CTA connects to NetApp filer or VNX over port 10,000 initially and dynamically use the tcp port range 32,768 – 61,000 for data transfer.  If CTA is behind a firewall those ports need to be opened bi-bidirectionally.
NDMP TCP port used by CTA migration?
NDMP TCP port used by CTA migration?