Backup Exec 2012 RALUS through firewall required ports

I'm running Backup Exec 2012 SP4 running on Windows Server 2008 R2 to back up, among others, a Red Had Enterprise Linux server with RALUS. The two are separated by a firewall which I control. I have read

http://www.symantec.com/docs/HOWTO73383

http://www.symantec.com/docs/HOWTO73384

http://www.symantec.com/docs/TECH43579

http://www.symantec.com/docs/TECH48490

http://www.symantec.com/docs/TECH49563

http://www.symantec.com/docs/TECH190459

but am still somewhat unsure which ports I need to open in which direction on the firewall. My current idea is to enable the "Dynamic TCP Port Range" option in Backup Exec Network and Security settings, set the range to, say, 57344-57375 for a total of 32 ports, and then in the firewall open

• TCP port 6101 (agent discovery) from RALUS to media server
• TCP port 10000 (control port) from media server to RALUS
• TCP port range 57344 to 57375 (dynamic ports) from media server to RALUS

Is that correct, or is it the opposite direction for the dynamic ports? Is port 10000 required in the opposite direction (RALUS to media server) too? What about the deduplication ports (10082, 10102 and possibly 10085 depending on which article you consult) - who needs those and when?

aTdHvAaNnKcSe,
Tilman