Firewall requirements for Parallels Remote Application Server

By default, Remote Application Server will install with a Secure Gateway and a Connection Broker. There can only be one master Connection Broker in a farm; however, multiple Secure Gateway access points and resource Connection Brokers (RDSH Agent) can be deployed where needed.
Below are the firewall requirements for each of the separate Remote Application Server functions:

All Components: TCP 135, 445 - remote agent push.

You can find detailed description of required port by following these links:

Parallels Client 

Web browsers

HALB 

RAS Secure Gateway 

RAS Connection Broker 

RAS Console 

SSRS 

RAS Reporting 

RAS Web Administration Service (REST/Management Portal) 

RAS PowerShell 

RAS Provider Agent 

RAS Enrollment Server 

RAS RD Session Host Agent 

RAS Guest Agent 

RAS Remote PC Agent 

Tenant Broker 

Azure Virtual Desktop 

Active Directory and Domain Service ports

For Active Directory and Active Directory Domain Services port requirements, please see the following article