Blog Post

Skype for Business Blog
2 MIN READ

Transport Relay Evaluation - CQD

Aaron Steele's avatar
Aaron Steele
Former Employee
Dec 14, 2017

As we've shared at Ignite and in other blogs, there is a change underway to Office 365 Skype for Business. With the new IP and Port ranges in use for both Skype for Business and Teams when using Transport Relay there are customers who are having challenges completing media setup using these IPS and ports.  When reviewing quality metrics a problem could be detected which indicates users in the tenants organization will fail when attempting to join meetings, share video, share audio, or share applications. Among the possible causes for this failure we know that customer firewall, proxy, or VPN device/software and client level software can influence customers ability to use Skype for Business and Teams.

 

As we work to complete this change it is paramount that customers review and update Skype For Business Online or Microsoft Teams rules on their firewalls, proxies, and VPN devices/software. Specific attention should be given to the following IP ranges, ports, and protocols that are used for media connectivity:

IPV6 Ranges:

2620:1ec:40::/42

2603:1027::/48

2603:1037::/48

2603:1047::/48

2603:1057::/48

IPV4 Ranges:

13.107.8.0/24

13.107.64.0/18

52.112.0.0/14

104.44.195.0/24

104.44.200.0/23

Ports:

TCP 443

UDP 3478, 3479,3480, 3481

 

For additional information please reference the following articles:

https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2

 

We have also prepared a template for CQD online that you can import that will help narrow down network infrastructure devices in a customer environment that could be impacting the ability to establish media.  Please see the template attached to this blog and we would love to hear from you.

 

 

Updated Jan 18, 2018
Version 5.0

18 Comments

  • You can open a service request with Microsoft support to help you with this issue. But if our data shows it's not open, and your Firewall team says it is, there must be some way to come to agreement. Data from CQD showing source subnet with source of failure has always been my go-to source of truth.

  • Our firewall team mentioned all the ports and IP address allowed in the firewall, but microsoft deducted us it is not allowed. More over we are also having failure in the audio communication. Please let us know what is the best way to update firewall team

  • Hello, this file needs to be imported into cqd through the detailed reports tab from the top menu. Sign into cqd.lync.com as a tenant or SFB admin, or someone with the Reports Reader role in your Office365 tenant. Open the detailed reports from the top menu that starts at Summary reports, and click import on the left hand pane.

  • Thanks Tom. We created two, so you as the end could see one increasing in quantity (UDP) and the other decreasing (TCP), as well in the UDP one, you as the admin could also add second server reflexive for the possibility to see the egress IP that is most impacting this problems for you and your users. That same thing doesn't render in the TCP filtered view any additional information and in the UDP might break out the subnet into other buckets depending on your routing and IP allocations so we left it to you to decide.
  •  

    Nice report Aaron Steele thanks.


    I'm not sure I'm 100% appreciating the difference between the two subreports?