I'm trying to set up FIM 2010 R2 SSPR for the first time. We've had FIM running without the password reset for quite a while. The portal is only used for FIM administration, not by customers ("users"). I'm trying to find docs on what ports need to be open between the SSPR server and the FIM server, and between the customer and the FIM server (assuming just https/443 between customer and SSPR). I found all kinds of references which seem to assume running the SSPR portal on the same box or in the same network/VLAN as the FIM server. Does anybody have pointers? If we have an AD management agent/connector already working on the FIM server (creating accounts, including setting passwords), are there additional ports needed between FIM and AD DCs for SSPR functionality? If it helps, I can try and post a diagram (ascii art?) or link to one.
-Robert