Endpoint Protection

Hello all , I need a confimation on the below points , would appreciate your replies.

1) SEPM 12.1.3 is already installed on endpoints will all components . Now if I deploy a communication update package from a new SEPM server to endpoints to point/re-direct them from the old SEPM to new SEPM do I need to open firewall ports required to do remote push  on the SEPM firewall or there is no need to create a firewall rule on SEPM . SEP will automatically take care of them ?

2) same scenerio as one but in that case I am deploying a new 12.1.6 package from a new SEPM server to achieve both tasks at one i.e to update the clients and to re-point them to the new SEPM. Do I also need to open firewall ports via configuring the policy on SEPM firewall or it will automatically be taken care of ?

Thanks and Regards 

The TCP ports 139 and 445 and the UDP ports 137 and 138 must be open. See this article:

Prepare computers to install the Endpoint Protection 12.1 client

The SEP firewall opens these ports by default. If Windows firewall is still active, the most simple way to achieve your goal is to activate file and printer sharing.

Other requirements are sufficient access control permissions (e.g. as domain admin) and running remote registry service on the target machines.

thanks for your reply greg. Since SEP firewall component is already running on the client and on the clients I am seeing the message that firewall is being controlled by SEP so I assume that whether i try do deploy a communiation update package or even an upgrade to 12.1.6 clients will still accept it and update themselves accordingly. Regards 

Correct. The SEP fw will not block these actions.

Thank you Greg and Brian for your replies.