System and Network Requirements - Amwell Carepoint Firewall Rules

This documentation was last updated on: 4/4/2024 6:01:27 PM (UTC).

Please find the System and Network requirements for Carepoint Firewall Rules below. Please click here to view Amwell’s full list of Products and their network requirements.

The most recent update to this page was on 11/01/2023 to add *.avizia.com to the list of destination links for port 443 under Amwell TV Kit 200S Platform Firewall Requirements. Please click here to view the complete System and Network Requirements change log.

Amwell Carepoint Firewall Rules

This article refers to all Amwell Proprietary Hardware devices – C250, C500, TV Kit 100 & 200

Hospital System Firewall requirements

Amwell Hospital Carepoints must be placed on a network that follows the rules listed below to allow for the appropriate incoming and outgoing traffic. Please supply your network administrator with the following mandatory details – these firewall permissions are needed for application functionality.

Firewall and Domain Permissions

• See the table below for specific domains and IPs (where available) that need to be allow listed on your network

Ports

• The firewall must be configured for outbound HTTP/HTTPS requests on ports listed in the table below

Amwell Hospital Carepoints employ an explicit firewall allow listing protocol that restricts all traffic on the device to specific domains and ports.

Firewall Allow List Requirements

The Amwell Hospital platform requires mandatory firewall permissions for minimum application functionality.

Please find our instructions on Split-Tunnel Virtual Private Network set up here – recommended for all Amwell products where providers are connecting via VPN.

Firewall and Domain Permissions

• *.amwell.com
• *.avizia.io
• *.avizia.com
• *.amwell.systems
• global.stun.twilio.com
• global.turn.twilio.com

Ports

• The firewall must be configured for requests on the following ports:

*Fail-over in case 40000-49999 cannot establish a connection.

**If using Amwell outside of the United States, please consult your Implementation Manager. STUN/TURN is not currently supported on the 210 Telemedicine cart.

†For the most restrictive networks. Note that you may see performance degradation in video quality. STUN/TURN is not currently supported on the 210 Telemedicine cart.

Converge Platform Firewall requirements

Please find our instructions on Split-Tunnel Virtual Private Network set up here – recommended for all Amwell products where providers are connecting via VPN.

Amwell TV Kit 200S Platform Firewall Requirements

The Amwell TV Kit 200 Carepoints must be placed on a network that follows the rules listed below to allow for the appropriate incoming and outgoing traffic. Please supply your network administrator with the following mandatory details – these firewall permissions are needed for application functionality. (These settings are required in addition to Amwell’s Converge network setting, which can be reviewed here).

Amwell TV Kit 200L Platform Firewall Requirements

The Amwell TV Kit 200L Carepoint must be placed on a network that follows the rules listed below to allow for the appropriate incoming and outgoing traffic. Please supply your network administrator with the following mandatory details – these firewall permissions are needed for application functionality for LG Virtual Visit Services and eSitter functionality. (These settings are required in addition to Amwell’s Converge network setting, which can be reviewed here).

1) NTP (“Network Time Protocol”) Server – The NTP server is required for device network time sync when device is initialized.
2) DMS (“Device Management”) service – this is the device management server for all Set top box and Goldeneye devices. It is the LG service that sits between devices and the Enterprise device portal, relating to onboarding devices, device settings/configuration, etc. We only expect devices to connect to this service.
3) CMS (“Call Management”) service – this is the service that handles all messaging and in‑call related management. It is used for real-time signaling between Providers and Devices and manages any video/webRTC room / connection states, as well as application specific in-call messaging (PTZ controls, e.g.). Both devices and providers/call participants connect to this service.
4) Pro:centric Servers – these are for updating the device firmware serving the device frontend application code. These must be accessible by the device for the system to function. The tenant/customer specific Pro:centric servers will be subdomains of these listed URLs.
5) DataDog Logging Service – In order to ensure stable operation of the system and to quickly recognize and resolve failures, we collect device logs using the DataDog service. (Only device-related logs are collected, and no other data that can be considered personal information is collected).

Home Platform Firewall requirements

Please find our instructions on Split-Tunnel Virtual Private Network set up here – recommended for all Amwell products where providers are connecting via VPN.

Firewall and Domain Permissions

• *.amwell.com
• *.avizia.io
• *.avizia.com
• *.amwell.systems
• global.stun.twilio.com
• global.turn.twilio.com

Ports

• The firewall must be configured for requests on the following ports:

*Fail-over in case 40000-49999 cannot establish a connection.

**If using Amwell outside of the United States, please consult your Implementation Manager.

†For the most restrictive networks. Note that you may see performance degradation in video quality.