Five9 Technical Requirements
Five9 Technical Requirements
Requirements
Reference Guide
November 2023
Five9 and the Five9 logo are registered trademarks of Five9 and its
subsidiaries in the United States and other countries. Other marks and
brands may be claimed as the property of others. The product plans,
specifications, and descriptions herein are provided for information only and
subject to change without notice, and are provided without warranty of any
kind, express or implied. Copyright © 2023 Five9, Inc.
About Five9
Five9 is the leading provider of cloud contact center software, bringing the power of
the cloud to thousands of customers and facilitating more than three billion customer
interactions annually. Since 2001, Five9 has led the cloud revolution in contact
centers, delivering software to help organizations of every size transition from
premise-based software to the cloud. With its extensive expertise, technology, and
ecosystem of partners, Five9 delivers secure, reliable, scalable cloud contact center
software to help businesses create exceptional customer experiences, increase agent
productivity and deliver tangible results. For more information visit www.five9.com.
Trademarks
Five9®
Five9 Logo
Five9® SoCoCare™
Five9® Connect™
What’s New 8
Studio Requirements 52
Studio Workstation Requirements 52
Studio Network Requirements 52
Studio 7 Network Requirements 52
Network 60
Five9 Network Connectivity 60
Equinix Fabric 60
Agent Connect (MPLS) 61
Virtual Private Network (VPN) 61
VPN and Quality of Service (QOS) 61
VPN and Private IP Addresses 61
Direct Connect 62
Five9 Network Requirements (LAN and WAN) 62
Five9 Bandwidth Requirements 63
Five9 Network Recommendations 63
Bandwidth Requirements for Five9 Video Engagement for Agents 64
Other VoIP Services and Phones, Ports, IP Address Ranges, and Network Traffic 65
Five9 Internet Domains and IP Addresses 66
Five9 IP Address Ranges 66
Five9 IP Addresses for Global Voice 69
Five9 IP Addresses for Email 70
Five9 Connectivity Assessment Test 71
Five9 IP Addresses for Callback API Integration 71
Five9 Addresses for Five9 University 72
Five9 Internet Domains 72
CounterPath Softphone Requirements 75
WebRTC Requirements 76
Performance Dashboard 77
SIP Firewall Note 79
TCP/UDP Port Requirements for Softphone Customers 79
TCP/UDP Port Requirements for Gateway Customers 80
TCP/UDP Port Requirements for PSTN Customers 81
TCP and UDP Ports for Connectivity Assessment Test 82
TCP Port Requirements for FTP/SFTP 82
TCP Port Requirements for Five9 Performance Dashboard 83
Network Requirements for Five9 Video Engagement 83
References 94
Technical Glossary 94
Reference Documents 96
What’s New
RMI Protocol
RTP Protocol
Voice Quality Testing
Digital Certificates
Supported TLS Protocols
Important
Before configuring your organization, be sure to obtain the most current
security and legal information relevant to your business. For example, you can
start by consulting the Five9 enterprise-ready security pages (see Enterprise-
Ready Security) and your legal advisor.
RMI Protocol
Five9 uses the secure Remote Method Invocation (RMI) protocol for the Java-to-Java
communications between the Five9 client applications and Virtual Contact Center
platform. The RMI traffic is transmitted out of the firewall through open TCP ports by
using the TLS protocol.
RTP Protocol
Voice traffic for VCC is transferred using the Real-Time Transport Protocol (RTP). The
RTP download (inbound) streams the voice packets sent from the Five9 data center to
the agent’s softphone. The voice packets that represent the caller’s voice upstream
(outbound) are rebuilt in the softphone. The voice packets are sent from the agent’s
softphone to the Five9 data centers to be rebuilt and played back to the caller as the
agent’s voice. The voice packet transfer uses User Datagram Protocol (UDP) which is
faster and more efficient than TCP for time-sensitive applications, such as VoIP.
Intercepting the RTP stream to listen in on a leg of the call would require local network
access to successfully rebuild the packets into an intelligible voice stream.
Digital Certificates
To communicate securely with Five9 VCC, users may need to install on their
workstation these certificates from the certificate-issuing authorities that Five9 uses.
Important
Following industry best practices and certificate authorities (CA), Five9 will no
longer trust or certify secure TLS connections based on the certificates issued
by Symantec Root Certificate Authority (CA) listed below. If you do not replace
these distrusted certificates, your Five9 integration may not work. Therefore,
Five9 highly recommends that you replace the distrusted certificates with the
certificates issued by DigiCert.
DigiCert Certificates
Certificate Link
High https://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt.pem
Assurance
EV Root CA
Global Root https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
CA
l TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
l TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
l TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
l TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
l TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
l TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
l TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
l TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
l TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 (0xc026)
l TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 (0xc02a)
l TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
l TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
l TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA (0xc005)
l TLS_ECDH_RSA_WITH_AES_256_CBC_SHA (0xc00f)
l TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
l TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
l TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 (0xc025)
l TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 (0xc029)
l TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
l TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
l TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA (0xc004)
l TLS_ECDH_RSA_WITH_AES_128_CBC_SHA (0xc00e)
l TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
l TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
l TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
l TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02e)
l TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 (0xc032)
l TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
l TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02d)
l TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 (0xc031)
l TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
Important
For enhanced security, Five9 does not support inbound or outbound traffic
using the TLS 1.1 protocol. Ensure that the TLS 1.2 protocol is enabled in your
browser to connect to Five9 applications.
