SCCM Restricted RPC Port Question

[stravze]

Hello all,

 

Was wondering if you could help me,

 

Here is some information about our infrastructure, so you understand why i'm asking this question

 

I'm trying to setup two Primary SCCM 2007 Site Servers in a hierarchy (Primary1 to Primary2)

 

Each SCCM is located in different domains (both 2008R2 root domain forests)

 

We have created two way transitive trusts between Domain1 and Domain2

 

We also have firewalls between both domains firewall1 and firewall2

 

So to allow Dynamic RPC traffic through the firewalls we have restricted RPC to use 49152 and 49153 (see MS KB)

 

http://support.microsoft.com/kb/224196

 

We have setup ACL's between Firewall1 and Firewall2 for the following:

 

Domain1_AD_Controllers and Domain2_AD_Controllers - Active_directory

Primary1 and Domain2_AD_Controllers - Active_directory

Primary2 and Domain1_AD_Controllers - Active_directory

and same on the reverse aswell

 

 

active_directory tcp-udp

group-object dns = 53

 

group-object ldap = 389 + 636

 

group-object kerberos = 88 + 464

 

group-object global_catalog = 3268 + 3269

 

group-object netbios = 137 + 138 + 139

 

group-object dc_rpc_static = 49152 + 49153

 

group-object ms_dfsr = 5722

 

group-object rpc_endpoint = 135

 

group-object smb = 445

 

group-object ntp = 123

 

 

Here is my question:

 

When trying to setup hierarchy, you have to add the other SCCM Site Server into the local Group SMS_SiteToSiteConnection_XXX and do the same on the other SCCM Site Server e.g.

SMS_SiteToSiteConnection_111 - Primary2

SMS_SiteToSiteConnection_222 - Priamry1

 

When querying the other active directory from the Site Server, the site server will connect to the domain controllers in the other domain directly to resolve computer names etc.

Primary1 and Domain2_AD_Controllers

or

Primary2 and Domain1_AD_Controllers

 

Now although at an Active Directory Level RPC is restricted to 49152 and 49153, why doesn't SCCM use these ports and uses the next available ports e.g.

49154

49155

 

Can we force SCCM to use the restricted ports because there is no point in opening RPC for 49152 to 65000

 

Hope this make sense, if not please asked away

 

regards

 

stravze