Inbound calls - Once calls are delivered to PureCloud Voice by the various PSTN providers SIP signaling is encrypted via TLS (Transport Layer Security) and voice is encrypted via sRTP (secure real time protocol). Outbound calls are also encrypted with similar standards/protocols until they egress to PSTN from PureCloud Voice.
PureCloud Voice would need access to specific ports based on the voice endpoints used. This would be in addition to the various ports typically used by PureCloud. A comprehensive listing of port usage in PureCloud and PureCloud Voice is located at the following link:
https://help.mypurecloud.com/articles/purecloud-ports-services/