the same network
AWS recommends the Endpoint Test Utility when agents have CCP problems. It checks that the browser supports WebRTC, that microphone and speakers are accessible, latency to every active Connect Region (and to your instance, if you supply it), and network connectivity across the ports required for media streams. A failed media-port check from the affected agent’s network is strong evidence for a firewall block.
You can pre-fill the tool with URL parameters. This example runs automatically against your instance and two Regions:
https://tools.connect.aws/endpoint-test/?autoRun=true&connectInstanceUrl=https://myinstance.my.connect.aws®ions=us-east-1,us-west-2Download the JSON results and attach them to your firewall change request or support case. The same run also reports average latency; AWS says it shouldn’t exceed 300 ms.
You also can try KloudMint Tool – Amazon Connect Agent Workstation Test
Step 3: Test DNS resolution for the TurnNLB hosts
From the agent’s network, resolve one of the TurnNLB hostnames for your Region:
nslookup TurnNlb-d76454ac48d20c1e.elb.us-east-1.amazonaws.com(That is the us-east-1 example from the AWS documentation. Use a host for your own Region.)
- Does not resolve: DNS filtering or a split-horizon DNS setup is blocking the name. Allow
TurnNlb-*.elb.REGION.amazonaws.comor the specific hostnames. - Resolves, but calls still fail: DNS is not your problem. A resolved name only proves DNS works, so the UDP 3478 path is the next suspect.
One nuance from AWS: if you allowlist the Connect IP ranges and have no DNS restrictions, you don’t need the TurnNlb domain entry. Most teams that use domain-based rules (Option 1 below) need it.
Step 4: Allow outbound UDP 3478
Create an outbound rule from the agent subnets to the media endpoints on UDP 3478. AWS describes two ways to do it.
Option 1 (recommended): domain allowlist
| Entry | Port | Purpose |
|---|---|---|
TurnNlb-*.elb.REGION.amazonaws.com |
UDP 3478 | Softphone media (TURN) |
*.transport.connect.REGION.amazonaws.com |
TCP 443 | Signalling, CCP v2 |
rtc*.connect-telecom.REGION.amazonaws.com |
TCP 443 | Signalling, CCP v1 |
INSTANCE.my.connect.aws (/ccp-v2, /api, /auth/authorize, /awas/api) |
TCP 443 | CCP, API, sign-in |
*.telemetry.connect.REGION.amazonaws.com |
TCP 443 | Telemetry |
participant.connect.REGION.amazonaws.com |
TCP 443 | Chat participant API |
*.cloudfront.net |
TCP 443 | Static CCP assets |
If your policy doesn’t allow the TurnNlb-* wildcard, AWS publishes the specific hostnames per Region. us-east-1 and us-west-2 list five each; most other Regions list one or two.
If you still use the older INSTANCE.awsapps.com/connect/... URLs, note that AWS says the awsapps.com domain is going away and points to a migration guide for moving to my.connect.aws.
Option 2 (not recommended by AWS): IP ranges
ip-ranges.json service |
Region | Port |
|---|---|---|
AMAZON_CONNECT |
GLOBAL plus your instance’s Region | UDP 3478 |
EC2 |
GLOBAL plus your instance’s Region | TCP 443 |
CLOUDFRONT |
Global | TCP 443 |
S3 |
us-east-1, us-west-2 and your instance’s Region | TCP 443 |
The Connect /19 range is exclusive to Amazon Connect, but it changes: new ranges are published in ip-ranges.json at least 30 days before they are used, then ramp up over roughly two weeks. If you go this route, automate a watch on that file.
Step 5: Handle stateless firewalls
A stateful firewall lets the return traffic for an outbound UDP session back in. A stateless one doesn’t. If yours is stateless, also allow inbound ephemeral UDP from the AMAZON_CONNECT ranges: 49152–65535 for Windows workstations, 32768–61000 for Linux.
Step 6: Rule out proxies, VPNs and NAT
If the rules look right and audio still fails, isolate the middle boxes:
- Proxy: test one agent without it. WebSocket handling in some proxy products can break the signalling endpoints, so AWS advises testing before production. Also raise the proxy or firewall’s SSL certificate cache timeout to cover a whole shift, breaks included, so certificate renewals don’t cut agents off mid-shift.
- VPN: test with the VPN off. Encrypted tunnels add overhead and latency to real-time audio.
- NAT: NAT traversal can cause one-way or no audio when misconfigured. AWS suggests static NAT where possible and keep-alives enabled.
- Wi-Fi: use wired Ethernet where you can. Jitter and packet loss show up as audio problems that look like firewall problems.
Agents on a virtual desktop add another variable. Run the VDI Compatibility Tester inside the session before blaming the perimeter.
Step 7: Re-test properly
One successful call proves little. AWS suggests testing a domain-allowlist setup with more than 200 calls and watching for softphone errors, dropped calls and conference or transfer failures. If more than 2 percent fail, AWS says the cause may be proxy resolution, and Option 2 is worth considering. Then run the Agent Workstation Validator on a few representative workstations.