SIP trunks are VoIP-based carrier services offered by an Internet Telephony Service
Provider (ITSP) that uses the SIP protocol to set up communications between the PSTN
network and inbound, outbound, or blended calls by Five9 Agents. SIP trunks support
all domestic, International, and toll-free services.
Important
To ensure that your business is not affected during data center migrations, be
sure to configure a redundant data center regardless of the data center that
you use. For example, if your primary data center is ATL (Atlanta), your
alternate data center is SCL (Santa Clara).
A gateway, such as AVAYA, CISCO, or Asterisk, enables you to connect to Five9 with SIP
trunks across the Internet or through a VPN or Direct Connect Option.
To communicate with Five9, Agent Desktop Plus uses standard security protocols
HTTPS and Secure WebSocket (WSS), which are required for proxy servers. See
Supported TLS Protocols for details.
Hardware
Windows Platforms
l Apple M1 l Apple M1
Memory 8 GB 16 GB
Chromebooks
Chromebooks are supported for WebRTC only. The Five9 Softphone plug-in cannot be
installed on these products.
Operating Systems
Operating System Version Supported
Windows 32-Bit and 64-Bit l Windows 10, Pro, and Anniversary Update
Note
Specific Windows issues:
l Windows Media Player is not installed by default so the required MP3
codecs are absent. As a result, you cannot play sound alerts and
voicemail recordings in Firefox. To resolve this issue, download and
install the update for Windows 10: Windows 10 N and KN.
Web Browsers
Windows Platforms
Browser Version
Google Chrome™ Most recent three stable versions. Google Chrome is
automatically updated. Five9 makes every effort to test and
support the most recent version.
Five9 supports 32-bit and 64-bit versions of the Chrome browser.
Firefox Most recent three stable versions.
Five9 supports 32-bit and 64-bit versions of the Firefox browser.1
Microsoft Edge Most recent three stable versions.
Browser Version
Five9 supports Microsoft Edge based on Chromium.
1Five9 does not recommend using Firefox for WebRTC when multiple tabs are used.
Browser Version
Google Chrome™ Most recent three stable versions. Google Chrome is automatically
updated. Five9 makes every effort to test and support the most
recent version.
Firefox Most recent three stable versions.
Safari Most recent version.
Hardware
Windows Requirements
l Apple M1 l Apple M1
Memory 8 GB 16 GB
Operating Systems
Operating System Version Supported
Windows 32-Bit and 64-Bit l Windows 10, Pro, and Anniversary Update
l Windows 11 Pro and Enterprise
Web Browsers
Note
For Five9 Video Engagement, agents must install the SightCall plugin and the
browser extension. For more information, see the SightCall documentation.
Windows Platforms
Mobile Devices
To use Five9 Video Engagement on mobile devices, agents must install the SightCall
app. A free app is provided in the app store by SightCall for iOS and Android. For
supported devices and for information on installing the SightCall app on mobile
devices, see the SightCall documentation.
Video
To use Five9 Video Engagement, agents require a sound card and a built-in or
standalone webcam. For information on requirements, see the SightCall
documentation.
URL Description
five9.net Access to Five9 Intelligent Cloud Contact Center infrastructure and
services.
launchdarkly.com Access to feature management and continuous delivery.
For the public IP list for LaunchDarkly, see
https://app.launchdarkly.com/api/v2/public-ip-list.
googleapis.com Access to open-source CSS and fonts.
gstatic.com
cloud.google.com Access to Google Cloud.
pndsn.com Access to messaging API (by PubNub) for client-side
communication.
Note
Five9 does not specify requirements or support for the virtualization
server installation. For requirements and support information, contact
This configuration also supports a Dynamic Virtual Channel (DVC) plug-in mode that
enables the VDI softphone to support remote agents behind NAT firewalls or VPN. The
VDI softphone makes a first attempt using DVC then, if that fails, it will try to connect to
the agent’s terminal using port 8083.
You must meet the following requirements to use the VDI softphone option:
Five9 supports PSTN mode connections with telephony endpoints called over the
PSTN or PBX endpoints over a private SIP trunk.
Contact your Five9 representative to determine if these options are preferred options
to the VDI softphone option.
Virtual Channel Allow List. Set Virtual Channel Allow List to Disabled if you plan to
use VDI softphone proxy mode via the DVC plug-in.
Virtual IP Loopback Programs List. Add the following applications to this list:
l chrome.exe
l firefox.exe
l msedge.exe
l Five9SoftphoneService.exe
l java.exe
l javaw.exe
l javaws.exe (add this if you intend to run Five9 java clients inside of VDI session)
Note
There is no special configuration required for VMWare Horizon using the
Five9 VDI Softphone solution.
