MP in DMZ for Internet facing clients and MAC systems

Question

I am planning to install an MP, DP and SUP in our DMZ to be able to manage following
 - Internet facing clients
 - In house MAC system
 - All Mobile device
I was wondering what ports I would be needing to open in DMZ so communication in/out DMZ to corporate is not compromised?
Also, would single box be able to handle all of the above role or I would need additional Primary site insdie the DMZ considering DMZ is residing in different forest?
I understand PKI is necessary to accomplish this so I am looking into it as well.
Anyone done this before and had any issues so please share so I can take advantage of your experience.
Thank you for your respond.

Answer 1

You need to put a single box in the DMZ that has the enrollment point, SUP, MP, DP roles on it.  Remember that internet facing site box doesn't have to be domain joined.
for ports you need to be able to push SQL, 445, 135, 8530 (WSUS), ports into the DMZ.  If the DMZ isn't able to have the ability to push into the perimeter network then you need to click the box that says "site server initated" this will make the primary
on the inside reach into the DMZ ever hour and pull out status messages and other data left that can't come back into the company.
Port listing
http://technet.microsoft.com/en-us/library/hh427328.aspx
Internet based is pretty much the same as it was in 2007 so you can use the docs for further information like scenerios:
http://technet.microsoft.com/en-us/library/bb693824.aspx
you will need to have the ability to export the cert and move it to the DMZ or you close the walls on the outside, make the make on the inside of the network, get the certs then bring up the firewall that forces it into the DMZ. 
It is a bit more complicated than that but it is not easy to outline this proceedure in a single post. 
http://www.sccm-tools.com http://sms-hints-tricks.blogspot.com