Hi,

I have two VLANs, separated from security reasons. I need to scan (via SCCM) devices (and install SCCM client) on devices in "closed" network. Which port need to be opened for this? 

Hi,

Have a look here:

https://technet.microsoft.com/en-gb/library/bb632618.aspx

• Marked as answer by Bartas1979 18 hours 17 minutes ago

https://technet.microsoft.com/en-us/library/hh427328.aspx

It depends of your SCCM mode - If native it should be 443 and mixed means 80 i dont think anything other than these two for client communication for package install, if you are using the Patch deployment method for client upgrade then - 8530 or 8531 for scan depends on your WSUS installation port.

https://technet.microsoft.com/en-us/library/ff189805.as

Thank you!! :-)

"I need to scan (via SCCM) devices "

ConfigMgr does not in any way "scan" systems. All client agent communication is initiated by the client agent -- the site server never ever initiates communication with a client agent.