Other solutions that process the audio within the virtual session, such as the standard
softphone or WebRTC, can support Linux OS thin clients but may negatively impact
audio quality.
l Citrix Workspace 2019 (formerly Citrix Receiver). For detailed requirements, see
Citrix minimum requirements for Citrix Workspace.
l VMWare Horizon Client 8.3.0. For detailed requirements, see VMWare minimum
requirements for VMWare Horizon Client, Windows.
Note
VMWare Horizon Web Client is not supported.
Note
High-definition experience (HDX) protocol is supported when Five9
VDI softphone is used in DVC plug-in mode. HDX protocol is not
supported when using port 8083. For more information about HDX, see
How to Configure HDX Enlightened Data Transport Protocol
l Chrome
l Microsoft Edge
l Firefox
Hardware
Java Runtime Environment (JRE) for Applications
Operating Systems
Web Browsers
Five9 Supervisor
Hardware
Important
These requirements cover the use of Five9 applications. If agents use additional
applications while using Five9 applications, be sure that each computer has
sufficient hardware, a faster processor, and additional RAM to support all
required applications. Supervisors running reporting applications require
additional memory. See Workstation Requirements for Spreadsheet
Dashboards.
Important
If your domain has more than 5,000 users, ensure that any workstations that
run the Java-based Administrator application meet the recommended
hardware requirements (16GB RAM).
Windows Platforms
Component Minimum Version or Value Recommended
Processor Intel Core i5-4440, CPU 2.10 GHz Intel Core i7-4770, CPU 3.40 GHz
Memory 8 GB 16 GB
Screen 1024 x 768 or higher 1024 x 768 or higher
Resolution
Important
Versions 3 and 4 of the Five9 CTI Adapter for Salesforce are not supported on
Mac OS X platform. The Five9 Open CTI Adapter for Salesforce is supported on
Mac OS X releases.
Because the Five9 web-based applications do not require Java SE, Five9
strongly recommends that you migrate to the Five9 Plus applications. For more
information about the migration, contact your Five9 representative.
Component Version
Java Runtime 8.0 updates 371, 381, and 391.
Environment l For Windows systems, the 32-bit version is required to use the
softphone and the script and browser tabs in the Desktop Agent
application.
l For macOS BigSur and Java Runtime Environment 1.8.0_291, Five9
recommends to set the macOS Prefer Tabs = never option in
System Preferences under General settings.
Operating Systems
Web Browsers
Five9 supports 32-bit and 64-bit versions of the Chrome browser.
Five9 Supervisor
In addition to the preceding requirements, supervisors who use additional software
applications may require more RAM and a faster processor. Ensure that each
workstation has sufficient hardware to support all running applications.
Apple iPad
This section applies to the iPad Supervisor application. It does not apply to Supervisor
Plus and the Java Supervisor client.
l Codecs: The primary codecs are G711U and G711A. You may also use GSM or
ILBC, but these have not been tested.
l Browsers: Chrome and Safari are supported for the iPad Supervisor application.
l Headsets: Supervisors may use any headset compatible with iPad and any
Advanced Audio Distribution Profile-compatible (A2DP) Bluetooth device that is
certified by Apple for use with iPad devices.
Application Notes
Web Page Security and Visual IVR Scripts
Dashboards
Agent Desktop Plus with Digital Engagement
Integrated Administration Console
Application Notes
Dashboards
The browser must support Secure WebSocket (WSS) and SVG. Dashboards do not work
if the browser is set to Compatibility View.
Application Notes
Browser Version
Google Chrome™ Most recent three stable versions. Google Chrome is automatically
updated. Five9 makes every effort to test and support the most
recent version.
Hardware
Windows Platforms
Note
If you enable Secure RTP, the minimum workstation requirement is Intel
Pentium IV 2.66 GHZ or greater and 1.5 GB memory.
l Apple M1 l Apple M1
Memory 8 GB 16 GB
Operating Systems
Operating System Version Supported
Windows 32-Bit and 64-Bit l Windows 10, Pro
Web Browsers
For information about the browser configuration specific to your Plus adapter, see the
guides for your integration.
Important
Five9 has ended support for Microsoft® Internet Explorer for all products. Five9
will continue to support Internet Explorer version 11 for the Oracle Service
Cloud adapter only.
l ServiceNow
l Salesforce
l Zendesk
Safari is not supported for Agent Desktop Toolkit Plus,
Netsuite, or Oracle adapters.
Application Requirements
Five9 supports the Salesforce Lightning CTI mode, Sales Cloud, and Service Cloud with
the Professional, Enterprise, Unlimited, and Performance editions. The Plus Adapter for
Salesforce Lightning Experience is supported.
To avoid any potential service impact, Five9 strongly recommends that you
implement this change by January 20, 2022.
l Vancouver
l Utah
l Tokyo
l San Diego
Hardware
Component Version
Memory Add 512 MB to agent desktop requirements.
Operating Systems
Operating System Version Supported
Windows 32-Bit and 64-Bit l Windows 10, Pro
Web Browsers
The softphone requires a 32-bit version.
Application Requirements
Salesforce.com determines the web browsers and their versions supported for the
Salesforce development toolkit. Browsers are 32-bit versions only.
