Firewall configuration for Avamar NDMP Accelerator

Hello,

I am setting up an existing Avamar server to backup a new Powerscale, with OneFS 9.5.

I have already configured the Powerscale for NDMP as detailed in the User Guide for Avamar NDMP Accelerator. The ndmp user has been defined, the DMA set to generic and the browse user has been setup, too.

Backup Client has been successfully configured on the NDMP accelerator and when I run a test backup, it connects to the Powerscale at first and reports the version. But when it tries to backup data, it times out.

2024-01-16 12:48:21 avndmp Info <41910>: [snapup-/ifs/path] NDMP listening IPV4 for data on address xxx.xxx.xx.xxx, port 27071
2024-01-16 12:48:21 avndmp Info <41861>: [snapup-/ifs/path] Connecting to data socket on address xxx.xxx.xx.xxx, port 27071.
2024-01-16 12:50:31 avndmp Error <41862>: [snapup-/ifs/path] Unable to establish data connection to address xxx.xxx.xx.xxx, port 27071.

A telnet to the IP and port from the NDMP Acclerator hangs, which seems to mean it cannot connect to the system. The initial NDMP connection goes through port 10000, but the data connection is to a random port (27071 in this example). Since the Powerscale's internal firewall is active by default in OneFS 9.5, do I need to create a rule for the connection from the NDMP Accelerator? And if so, how? I'm not a firewall specialist. Turning off the firewall is not an option. There is a default ndmp rule in the existing policy, but I'm guessing that's just the NDMP service port of 10000.

Thanks in advance for any tips.