CSAgent to VMS/CSAMC communication is on TCP port 5401 with a fallback to 443 if 5401 is not available, so either one of these will need to be opened through to the server.
Browser to CSAMC communication needs TCP ports 1741 (http), 1742 (https) and 443 (https). This is only if you want to access the CSA Management Center screen from one of these PC's.