🌐

EPIC Pre-Install Network Checklist for District IT

Quick Reference QR-AE-015 · Audio Enhancement EPIC · Rev 1.1 · Oct 2026

What the district's network team needs to have ready before VSC installs an EPIC system: addresses, VLANs, ports, internet hosts and certificates.

📄 View or download this guide as a PDF

Click the PDF icon below to open it right here in your browser. In the viewer, use Download (top right) to save a copy, or the printer icon to print it.

🤝

Written by: Brad Roy, VSC Director of Operations · Verified against: AE EPIC & VIEWpath Network Guidelines DC-41095.0725; Public Internet Access DC-41231.1125; SAFE+ Firewall Rules DC-41211.0925; Cybersecurity Model DC-41262.0726; VSC EPIC 3.2.5 demo server · Applies to: EPIC 3.x on-premises servers (AE appliance or district VM), MSx classroom devices, kiosks, InfoView, cameras

EPIC is an on-premises system: paging, bells, intercom and alerts all run on the school network and don't need the internet. Most install delays come from the network not being ready, so please work through this list with your VSC Project Coordinator before the install date.

1️⃣ Addresses and VLANs

✓	Item	Notes
☐	Static IP for the EPIC server	Plus subnet mask, gateway and DNS. Give it a DHCP reservation or a true static address; it must never change.
☐	IP plan for devices	MSx amps, CZA-1300s, kiosks, InfoView players, IP speakers and strobes. DHCP reservations or a static range. Send VSC the range.
☐	VLAN for EPIC	Keep the server and devices on their own VLAN (or your VoIP/security VLAN). Block student and guest networks from reaching EPIC.
☐	PoE budget	MS-700, MS-720 and MS-775 classroom amps run entirely on PoE+ (802.3at). The CZA-1300 needs PoE (802.3af) and AC power. Check each switch's total PoE budget, not just the ports.
☐	Switch ports patched	One per classroom amp, kiosk, InfoView and common-area amp, on the EPIC VLAN, labeled to match the room.
☐	NTP	Bells depend on time. Point EPIC at an internal NTP server, or allow UDP 123 to ntp.ubuntu.com and pool.ntp.org.

2️⃣ Internal ports (between VLANs or through an internal firewall)

From › To	Allow
EPIC › devices	TCP 80, 554, 12302, 12303 · UDP 4444, 5004, 5060
Devices › EPIC	TCP 2786, 8020, 8081 · UDP 123, 5004, 5060
Staff PCs, kiosks, phones › EPIC	TCP 80, 443, 3000, 3355, 3357, 3690, 4000, 4001, 4690, 5004, 8009, 8010, 8015, 8016, 8080, 8089, 8090, 9001, 9003
Audio (RTP)	UDP 10000–20000 between EPIC, its devices and any integrated VoIP phones
Discovery (optional)	mDNS lets EPIC find new devices automatically. If you block it, VSC adds devices by IP.

💡

Keep clients off the devices. AE recommends that staff and student computers don't talk to the MSx devices directly. Only the EPIC server needs to reach them.

3️⃣ Outbound internet (from the EPIC server only, HTTPS 443 unless noted)

Host	Why
licensing.audioenhancement.com	Daily license check for features
canonical.com · security.ubuntu.com · us.archive.ubuntu.com	System upgrades (TCP 80 and 443)
registry.npmjs.org	System upgrades
ntp.ubuntu.com · pool.ntp.org (UDP 123)	Time sync, if you don't provide an internal NTP server
ae-support.screenconnect.com · instance-ioy0tx-relay.screenconnect.com	AE remote support (outbound TCP 443). Whitelist these in web filters.

VIEWpath (classroom video, cloud): staff PCs and EPIC reach viewpath.audioenhancement.com and the district's [district]-district-storage.s3.amazonaws.com bucket. SAFE+ apps: allow *.aegix.global (safe, aim, api, app), 100.27.77.1 on TCP 80/443, plus Google Firebase Cloud Messaging and Google Maps.

⚠️

Never put EPIC on the public internet. No port forwarding, no public DNS. AE's terms prohibit it and the district takes on all the risk. For off-site access use the district VPN.

4️⃣ Friendly hostname and SSL certificate (recommended)

Pick a name (for example epic.district.k12.mi.us) and create an internal DNS A record pointing to the EPIC server. No external DNS.
Get a certificate for that name: an existing wildcard or SAN cert, a new one from a public CA, or one from your internal CA (internal/self-signed certs need to be trusted on staff devices). Some EPIC Mobile app features need a trusted public certificate.
Have it ready as .crt (certificate), .key (unencrypted private key) and .ca-bundle (intermediate). VSC or your admin imports it at Settings › System Settings › Network › Import SSL Certificate during a maintenance window; EPIC restarts.

5️⃣ Accounts and contacts

Decide SSO or LDAP for staff logins (see QR-AE-018), and who will be EPIC admins.
Give VSC a maintenance contact (name, email, phone). AE sends security and update bulletins to this contact.
Plan a backup destination: a district-owned, access-controlled network share for EPIC's encrypted daily or weekly backups.
If you're integrating VoIP phones, have your phone admin ready with an extension (see QR-AE-019).

🔧

VSC note: Send the completed checklist to your VSC Project Coordinator at least two weeks before the install. If the server will be a district VM, it needs: VMware only, 8 cores at 2 GHz, 8 GB RAM reserved, 500 GB thin-provisioned storage (SSD recommended), a 1 Gbps port on the EPIC VLAN, and an enterprise server 3 years old or newer. AE deploys it from a one-time OVA and needs remote and physical access, and a host that isn't on the campus it serves needs AE's signed acknowledgment (details in QR-AE-016).

📚 Sources & credits

Compiled by Brad Roy, VSC Director of Operations
Audio Enhancement: EPIC System & VIEWpath Network Guidelines DC-41095.0725 (ports, hosts, NTP, mDNS); EPIC Public Internet Access DC-41231.1125; SAFE+ Firewall Rules DC-41211.0925; EPIC Cybersecurity Framework Mapping DC-41262.0726 (maintenance contact, backups, blocking student networks)
Audio Enhancement: EPIC Remote Access Guide DC-40717.03 (support hosts); Hostnames and SSL Certificates in EPIC DC-40854.01 (2022; menu path re-checked on VSC's EPIC 3.2.5 demo server, 10/9/2026)
This is a guideline. Every district network is different, and the district is responsible for its own security configuration.