BES Web Services (SOAP) only supports the secure ports via TLS. Retain initiates contact with BES Web Services if you are syncing the Address Book with the BES. Outgoing access is required for the Retain Server and incoming access for the BES server for the following ports:
BES 12: 18084 (TCP)
BES 10: 38443 (TCP)
BES 5: 443 (TCP)
111/2049 (UDP / TCP) on the Blackberry Enterprise Server (BES) for NFS Server services.
The Blackberry module requires incoming access if the Worker is not on the BES server so that it can retrieve the BES logs. Samba can be used, but NFS seems to be more reliable.
Other ports may need to be considered for NFS to work properly.
It is up to the customer to do this research to get NFS services to work properly.