System and Network Requirements - Amwell Platform

OS Platform	Supported Web Browser	Unsupported
Windows	Chrome (preferred) Edge Chromium Firefox	Opera DuckDuckGo
Mac	Safari* Chrome Firefox* * pop up feature has been disabled	Edge Chromium Opera DuckDuckGo Mobile Safari UIWebView**
Linux	Not Supported	Chrome
Chrome OS	Not Supported	Chrome
Android	Mobile Chrome Samsung Internet	Edge Chromium Opera Firefox Silk DuckDuckGo
iOS iPhone, iPad	Mobile Safari Chrome	Edge Chromium Opera Firefox DuckDuckGo Mobile Safari UIWebView**

Operating System Compatibility
Mac OS X (Most recent 3 versions)*
Windows 10 or Newer

*Video on macOS requires Safari version 11 or later

Mobile Device Minimum OS Requirements

*Please note that the Amwell Platform does NOT support A12 and A32 Samsung devices at this time.

* For optimal experience, no older than two versions behind the current OS should be used.

Required	Port	IP Addresses & URLs	Specification	Details
Mandatory for Amwell Platform	TCP: 443, 5349, 3478 10000-60000 UDP: 3478, 10000-60000	34.203.254.0/24 54.172.60.0/23 34.203.250.0/23 3.235.111.128/25 34.216.110.128/27 54.244.51.0/24 44.234.69.0/25 168.86.128.0/18 *.twilio.com	Twilio/Amwell Platform	Outbound established connections for audio and video streams
Mandatory for Amwell Platform	TCP: 80, 443, 5060, 5061 33000-49999 UDP: 3478, 33000-49999	18.97.140.128/25 18.98.7.0/25 *.amwell.systems	Amwell Platform/Pexip	Outbound established connections for audio and video streams
Mandatory for Amwell Platform	TCP: 80, 443, 3478, 5349 UDP: 3478	141.101.90.0/31 162.159.207.0/31 stun.cloudflare.com turn.cloudflare.com	Cloudflare/Amwell Platform/Pexip	Outbound established connections for audio and video streams for TURN and STUN
Mandatory for Amwell Platform	TCP: 443	*.amwell.com *.amwellnow.com *.amwlnw.com *.amwlehr.com *.amwell.systems *.embedded.converge.amwell.com/* firebasehostingproxy.page.link *.sendgrid.net images.ctfassets.net assets.ctfassets.net videos.ctfassets.net downloads.ctfassets.net images.secure.ctfassets.net assets.secure.ctfassets.net videos.secure.ctfassets.net downloads.secure.ctfassets.net *.myvirtualcare.com myvirtual.care/*	Amwell Platform	New URLs for Amwell Platform Product and Looker Reporting
Mandatory for Amwell Platform	TCP: 443	Production: https://cvg01-file-storing-file-storage-amwell-resources-1.s3.us-east-2.amazonaws.com https://cvg01-file-storing-file-storage-amwell-resources-2.s3.us-east-2.amazonaws.com Staging: https://stg01-file-storing-file-storage-amwell-resources-1.s3.us-east-2.amazonaws.com https://stg01-file-storing-file-storage-amwell-resources-2.s3.us-east-2.amazonaws.com	Amwell Platform	AWS S3 buckets that will contain files / images / resources for the provider profile.
On Demand on the Amwell Platform
Mandatory for On Demand Workflow	TCP: 443	Suki (Notes) Staging https://*.suki.ai/* https://*.suki-stage.com/* https://suki-api.okta.com/* Production https://*.suki.ai/* https://suki-api.okta.com/* Dr. First (eRx) Staging https://*.drfirst.com/* Production https://*.drfirst.com/* Health Gorilla (Labs) Staging https://*.healthgorilla.com/* Production https://*.healthgorilla.com/*
*Mandatory for Amwell Platform	TCP: 5060, 5061 33000-49999 UDP: 3478, 33000-49999	18.97.140.128/25 18.98.7.0/25 *.amwell.systems	Amwell Platform/Pexip (SIP Services)	Outbound established connections for audio and video streams

*If your interpretive services require safelisting of SIP Domains, allow the listed servers or IPs.

Understanding Deep Packet Inspection (DPI) and WebRTC Compatibility in Healthcare Endpoints

In healthcare environments (hospitals, clinics, telehealth setups using Pexip), laptops and desktops typically run enterprise-grade endpoint security and secure access software that performs deep packet inspection (DPI) or equivalent traffic analysis. These tools are required for HIPAA compliance, data loss prevention (DLP), and zero-trust security. They inspect packet payloads (not just headers), decrypt/re-encrypt TLS traffic, classify apps/protocols, and enforce policies in real time.

