Hello Dave, I've got some experiences with this.
Configure BE at Tools > Options > Network for the following:
1. Enable media server TCP dynamic port range: open up 10100--10150 (ports coming in to the backup server)
2. Enable remote agent TCP dynamic port range: open up 10151--10200 (ports going out to remote servers)
Next, open up port 10000 going out to the remote server on other side of firewall.
Next, open up the range in #1 above coming in through firewall to the IP of the backup server.
Lastly, open up the range in #2 above going out to the remote server.
Remember the range you specify in #1 and #2 above will be used for ALL remote servers you backup, not just the servers on other side of firewall.
Lastly, if your firewall is using one-to-many Network Address Translation (NAT) you must configure port forwarding for the range in #1 above to the IP of the backup server or you will not be able to backup across that type of firewall with Backup Exec 9.
Hope this would be helpful