The following table lists ports and processes associated with Symantec Endpoint Protection version 11.0, 12.0 and 12.1
http://www.symantec.com/business/support/index?page=content&id=TECH163787
Ports used for communication in Symantec Endpoint Protection 11.0
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007091009064448
Normal package wont go to internet for updates. You will have to set a liveupdate policy for that on a group then export a package for that group.
Managed client won't automatically become unmanaged
how to configure mobile computers to automatically download virus definitions when disconnected from the Symantec Endpoint Protection Management console
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008040214442248