Workstation Requirements
Network Requirements (LAN and WAN)
Workstation Requirements
These requirements assume the Five9 Virtual Contact Center and Verint Systems
products are the only applications running in the agent’s workstation. Agents who use
additional software may require additional RAM and a faster processor. Sufficient
hardware to support all agent applications is at the discretion of the administrator.
Some features may require additional workstation components.
To allow your agents to create and leave conferences that contain an unlimited number
of participants, request from your Five9 representative that your domain be enabled.
As part of that process, you will be required to acknowledge that you will be
responsible for toll charges if your agents set up external non-business-related
conferences.
Hardware Requirements
Third-Party Software Required for Agent Stations
Third-Party Software Required for Browsing
Workstation Antivirus Settings
Java Runtime Settings Requirements for Verint
Supported Operating Systems
Supported Web Browsers
Browser Requirements for Verint Player
Workstation Requirements
Hardware Requirements
Component Requirement
Processor Minimum: 2 GHz; recommended: 3.2 GHz
Memory Minimum: 2.0 GB; recommended 4.0 GB.
Disk Space For desktop and process analytics: 10 MB for the client installation files
and 100 MB to ensure that processes run when there is no network
access.
Monitor Minimum resolution: 1280 x 800
Recommended resolution: 1280 x 1024 or higher
Network 10-100 Mbps 10-BaseT LAN Card.
This table lists the minimum third-party software requirements for the desktop
application installed in each agent’s computer.
Important
Install the desktop resources package before installing any other desktop
application.
Workstation Requirements
Workstation Requirements
To prevent scanning these files, ensure that each workstation is set up to exclude the
following items.
l In the Java Control Panel, enable Keep temporary files on my computer in all
client workstations. Otherwise, each time that users log in, security prompts are
displayed.
Workstation Requirements
l For systems using SSL with High Mode, in the Java Control Panel > Advanced >
Advanced Security Settings, enable Use TLS 1.2.
Workstation Requirements
Workstation Requirements
Microsoft Edge
Microsoft® Edge for Chromium v100 or higher is supported.
Google Chrome
Google® Chrome, version 45 or higher, is supported on Windows 32-bit and 64-bit
operating systems. The general Chrome settings described here apply to all desktop
applications. The location of the settings shown here use Chrome version 84, the
location you see may differ with Chrome version updates.
2 To add the five9-wfo portal addresses to the list of sites allowed to run
JavaScript, click Add.
Pop-ups are required for the following pop-up windows:
o Login
o DPA portal
3 To enable pop-ups, select Pop-ups Allowed and add the five9-wfo sites to the
list of sites allowed to display pop-ups.
4 To allow file downloads from the portal, such as DPA validator and reports,
select Ask or Allow for automatic downloads.
Interaction playback in Chrome or Edge for Chromium streams playback and does not
require installation of the Plugin Playback on the user’s desktop. The streaming player
uses the native browser capabilities to perform playback.
Firewall Requirements
These ports must be open for Verint application features. These ports apply to US,
Canada, and EU environments.
Note
All outbound requests from integration nodes and web services hosted
internally by Five9 will use the following IP addresses. Externally hosted
services such as Google App Engine or AWS will not use the IP addresses listed.
l RTP Media uses UDP ports 35000 - 65000 for PCI, AWS, and SNSW icare
(Aus PoP) otherwise 10200 - 28000.
Note
DNS SRV is the preferred method to use when connecting to Five9 SIP
resources.
Customers and partners wanting to allow specific IPs need to monitor the
provided domains for changes to underlying IPs offered.
IP Addresses
104.37.106.48/28
199.19.68.208/28
199.189.191.64/28
Note
All outbound requests from integration nodes and web services hosted
internally by Five9 will use the following IP addresses. Externally hosted
services such as Google App Engine or AWS will not use the IP addresses listed.
l RTP Media uses UDP ports 35000 - 65000 for PCI, AWS, and SNSW icare
(Aus PoP) otherwise 10200 - 28000.
Note
DNS SRV is the preferred method to use when connecting to Five9 SIP
resources.
Customers and partners wanting to allow specific IPs need to monitor the
provided domains for changes to underlying IPs offered.
UK SBC IPs.
Primary AZ Secondary AZ
primary.sip.uk.inferencecommunications.com secondary.sip.uk.inferencecommunications.com
34.255.92.105 52.211.77.33
IP Addresses
104.37.106.48/28
199.19.68.208/28
199.189.191.64/28
IP Address
202.147.137.0/28
Equinix Fabric
Five9 has partnered with Equinix to leverage the power of their Fabric to enable you to
establish secure dedicated bandwidth connections to Five9.
The Equinix Fabric™ is for customers who have networking equipment in Equinix
Fabric™ enabled co-locations. You procure Layer-3, Equinix Fabric subscriptions directly
from Equinix, who provides the Service Level Agreements (SLAs) for latency, packet
loss, and jitter when connecting to Five9 Edge locations.
l Chicago, US (CH3)
l Washington D.C., US (DC10)
l London, UK (LD5)
l Amsterdam, NL (AM4)
l Sao Paulo, BR (SP4)
l Tokyo, JP (TY11)
l Sydney, AU (SY5)
For more information about this connectivity option, contact your Five9 account
manager.
