media server can't connect to master web service

Hello,

during install (NetBackup 9.0), media server can't establish a connection to the master web service:

The setup wizard could not determine the security certificate mode of master server [win-XXX].

The command executed was: ["C:\Users\Administrator\AppData\Local\Temp\nbcertcmdtool.exe" -getSecConfig -caUsage -server win-XXX -installDir "C:\Program Files\Veritas\NetBackup" -atLibPath "C:\Users\Administrator\AppData\Local\Temp" -debugFile "C:\ProgramData\Veritas\NetBackup\InstallLogs\ExternalCertificateOp.20210407.122834.log"].

Command status: [8500].

Command output:
The external CA usage information could not be retrieved.
EXIT STATUS 8500: Connection with the web service was not established.

Looks like the problem is with firewall - the connection can be established, if I disable firewall completely.

Which port(s) should I open on firewall to allow communication during the install process?