Currently, it is not clear from the documentation what are the source hosts for each port to open. The diagram fills in a bit this imprecision, but it is not formal enough. Also, some ports need to be open only if certain features are needed (eg. download link for snapshots).

This makes firewall configuration imprecise and experimental (or not as secure as it could be).

Suggestion: each table of the the Ops Manager firewall configuration webpage should document those columns:
- source component: client component(s)
- target component: server component(s)
- protocol: tcp/udp
- port
- feature: to specify if the port is needed only for some optional feature