Numbers worth knowing
| Metric | Threshold | Where to check |
|---|---|---|
| Average latency to the instance | Should not exceed 300 ms | Endpoint Test Utility |
ToInstancePacketLossRate |
A ratio above 0.2 signals a significant network problem | CloudWatch, for the time of the incident |
| Failure rate on a domain-allowlist trial | Above 2 percent: investigate proxy resolution | Your 200-call test |
Not a firewall problem? Look-alikes to rule out
| Symptom | Likely cause | What to do |
|---|---|---|
| Microphone is not accessible | Browser microphone permission, or Firefox with the CCP tab not in focus | Check browser permissions; the Endpoint Test Utility tests media devices |
| Initialization Failed | Missing domain or IP entries for the API and signalling endpoints | Re-check the full Option 1 list |
| Dead air on the first call after a reboot (Windows 11, Chrome or Edge) | The network card restarts when the browser requests audio prioritisation | With IT, set qWAVE, ndisuio.sys, dmwAppushSvc, SstpSvc and RasMan from Manual to Automatic |
| Agent hears the customer, customer can’t hear the agent | Another app has exclusive control of the microphone or speaker | Turn off exclusive mode for the audio device |
| CCP freezes for tens of seconds | High latency, or too little CPU or memory (screen recorders, noise suppression, VDI, browser extensions) | Check API call metrics in the CCP log; disable extensions to test |
Using AWS Network Firewall in the agent path? If your agents reach the internet through a VPC protected by AWS Network Firewall (a common VDI pattern), check the firewall’s own health before editing rules. AWS documents that a firewall endpoint in a failed state, for example a misconfigured KMS key or a generic fail-closed condition, drops all traffic directed to it. The status message is in the VPC console under Network Firewall > Firewalls (hover over the endpoint status) and can take up to 15 minutes to appear. This page is about the health of the Network Firewall service itself, so don’t confuse it with the Connect media endpoint.
Building a custom CCP? A media-less CCP built on the Streams API doesn’t need ports opened for communication with Amazon Connect, though it still needs the EC2 and CloudFront access described above.
Prevention checklist
- Allowlist by domain, not by IP, and keep the rule set Region-specific.
- Allow
TurnNlb-*.elb.REGION.amazonaws.comon UDP 3478, and confirm DNS resolves it. - Set the SSL certificate cache timeout to at least a full shift.
- If you use IP ranges, monitor
ip-ranges.jsonand update within 30 days. - Re-audit after every firewall policy or vendor change with the Allowlist Auditor.
- Test every new agent site with the Endpoint Test Utility before go-live.
- Agents who sign in with SAML also need the AWS sign-in endpoints allowed; see our IAM SAML authentication troubleshooting guide.
- Where agents’ routes to AWS are inconsistent, AWS notes Direct Connect can help with latency and connectivity between your edge router and AWS.
Copy-paste request for your network team
Subject: Amazon Connect softphone calls failing - please allow media traffic
Agents at [site] cannot answer Amazon Connect calls. The CCP shows Failed to establish softphone connection and the log shows ICE collection timed out.
Please allow from agent subnet [x] to the internet:
1. UDP 3478 outbound to TurnNlb-*.elb.[region].amazonaws.com
2. TCP 443 outbound to *.transport.connect.[region].amazonaws.com (WebSocket upgrade must pass)
3. DNS resolution for the TurnNlb hostnames
4. If the firewall is stateless: inbound UDP 49152-65535 (Windows) or 32768-61000 (Linux) from the AMAZON_CONNECT ranges
Instance Region: [region]
Endpoint Test Utility results attached.Frequently asked questions
What port does the Amazon Connect media endpoint use?
UDP 3478, outbound, to TurnNlb-*.elb.REGION.amazonaws.com. Signalling and API traffic use TCP 443.
Does allowing TCP 443 fix “Failed to establish softphone connection”?
No. TCP 443 covers signalling, API and static content. Softphone media travels separately over UDP 3478.
Do I need to open inbound ports for the CCP?
Usually not. The CCP uses persistent outbound connections from the browser. Only stateless firewalls need inbound ephemeral UDP ports for return traffic.
nslookup works but calls still fail. Why?
Resolving the TurnNlb name only proves DNS. If it resolves and calls still fail, check that UDP 3478 is allowed end to end, and test without the proxy or VPN.
Can I allowlist IP ranges instead of domains?
Yes (Option 2), but AWS recommends domains. IP ranges change, with at least 30 days’ notice in ip-ranges.json.
How do I tell a media failure from a signalling failure?
By the log. ICE collection and No ICE candidate messages point to media (UDP 3478). Failed connecting to signaling server points to signalling (TCP 443 and WebSocket).
Try it now: generate your Region’s full firewall list with the free Allowlist Auditor, then parse the failing agent’s log in the CCP Log Parser. Nothing to install. Browse the rest on the Amazon Connect tools page.
References
- AWS: Set up your network to use the CCP
- AWS: Contact Control Panel (CCP) issues
- AWS: Troubleshoot your network for call quality and disconnect problems
- AWS: Validate connectivity with the Endpoint Test Utility
- AWS re:Post: How do I troubleshoot Amazon Connect CCP softphone errors?
- AWS Network Firewall: Troubleshooting firewall endpoint failures
- AWS Knowledge Center video: How do I troubleshoot CCP user interface errors in Amazon Connect?