Ports between on-premise and CPI-DS agent

Dear All,

We have a requirement to setup CPI-DS to integrate on-premise SAP system with SAC IBP. We have decided to keep CPI-DS agent in DMZ. I see that no port opening is required for inbound traffic from SAC to DS agent. My question is whether do we need to open port for inbound / outbound traffic to / from on-premise SAP systems / Data sources.

Thank you,

Kamesh