If a VPN tunnel exists between your premises and a Five9 data center, all traffic
traveling across the VPN tunnel should be routable by all Five9 VCC equipment. This
requires that all such traffic must use public IP addresses. If you plan to use a VPN,
apply Network Address Translation (NAT) to any traffic going inside VPN tunnel using
public IP addresses.
Direct Connect
Five9 data center internet connections provide 20 times more bandwidth than the
average usage and three times the fault tolerance. In most cases, using the public
internet as a transport between your network and Five9 network provides enough
bandwidth. The limiting factor is usually the last mile connection to your premises. If
you are required to establish direct connection to a Five9 data center, such as through
MPLS or Equinix Fabric™, the Direct Connect option provides this capability.
Direct Connect can be used as an alternative to VPN. Direct Connect is useful if you
want greater control over bandwidth and QoS for VoIP.
You are responsible for establishing a leased line connection to a Five9 data center and
for providing 10/100/1000MB full-duplex ethernet hand-off to connect to Five9
network equipment.
Important
The hand-off must be Layer-3, and the port must not have Layer-2 capabilities.
All traffic coming through the leased line use NAT to a publicly routable IP address or a
private IP address assigned to the LAN interface of the network router terminating the
connection.
For more information about these connection options, contact your Five9 account
manager.
Note
These values apply to the G.711 codec, which is used by default. G.711
provides an uncompressed high quality voice.
Multi-Party
Conference Active 30 Kbps 280 Kbps 280 Kbps 280 Kbps
Speaker HD
Conference Active 30 Kbps 130 Kbps 130 Kbps 130 Kbps
Speaker HD
Conference 0 Kbps +40 Kbps +40 Kbps +40 Kbps
Additional Passive
Speaker*
*Video conferences support the display of four passive speakers. Attendees can join a
conference in addition to the active speaker and on-screen passive speakers.
Screen Sharing
Maximum Resolution 2560 x 1600 2560 x 1600 2560 x 1600 2560 x 1600
Additional Bandwidth +20 Kbps +20 Kbps +20 Kbps +20 Kbps
The URL standard contains a port specification. For example: www.domain.com means
http://www.domain.com:443. The default port is generally omitted. Five9 URLs do not
use a port other than 443.
Five9 uses certain TCP/UDP ports for Five9 applications and communications.
Customers must avoid using the following TCP/UDP ports for any third-party services or
applications running on agent desktop computers: 8080, 9998, 11000, 30059.
Five9 recommends that you configure your firewall to allow traffic only at the TCP/ UDP
ports and source destination to or from any of the Five9 data center IP address
ranges/internet domains listed in this section.
Important
Five9 uses a two-minute TTL (time-to-live) setting on DNS records used for
automated failover between primary and secondary sites. Ensure that DNS
caching on your network does not override this two-minute TTL to avoid
potential issues in the event of a failover.
Note
If your network security protocols restrict the external IP addresses that you
can use, contact your Five9 representative for assistance in configuring Five9
email.
Important
Five9 is adding new IP addresses to the Canada data center.
To avoid any potential service impact, Five9 strongly recommends that you
implement this change by January 20, 2022.
Note
Intrusion Prevention Systems (IPS) solutions are designed to block real-time
traffic that matches certain attack behavior. Because every IPS solution
responds to traffic differently, and you may receive daily updates to attack
signatures, the behavior of IPS solutions can be unpredictable. False positives
are possible.
If your IPS overreacts to normal VOIP (SIP and RTP) traffic to and from Five9,
you may experience service interruptions.
Location IP Address
Dublin 34.241.191.251
Sao Paolo 18.231.8.114
Sydney 52.63.91.200
Tokyo 54.64.27.35
Important
Five9 is updating Global Voice for Tokyo, Sydney, and Sao Paulo with new IP
addresses.
Five9 is providing these new IP addresses in advance to allow you time to add
them to your firewall IP allowlist. Do not remove the current IP addresses from
your existing IP allowlist.
To avoid any potential service impact, Five9 strongly recommends that you
implement this change by January 20, 2022.
Location IP Address
Sydney 103.169.229.0/24
Tokyo 103.169.228.0/24
Sao Paulo 209.14.129.0/24
Location IP Address
Santa Clara 38.107.71.103
Santa Clara 198.105.200.22 - 198.105.200.25
Atlanta 198.105.202.16 - 198.105.202.18, 198.105.202.9
London 212.187.211.5 - 211.187.211.6
Canada 35.203.75.94
Tokyo 52.196.118.63
Sydney 3.105.227.19
Sao Paulo 18.229.56.203
Dublin 108.129.62.47
Location IP Address
US 35.231.25.195
34.70.24.218
35.243.214.240
34.66.82.195
35.229.109.107
34.71.1.196
35.185.70.123
35.192.111.252
104.196.65.187
146.148.69.156
EU 34.91.242.131
34.78.235.107
34.90.189.196
35.187.71.103
35.246.33.168
or
l If you specify firewall exceptions with IP addresses instead of FQDNs, add these
IP addresses to your list of allowed entities:
o 69.90.51.170
o 216.93.246.170
o 40.78.10.175
o 52.183.45.217
o 52.250.216.127
o 198.204.63.15
o 173.244.45.15
WebRTC Requirements
Web Real-Time Communication (WebRTC) enables agents to use their browsers to
communicate with customers. Agents do not need to install the softphone plug-in and
an extension because audio and video communications are inside web pages. Not all
agents in your domain need to use WebRTC. Agents can use the softphone as needed.
