we had to list open ports for our current customer in order for firewall to be setup properly.
On 7.4.1 here's what needs to be open:
port TCP/4750 from appservers to agents
port TCP/9840 (authentication service), TCP/9841 (appserver service), TCP/9842 (optional - NSH proxy service) from CM consoles to appservers.
Hope this helps