 

WebRTC traffic (which Pexip relies on heavily for browser-based video conferencing, media streams over UDP, DTLS-SRTP encryption, ICE/STUN/TURN, and signaling over WebSockets/HTTPS) is especially sensitive. DPI-based tools can:

• Break or delay DTLS handshakes during TLS inspection.
• Misclassify or throttle UDP media flows (WebRTC often uses dynamic high ports).
• Add latency, drop packets, or block connections if signatures don't perfectly match "approved" video traffic.
• Interfere with Pexip's TURN servers or direct peer connections.

This is a common source of issues like one-way audio/video, frozen screens, failed connections, or poor quality in Pexip WebRTC clients on corporate healthcare devices.

Common Apps/Agents That Run on Healthcare Laptops & Desktops and Use DPI (or DPI-like Inspection)

Here are the most frequently deployed ones in U.S. healthcare (based on widespread adoption for telehealth/zero-trust):

1. Zscaler Client Connector (ZCC / ZIA + ZPA)
   • What it does: Full inline proxy + DPI + 100% TLS/SSL decryption/re-encryption for all outbound traffic. It performs deep content inspection, DLP, threat detection, and app classification directly on the endpoint.
   • How it affects Pexip WebRTC: Routes and inspects WebRTC UDP/media flows; TLS inspection often breaks DTLS. Very common in healthcare for HIPAA-grade egress control.
   • Why in healthcare: Explicitly promoted for telehealth, PHI protection, and replacing traditional VPNs.
2. Netskope Client (or Netskope Private Access / SWG)
   • What it does: Client-based Secure Web Gateway with DPI, real-time TLS inspection, DLP, and cloud/SaaS traffic steering. Inspects payloads for threats, data exfiltration, and policy violations.
   • How it affects Pexip WebRTC: Common culprit for video conferencing disruptions (latency on UDP streams, inspection of WebRTC signaling). Netskope's healthcare threat reports highlight heavy use in the sector.
   • Why in healthcare: Strong focus on preventing PHI leaks to unsanctioned cloud apps and AI tools.
3. Palo Alto Networks GlobalProtect / Prisma Access Client
   • What it does: ZTNA/SWG client with App-ID, User-ID, and content inspection (DPI equivalent) plus threat prevention. Performs deep packet analysis and TLS decryption.
   • How it affects Pexip WebRTC: Can block or reroute media streams unless Pexip domains/ports are explicitly exempted.
   • Why in healthcare: Widely used for secure remote access and telehealth endpoints.
4. Symantec / Broadcom Endpoint Security (or Endpoint Protection with Web Protection / Network Threat Protection)
   • What it does: Host-based firewall + IPS + DPI-like packet inspection for threats and DLP. Includes web filtering and content scanning.
   • How it affects Pexip WebRTC: IPS signatures or deep inspection can interfere with WebRTC protocols.
5. Forcepoint Endpoint / Web Security or DLP Client
   • What it does: Explicit SSL/TLS inspection + DPI for data security and threat prevention. Often paired with SD-WAN or endpoint agents.
   • How it affects Pexip WebRTC: Inspects encrypted video traffic and can disrupt real-time flows.
6. Other Endpoint DLP Tools with DPI Integration (less common but relevant)
   • Examples: Netwrix Endpoint Protector (explicitly combines endpoint DLP with DPI for packet payload analysis), Digital Guardian/Fortra, or Symantec DLP endpoint agents.
   • These scan network flows directly on the host for sensitive data (e.g., PHI in video streams or metadata).

Less likely but possible:

• CrowdStrike Falcon (very common EDR in healthcare) has network threat detection but lighter DPI than the above SWG/ZTNA tools.
• Microsoft Defender for Endpoint (network protection features) — usually milder impact unless custom policies are aggressive.

Quick Troubleshooting Tips for Pexip WebRTC Issues

Healthcare IT teams usually resolve this by:

• Adding bypass/exclusion rules for Pexip domains (e.g., *.pexip.com, TURN/STUN servers) and WebRTC UDP ports (typically 5000–65535, plus 443/80 for signaling).
• Disabling TLS inspection or enabling "pass-through" for Pexip traffic.
• Whitelisting in the client's policy (Zscaler/Netskope/etc. have specific video-conferencing exceptions).