WebRTC is available in US, EU, Canada, and Five9 Global Voice (FGV) domains.
Requirements Description
Five9 Plus Supervisor Plus, Agent Desktop Plus, and Plus CRM adapters.
applications
WebRTC Domain enabled.
VDI See Virtual Desktop Requirements
Firewall l UDP outbound ports: 1024–65535
RTP between Five9 applications. If you do not use a stateful
firewall, configure inbound rules to allow return traffic. All ports
open for RTP must also allow STUN.
l TCP outbound port: 443
HTTPS-web communications for login, reporting, and customer
support.
Network For US/EU/UK/CA, see Five9 IP Address Ranges for networking
requirements by location.
Note: For Five9 FGV customers, allowlist the following addresses
for your locations:
l FGV PoP (Dublin)
WebSocket/Agent Registration: 54.73.166.58
Media: 54.195.40.249
Media: 63.34.119.26
l FGV PoP (Sao Paulo)
WebSocket/Agent Registration: 18.229.177.118
Media: 18.228.254.135
Media: 18.230.128.58
Requirements Description
Media: 177.71.247.2
l FGV PoP (Sydney)
WebSocket/Agent Registration: 13.211.19.119
Media: 52.64.122.16
Media: 3.105.60.140
l FGV PoP (Tokyo)
WebSocket/Agent Registration: 3.115.80.118
Media: 18.180.1.110
Media: 54.248.166.76
Performance Dashboard
To access Performance Dashboard, firewalls must allow the clearviewportal.com
domain and sub-domains. The list below shows specific DNS entries and the CNAME
(Alias) records as well as the A (Host) record they point to. For the data integrations to
work, the integration IPs must be allowlisted for Five9 user access if IP allowlisting is
used.
UI Access
l A (Host) uiwebalbfive9-1065485923.us-east-1.elb.amazonaws.com
Integration Server IP Addresses
l 34.192.10.54
l 18.212.41.50
UI Access
l A (Host) uiweboregonfive9-1563430220.us-west-2.elb.amazonaws.com
Integration Server IP Addresses
l 44.231.5.68
UI Access
l A (Alias) uiwebalb-1155967432.ca-central-1.elb.amazonaws.com
Integration server IP Addresses
l 35.182.166.66
l 35.183.6.253
EU Data Center
UI Access
l A (Alias) uiweb-112004485.eu-central-1.elb.amazonaws.com
Integration server IP Addresses
l 18.193.72.36
l 3.125.250.132
UK Data Center
UI Access
l A (Alias) uiweblondonfive9-700149032.eu-west-2.elb.amazonaws.com
Integration Server IP Addresses
l 35.176.128.134
l 52.56.93.155
ClearView is hosted by AWS Cloud. For more information, contact your Five9
representative.
You must also add these wildcard URLs to your list of allowed URLs (your allowlist):
To use Five9 Digital Engagement Email, Five9 IP addresses for email (see Five9 IP
Addresses for Email) require access to the applicable ports below or to the non-default
ports where your inbound or outbound mail service is provided.
SOAP APIs
For SOAP APIs, your external firewall needs to allow outbound connections on TCP Port
8843 from the computer using the API web services to the Five9 data center subnets.
For CTI Web Services, if you use Agent Desktop Toolkit, the TCP/UDP Port requirements
listed in this document for softphone, gateway or PSTN customers may apply.
Third-Party Software
Consult your CRM vendor’s technical documentation or customer support for details
about the domains in use with the respective applications.
Protocol Requirements
RTP Highest priority, low latency queue across the network infrastructure.
Source Ports: UDP 8000—8015
Destination Ports: UDP 1025—65535
SIP Can be in the highest priority queue but may also be in a second queue less
critical than RTP.
Source Port: UDP 5060
Destination Port: UDP 5080
Five9 VCC marks the SIP and RTP network packets for VoIP calls that are leaving Five9
destined for the customer or provider network. Five9 VCC does not mark the DSCP
header on packets leaving the workstation destined for the Five9 network. Five9
recommends that the network protocols defined for this purpose be marked and
prioritized by the workstation or the network infrastructure.
The Five9 Workforce Optimization (WFO) integration enables Five9 VCC to share
various data elements with the WFO Quality Monitoring (QM) and Workforce
Management (WFM) solutions.
The following sections describe the Workforce Optimization product requirements for
use with Five9 VCC.
Agent Workstation Requirements
Supervisor Workstation Requirements
Bandwidth Considerations
Hardware Requirements
Component Minimum Requirement Notes
Processor Dual-Core CPU. 2M Cache, No manufacturer required.
1.8 GHz, 800 MHz FSB.
Memory 2.0 GB 4.0 GB recommended for
Windows Vista or later.
