The Remote Agent for Windows Servers (RAWS) and Backup Exec Job Engine utilize a dynamic TCP port range for data communication ranging from 1025 to 65000. The control connection uses TCP port 10000.
Refer to the following technote which explains the communication in Backup Exec using NDMP.
http://seer.support.veritas.com/docs/255831.htm
1] Ensure that port 10000 is open in both directions.
2] Communication between the media server and the Remote Agent for Windows Servers will require 2 ports on the media server side and up to 2 ports on the remote agent side per operation.
If you plan on supporting multiple backups and restores occurring simultaneously, you must configure your firewall to allow a range of ports large enough to support the maximum number of simultaneous operations desired.
3] Also VERITAS recommends using a range of 50 allocated ports for the media server and 25 allocated ports for the remote systems. For optimum reliability, port ranges should not overlap.
Hope this answers your query.