Pexip's own docs (telehealth/Epic integration guides) and general WebRTC troubleshooting recommend network/proxy exceptions exactly for these enterprise inspection tools.

Deep Packet Inspection (DPI) has a mixed but often disruptive impact on WebRTC, particularly in enterprise, healthcare, or ISP-managed networks (common in telemedicine setups like yours with Twilio Video or Pexip Infinity). It excels at traffic classification and security but frequently introduces latency, connectivity failures, and media issues due to how it interacts with WebRTC's protocols.

Reference -  https://help.pexip.com/service/optimize-experience.htm

Network appliances manipulating packets

Consider if there are security appliances at the network edge which could be delaying the transfer of media traffic. Is there deep packet inspection that is adding delay? Such packet inspection policies will lead to sluggish video call behavior.

Key Effects of DPI on WebRTC

1. Classification and Heuristic-Based Treatment (Even with Encryption) SRTP encrypts the media payload, but the first 12 bytes of the RTP header remain unencrypted (SSRC, sequence number, timestamp, etc.). DPI uses this plus packet size, inter-arrival timing, RTP timestamp increments, and DTLS handshake fingerprints to reliably identify "WebRTC/RTP video/audio streams."→ Result: DPI can apply QoS rules, throttle bandwidth, deprioritize, or drop flows—even if it can't read the actual video/audio content. This is why WebRTC resists blind blocking better than unencrypted VoIP (DTLS makes it look like HTTPS traffic, risking collateral damage if over-blocked), but smart DPI still fingerprints and treats it specially.
2. Added Latency, Jitter, and Packet Processing Delay DPI inspection (stateful tracking, pattern matching) adds 5–50+ ms per packet in busy networks. Real-time apps hate this—WebRTC's congestion control (Google Congestion Control) reacts poorly, leading to lower resolution, higher packet loss, or freezing. In high-security environments (HIPAA-compliant healthcare networks), DPI + traffic shaping often makes calls feel "laggy" compared to direct internet.
3. UDP Flow Timeouts and Premature Session Teardown Many DPI/firewall combos (e.g., Palo Alto) have aggressive UDP idle timeouts (default ~30s). WebRTC media is bursty; silent periods (e.g., during screen-share-only or low-motion video) cause the flow to be torn down. → Classic symptoms:
   • One-way audio/video
   • Black screens (remote track stops rendering)
   • Intermittent reconnects or "media lost" after initial connection This is extremely common in Pexip deployments and Twilio Video on corporate networks.
4. ICE Candidate Failures and Blocked Direct Paths DPI can drop STUN Binding requests/responses or block high-port UDP (WebRTC's dynamic RTP range: usually 49152–65535).
   • Direct peer-to-peer paths fail → fallback to TURN (good) or total failure (bad).
   • Partial success: Signaling works, but media doesn't → black screen / one-way media. DTLS ClientHello fingerprints are sometimes explicitly blocked in restrictive networks (e.g., certain countries or high-security enterprises).
5. Throttling or Selective Dropping Once classified, DPI might rate-limit "video" flows or reorder packets (hurts jitter buffer). In extreme cases, it triggers active probing that breaks DTLS handshakes.

 

Common DPI-Using Apps/Agents in Healthcare Environments

These are the most frequently deployed endpoint agents on healthcare devices (based on industry standards for hospitals, clinics, and telehealth):

Category	Common Tools/Agents	DPI/Inspection Type	Typical Impact on Pexip WebRTC
DLP (Data Loss Prevention)	Symantec/Broadcom DLP Endpoint, Forcepoint DLP Endpoint, Microsoft Purview DLP, Digital Guardian	Deep content inspection of network traffic, clipboard, files	Scans outbound traffic for PHI → can block or quarantine WebRTC streams
EDR/XDR / Endpoint Security	Microsoft Defender for Endpoint, CrowdStrike Falcon, Palo Alto Cortex XDR	Network threat protection + DPI-like inspection	Classifies UDP as threat → drops media packets
SASE / Secure Web Gateway Clients	Zscaler Client Connector, Netskope Client	Full DPI + SSL/TLS decryption & re-encryption	Intercepts all traffic → breaks DTLS, adds latency
VPN / Firewall Clients	Palo Alto GlobalProtect, Cisco AnyConnect (with security modules)	Traffic inspection + policy enforcement	UDP port restrictions or unknown protocol blocking

Note: These agents run silently in the background with kernel-level hooks. Network-level firewalls (e.g., Palo Alto NGFW) add another layer but the question focuses on laptop/desktop apps.