Architecture 32-bit or 64-bit supported
Hard Disk 7200 RPM SATA HDD Cache of captured screen
2GB free required media resides locally on
10 GB free space required1 agent workstation.
Configuration of solution-
20 GB free space preferred1 specific options for local
cache are available.
Audio Devices Windows standard audio Headphones or speakers are
output device required for media playback.
Applicable device drivers
1 Required only by QM Screen Capture.
Operating Systems
Operating System Version (32-bit and 64-bit)
Windows Vista Service Pack 2
Windows 10 Home, Pro, and Enterprise Latest release
Windows 11 Pro and Enterprise Latest release
Web Browsers
The following web browsers are supported for all WFO components.
Browser* Version (32-bit)
Google Chrome Latest release.
Firefox Latest release.
Edge Latest release.
*Apple®Safari desktop browser is not supported.
Software Requirements
Component Requirement
Windows Media Player Version 9 or higher.
Configuration Requirements
Component Requirement
Local Permissions Configuration of Full Control permission to
local application installation directory is
required if agents are not administrative
users of their PCs.
Windows User Account Control Use of User Account Control is compatible.
An administrative user, bypassing UAC, is
required for the successful installation and
configuration of the client, whether
configuration is completed locally on the PC
or by an automated deployment method.
Local Firewall Exceptions to local Windows Firewall
policies may be required depending on site-
specific policies.
For more information, see deployment
instructions.
Local Antivirus or Antimalware Exceptions to local antivirus or malware
detection applications may be required
depending on site-specific policies.
Add the following executables in any
antivirus or antimalware program:
l <Installation Directory>\voacli.exe
l <Installation Directory>\voacld.exe
l <Installation Directory>\voacsc.exe
l <Installation Directory>\voacmt.exe
l <Installation Directory>\voacse.exe
l <Installation Directory>\voaclm.exe
l <Installation Directory>\RC\voacvc.exe
Firewall Policies
Source Destination Port Protocol Description
Agent PC 1 WFO CLOUD 443 TCP Screen capture client
HTTPS
heartbeat messaging.
Agent PC 1 WFO CLOUD 22 TCP Screen capture FTP file
transfer.
Agent PC WFO CLOUD 443 TCP Application Access.
Agent PC 2 WFO CLOUD 5018 TCP Live Agent Desktop Access.
Agent PC 2 WFO CLOUD 5019 TCP Live Agent Desktop Access.
Agent Workstations VO CLOUD ENV 4443 TCP Interaction Analytics UI
access.
1 Required only by QM Screen Capture.
Hardware Requirements
Component Minimum Requirement Notes
Processor Dual-Core CPU. No manufacturer required.
2M Cache, 1.8 GHz, 800
MHz FSB.
Memory 2.0 GB 4.0 GB recommended for
Windows Vista or later.
Architecture 32-bit or 64-bit supported
Hard Disk 7200 RPM SATA HDD Cache of captured screen
2GB free required media resides locally on
10 GB free space required1 agent workstation.
Configuration of solution-
20 GB free space preferred1 specific options for local
cache are available.
Audio Devices Windows standard audio Headphones or speakers are
output device required for media playback.
Applicable device drivers
1 Required only by QM Screen Capture.
Operating Systems
Operating System Version (32-bit and 64-bit)
Windows Vista Service Pack 2
Windows 10 Home, Pro, and Enterprise Latest release
Windows 11 Pro and Enterprise Latest release
Web Browsers
The following web browsers are supported for all WFO components.
Browser* Version (32-bit)
Google Chrome Latest release.
Firefox Versions 52 and 53.
Edge Latest release.
*Apple®Safari desktop browser is not supported.
Software Requirements
Component Requirement
Windows Media Player Version 9 or higher
Configuration Requirements
Component Requirement
Local Firewall Exceptions to local Windows Firewall policies may be
required depending on site-specific policies.
See deployment instructions for further detail.
Local Antivirus or Antim- Exceptions to local AV or malware detection applications
alware may be required depending on site-specific policies.
Add the following executables in any antivirus or
antimalware program:
l <Installation Directory>\voacli.exe
l <Installation Directory>\voacld.exe
l <Installation Directory>\voacsc.exe
l <Installation Directory>\voacmt.exe
l <Installation Directory>\voacse.exe
l <Installation Directory>\voaclm.exe
l <Installation Directory>\RC\voacvc.exe
Firewall Policies
Source Destination Port Protocol Description
Supervisor PC WFO CLOUD 443 TCP Application Access.
Supervisor/Adm VO CLOUD ENV 4443 TCP Interaction Analytics UI
Workstations access.
Bandwidth Considerations
Bandwidth Considerations
Internet bandwidth is used by Five9 Workforce Optimization (WFO) by two primary
mechanisms.
Screen capture uses bandwidth when screen cache data is moved from the agent
premise to the WFO cloud environment.
User Media Playback
Screen Capture Cache Transmission
Example Screen Capture Calculation
Screen capture usage estimates are provided for initial sizing only. Actual usage can
vary greatly depending on screen content, activity, monitor resolution, and other
environmental factors. Five9 recommends that for site-specific bandwidth usage
metrics, run a pilot group test during deployment.
