> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bland.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network and security

> Bland's regional SIP endpoints and IPs, what to allow-list on your firewall, and the TLS, SRTP, and codec requirements

Bland runs a SIP edge in four regions. Each region has one endpoint, two signaling IPs, and four media IPs, and all of them are static. This page lists them, what to allow on your firewall, and the security requirements every connection must meet.

## Connection endpoints

Connect to the endpoint closest to your infrastructure. Signaling and media use different IP addresses:

* **Signaling (calls you send to Bland):** TLS on TCP port 5061 only. Each region has two signaling IPs, one per availability zone, behind its endpoint. Send SIP to the endpoint and it balances across both.
* **Media:** SRTP on a separate set of four media IPs per region, over UDP ports 16384 to 32768.
* **Calls Bland places to you:** when Bland sends an `INVITE` to your SBC, for example for a [transfer](https://docs.bland.ai/agents/sip-transfers.md) or a warm transfer consult call, the TLS connection comes from one of the region's media IPs.

| Region | Endpoint (TLS 5061) | Signaling IPs (SIP you send to Bland) | Media IPs (RTP, and SIP over TLS that Bland sends to you) |
| - | - | - | - |
| United States | `us2.sip.bland.ai` | `35.82.60.77`, `52.27.163.2` | `52.13.231.129`, `35.160.144.213`, `44.234.13.26`, `54.218.96.252` |
| Canada | `ca2.sip.bland.ai` | `15.156.129.66`, `15.157.196.128` | `3.96.68.79`, `35.183.80.246`, `52.60.169.171`, `16.54.43.127` |
| Asia-Pacific | `asia2.sip.bland.ai` | `32.236.162.210`, `3.104.20.26` | `3.104.151.70`, `15.134.58.75`, `52.62.109.3`, `54.79.10.189` |
| Europe | `eu2.sip.bland.ai` | `52.17.235.44`, `34.250.51.24` | `3.248.61.228`, `54.194.194.135`, `52.215.80.226`, `108.132.103.51` |

Use the full SIP URI for your region, for example `us2.sip.bland.ai:5061;transport=tls`.

## Firewall allow-list

For your region:

* Allow outbound TLS on port 5061 from your SBC to the signaling IPs.
* Allow UDP 16384 to 32768 to and from the media IPs, or audio will not flow.
* Allow inbound SIP over TLS from all six IPs, signaling and media, and configure all six as trusted SIP peers on your SBC. A firewall rule alone is not enough: an SBC that doesn't recognize the source as a peer rejects the `INVITE` with `403 Forbidden`.

You can also copy the list from the **Firewall** section of the trunk's **Configure** tab, or fetch it with [`GET /v1/sip/firewall-ips`](https://docs.bland.ai/api-v1/get/sip-firewall-ips).

> [!NOTE]
>
> Allow-listing is mutual. Bland allow-lists your source IPs, and you allow-list Bland's.

> [!WARNING]
>
> Match Bland by source IP, not by the `Via` or `Contact` header. On an `INVITE` that Bland sends, those headers carry a signaling IP while the connection itself comes from a media IP.

## Requirements and security

| | Requirement |
| - | - |
| Transport | TLS 1.2 or higher, TCP port 5061 only. UDP and port 5060 are not accepted |
| Certificate | Let's Encrypt. Your SBC must trust the [ISRG Root X1](https://letsencrypt.org/certs/isrgrootx1.pem) CA |
| Media | SRTP with `AES_CM_128_HMAC_SHA1_80`, over UDP 16384 to 32768. RTCP uses the RTP port plus 1 |
| Codecs | Opus, G.722, PCMU (G.711 μ-law), PCMA (G.711 A-law). G.729 is not supported |
| Methods | `INVITE`, `ACK`, `BYE`, `CANCEL`, `OPTIONS`, `REFER` |
| DTMF | RFC 2833 (RTP telephone-event) |
| Number format | E.164 for phone numbers. DIDs and extensions on numbers attached to a trunk |
| Authentication | IP-based (default) or SIP REGISTER. Bland answers a `401` or `407` challenge on calls it places with the trunk's outbound call credentials |

## Limits

* Up to 100 numbers per attach request.
* Each number has one inbound and one outbound configuration.
* Test calls are limited to 10 per 15 minutes per organization.
* One endpoint discovery runs per organization at a time.
* Health checks probe outbound endpoints with SIP OPTIONS. An inbound-only configuration shows as "unchecked" because there is no outbound endpoint to probe.

## Next steps

> [card] [Set up a trunk](https://docs.bland.ai/agents/sip-setup.md)
>
> Create a trunk with the setup wizard.

> [card] [Static IPs](https://docs.bland.ai/platform/static-ips.md)
>
> Every IP Bland uses, beyond SIP.

Docs for agents: [llms.txt](https://docs.bland.ai/llms.txt)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.