Cisco TelePresence Administrator's Manual page 237

The ports used by these services are configurable on the
TURN).
The ICE clients on each of the SIP endpoints must be able to discover these ports, either by using SRV
records in DNS or by direct configuration.
Ports for connections out to the public internet
In situations where the VCS Expressway is attempting to connect to an endpoint on the public internet, you
will not know the exact ports on the endpoint to which the connection will be made. This is because the ports
to be used are determined by the endpoint and advised to the VCS Expressway only after the server has
located the endpoint on the public internet. This may cause problems if your VCS Expressway is located
within a DMZ (that is, there is a firewall between the VCS Expressway and the public internet) as you will not
be able to specify in advance rules that will allow you to connect out to the endpoint's ports.
You can however specify the ports on the VCS Expressway that are used for calls to and from endpoints on
the public internet so that your firewall administrator can allow connections via these ports. The ports that
can be configured for this purpose are:
H.323
TCP/1720: signaling
UDP/1719: signaling
UDP/50000-54999: media
TCP/15000-19999: signaling
Cisco VCS Administrator Guide (X7.2)
TURN
SIP
TCP/5061: signaling
UDP/5060 (default): signaling
UDP/50000-54999: media
TCP: a temporary port in the range
25000-29999 is allocated
page (VCS configuration > Expressway >
TURN
UDP/3478 (default): TURN services
UDP/60000-61200 (default range):
media
Firewall traversal
Page 237 of 498