Mursion Magic — Tech Implementation & Network Requirements (Human-Powered)

Before You Begin

Before configuring your network, review the Supported Browsers & Device Requirements article so your IT team understands the browser, webcam, and microphone requirements participants will need on their end. Confirming these requirements up front prevents network changes from being undermined by an unsupported device later on.

Network & Firewall Planning

Start by mapping out where your participants will connect from:

• Single office network: you'll typically only need to update one firewall.
• Multiple offices, departments, or cohorts with different firewall policies: each of those networks will need the same allowlist applied.
• VPN connections: confirm whether participants connect through a VPN. VPNs often apply different filtering rules than a standard office connection, and unaddressed VPN filtering is one of the most common causes of connection failures we see.

Testing Recommendations

Once your network changes are in place, test connectivity with a small group of participants representing each office location, firewall environment, and VPN or non-VPN configuration you support. Run this test at least 48 hours before a participant's first live session so any remaining issues can be resolved without delaying a scheduled simulation.

Human-Powered Allowlist (Ports, Domains, IPs)

Human-powered Mursion Magic sessions require outbound and inbound access to the following TURN servers over the standard WebRTC TCP and UDP port ranges:

Make sure content filters and proxies are not blocking WebRTC traffic even when these ports are already open elsewhere in your configuration. This allowlist should only include human-powered destinations — AI/LiveKit destinations are covered separately in the AI Simulations article.

Zscaler SSL Inspection Bypass

If your organization uses Zscaler or a similar SSL inspection tool, exclude the following domains from SSL inspection:

• portal.mursion.com
• turn-west-001.mursion.com
• turn-west-002.mursion.com

Without this exclusion, participants typically experience dropped connections mid-session or a black screen when they try to join, since the inspection process interferes with the encrypted media stream.

WebSocket & HTTPS Allowlist

In addition to the TURN servers above, allowlist the wss:// and https:// traffic for:

• portal.mursion.com
• magictest-signaling.mursion.com

Email Allowlisting

So participants reliably receive scheduling confirmations and session reminders, allowlist the following in your email security tools:

• no-reply@mursion.com
• scheduling@mursion.com
• mursion.com (domain)

Link redirects in these emails also route through mursion.com, so that domain needs to be permitted for links to open correctly as well.

When to Contact Support

If a connection issue can't be resolved using the steps above, email support@mursion.com with:

• Your organization name
• The affected participant location(s)
• The browser and operating system in use
• A screenshot (or short recording) of the error
• The date and time of the affected session