Bandwidth Considerations
Example
50 agents (x) 2 monitors (x) 18,000 minutes recorded per day (x) 2.0 MB per
minute captured = 3.5 GB upload per day
Technical Glossary
Reference Documents
Technical Glossary
Term/Acronym Definition
ACL Lists that filter network traffic by controlling whether routed packets
are forwarded or blocked at the router's interfaces. Your router
examines each packet to determine whether to forward or drop the
packet, based on the criteria you specified within the access lists.
Codec Codecs are used to convert an analog voice signal to digitally
encoded version. Codecs vary in sound quality and bandwidth
required.
CTI Computer Telephony Integration.
Diffserv QoS Differentiated Services (Diffserv) QoS framework enables quality-of-
service provisioning in a network domain by applying rules at the
edges to create traffic aggregates and by coupling each of these with
a specific forwarding path treatment in the domain through use of a
code point in the IP header.
Digital Certificate Digital Certificates provide a means of proving identity in electronic
transactions. Also known as a public key certificate, the digital
certificate is an electronic document that uses digital signature to
bind a public key with an identity — information such as the name of
a person or an organization, their address, and so forth. The
certificate can be used to verify that a public key belongs to an
individual.
G.711 Two main VoIP compression algorithms:
l µ-law algorithm is used in North America & Japan.
l A-law algorithm is used in the rest of the world. The sample rate
is 64 kbit/s bit.
Technical Glossary
Term/Acronym Definition
G.729 ITU standard codec with two main versions: A and B. For VoIP
processing, the sample rate ranges from 28 to 40kbit/s bit,
depending on overhead.
MPLS Multiprotocol Label Switching (MPLS) is a pure IP architecture that
combines the strengths of Layer-3 routing and Layer-2 switching.
MPLS carrier networks are scalable virtual private networks (VPNs)
that provide end-to-end quality of service (QoS).
NAT Network Address Translation translates IP addresses used in one
network to a different IP address known to another network.
PAT Port Address Translation works with NAT to conserve IP addresses
used by permitting multiple devices on a local area network (LAN) to
be mapped to a single IP address.
RTP protocol Real-Time Transport is used with the RTP Control Protocol (RTCP).
RTP carries the media streams, such as audio and video whereas
RTCP monitors transmission statistics and quality of service (QoS)
and helps to synchronize multiple streams. With WebRTC, STUN
protocol messages are sent through these ports.
SBC Session Border Controller (SBC) is a device deployed in Voice over
Internet Protocol (VoIP) networks to exert control over the signaling
and usually the media streams involved in setting up, conducting,
and tearing down SIP calls.
SIP Session Initiation Protocol works in the Application Layer to control
communications for video, voice, IP, unicast, and multicast sessions.
SIP ALG SIP-ALG is a firewall that can perform NAT with standard SIP
protocols.
SIP Inspection To support SIP calls through the security appliance, signaling
messages for the media connection addresses, media ports, and
embryonic connections for the media must be inspected. While the
signaling is sent over a well-known destination port (UDP/TCP 5060),
the media streams are dynamically allocated. Also, SIP embeds IP
addresses in the user-data portion of the IP packet. SIP inspection
applies NAT for these embedded IP addresses.
SIP Trunking SIP trunks are VoIP-based carrier services based on the Session
Initiation Protocol (SIP) by which Internet telephony service
providers (ITSPs) deliver telephony PSTN Services.
STUN protocol Session Traversal Utilities for NAT is a Network Address Translator
(NAT) traversal tool for other protocols. STUN can be used by an
endpoint to determine the IP address and port allocated to it by a
Reference Documents
Term/Acronym Definition
NAT.
TCP/UDP Ports Transport Layer protocols, such as Transmission Control Protocol
(TCP) and the User Datagram Protocol (UDP), specify a source and
destination port number in their packet headers. A port number is a
16-bit unsigned integer, ranging from 0 to 65535. A process
associates its input or output channels via Internet sockets, a type of
file descriptors, with a transport protocol, a port number and an IP
address. This process is known as binding, which enables sending
and receiving data via the network.
TLS Transport Layer Security protocol that provides data secrecy and
integrity between applications.
VoIP Voice over Internet Protocol. Voice signals are transmitted over the
Internet rather than over the public switched telephone network
(PSTN).
VPN Virtual Private Network extends a private network so that the
resources that belong to that network are available by controlled
remote access.
WebRTC Web Real-Time Communication is an API definition drafted by the
World Wide Web Consortium (W3C) to support browser-to-browser
applications for voice, video chat, and P2P file sharing without either
internal or external plug-ins.
WSS Secure WebSocket protocol. Provides secure, full-duplex
communication channels over a single TCP connection. Used in web
browsers and web servers.
Reference Documents
Document Name Link
Session Initiation Protocol http://en.wikipedia.org/wiki/Session_Initiation_
Protocol
RFC 3261 SIP: Session Initiation http://www.ietf.org/rfc/rfc3261.txt
Protocol
VoIP Reference Guide http://www.voip-info.org/wiki/view/SIP
SIP Reference and Training http://www.thesipschool.com/
WebRTC - Wikipedia http://en.wikipedia.org/wiki/WebRTC