Netbackup connect to port 10000. As far as I know Netbackup doesn't use SSH for NDMP backup.
This is from the Netbackup port usage guide:
ftp://exftpp.symantec.com/pub/support/products/NetBackup_Enterprise_Server/281623.pdf
If you are using an NDMP storage unit in a firewall environment, make sure you
know the different types of NDMP backups to be performed. The backup type
determines which ports need to be opened in the firewall. The following
paragraphs describe the types of NDMP backups and how they pertain to
firewall use. These backup types include local, 3-way and remote NDMP, remote
NDMP and local and 3-way TIR.
■ For local operations, the DMA needs access to port 10,000 on the NDMP
server. In this case, the one NDMP server is both the NDMP tape server and
the NDMP data server.
■ For 3-way and remote NDMP, the DMA needs access to port 10,000 on the
NDMP tape server and the NDMP data server. Also, there cannot be a
firewall between the NDMP tape server and the NDMP data server because
there is no control over the TCP/IP ports used for the data movement.
■ For remote NDMP (5.0 / 5.1), it is not advisable to put a firewall between the
DMA and the NDMP hosts. This is because the DMA can be on the same
computer as the NDMP tape server. In this case, you need an unlimited
number of ports available to perform the data movement between the
NDMP tape server and the NDMP data server.
■ For local and 3-way TIR, the data requires an unlimited number of ports
available because NetBackup has no control over the ports used.
