One-way audio after VPN reconnect — WebRTC ICE candidate failure

Voice & Telephony
1

After a VPN reconnect, my agents are reporting one-way audio - they can hear the customer, but the customer can’t hear them.

This has nothing to do with email routing, but I’m replying because I’ve seen a similar ICE candidate failure in our email notification system. When the VPN drops, our email auto-routing rules also fail to re-establish the WebSocket connection, causing missed email assignments alongside the voice issue.

2

In Australia, this is extremely common for our remote agents on NBN (National Broadband Network) connections.

The NBN infrastructure frequently drops the UDP path used by WebRTC STUN/TURN relay. When the VPN reconnects, the browser holds stale ICE candidates from the old session. The STUN server validates the new public IP, but the old candidates are still cached locally, causing the one-way audio.

3

We saw the exact same issue when we migrated from Zendesk Talk to Genesys Cloud.

Zendesk Talk handled VPN reconnects gracefully because it used a server-side media relay that re-established the audio path automatically. Genesys Cloud’s peer-to-peer WebRTC model puts more burden on the client browser to renegotiate the ICE candidates.

4

One-way audio issues are killing our agent engagement metrics.

The gamification system counts ‘calls handled’ as a KPI. When an agent experiences one-way audio, the customer hangs up, the interaction is counted as ‘handled’ even though it was a technical failure. Our leaderboard rewards agents who sit in the broken state because they rack up short calls.

5

To fix the gamification scoring, we added a custom filter.

Any interaction with a duration under 10 seconds AND a ‘Disconnect’ initiated by the customer is excluded from the leaderboard points calculation. This prevents agents from getting false credit for broken audio calls.

6

If you are building a custom agent desktop in React, you can programmatically force an ICE restart when you detect the VPN change.

// Detect network change event
window.addEventListener('online', () => {
  // Force ICE restart on the active peer connection
  const pc = getActivePeerConnection();
  if (pc) {
    pc.restartIce();
    console.log('ICE restart triggered after network change');
  }
});

This forces the browser to renegotiate fresh candidates without requiring a full page refresh.

7

Or you could just tell your agents to press F5. I know, I know, revolutionary engineering.

But seriously, the root cause is that VPN software (especially Cisco AnyConnect) destroys the UDP socket bindings during reconnection. No amount of fancy ICE restart code will fix the fact that the OS-level socket table was just nuked. The only reliable fix is a full browser reload.

8

We built a ServiceNow automation to detect this.

Our monitoring script listens on the v2.users.{id}.conversationsummary WebSocket topic. If an agent’s interaction has been active for more than 30 seconds but the mediaStats show zero outbound RTP packets, we automatically create a P2 incident in ServiceNow and send the agent a browser notification saying ‘Please refresh your browser to restore audio.’