SCCM 2012 What Ports Do I need to open so DMZ servers can communicate with my SCCM Server?

Question

Hi,
What ports do I need to open in the firewall so my DMZ servers can talk to my SCCM server on the network?
Here are my steps before to make my DMZ servers talk to my SCCM server:
1.  On my SCCM 2012 SP1 CU2 I have bounderies installed --> I install SCCM Client on my DMZ server with the appropriate switches --> I go back to my SCCM server to approve the server --> Works
But now my DMZ servers stops getting definition updates from my SCCM server and I was suggested that it is much easier to open ports in DMZ.
Now, could you please tell me what ports should we open to ensure two way communication among servers?
Thanks!

Answer 1

Yes and no. It's a bit muddy at times.
For Internet based clients, putting an Internet-enabled MP in the DMZ is perfectly acceptable because Internet clients will only choose MPs enabled for Internet communication.
For systems in the DMZ, that's where it really gets muddy. There's no perfect way to accomplish this. IMO, DMZ clients should be allowed to go back to the MP/DP in the Intranet with a targeted opening in the DMZ firewall rules that allows them to only go
to the internal MP. That's a security policy question though for your organization.
Another option is to treat the clients in the DMZ as Internet only clients. This way, they will only go to the Internet MP in the DMZ. You do lose some functionality though like Remote Control.
A final way is to actually put an MP/DP in the DMZ and deal with the timeout's that happen when clients try to talk to the MP in the Intranet. Clients will try 5 times to contact that MP before giving up. They try to find a new MP at the following times
(which are not configurable):
- Every 25 hours
- WHen the client detects a network change
- When the client agent starts
Jason | http://blog.configmgrftw.com