The following ports should be allowed to and from the Session Border Controller addresses:
Session Border Controllers:
As for other services which could be used for phone configuration and firmware upgrades, those can and will change and are dependent upon the endpoints. We currently use:
Our preferred method is HTTPS, but as of right now, only the Sipuras and Linksys support it. Of these protocols, the only one which a company is likely to block outbound is TFTP. Even that is not very common for sessions initiated from the local LAN.