Pushing a MOM agent to a target machine is pretty straightforward using the agent installation wizard from the MOM console. However when it comes to the point where one or more firewalls are inbetween the MOM server and the target machine things become to get interesting.
For MOM client to server communication opening port 1270 on the firewall is sufficient, however when trying to push out the MOM agents from the server you will need some more bi-directional traffic to be allowed through the firewall:
- SMB (445)
- RPC (135)
- RPC Dynamic (5000-5300)
- ICMP
In general firewall admins like to open the least amount of ports as possible so therefore restricting the dynamic RPC port range is always a good idea. There is a KB article on how to do this.