ALso depending on your firewal, you could always NAT the TSM server address.
Through the firewall you could assign an OUTSIDE address that gets
translated to the INSIDE address of the TSM server. You can also put rules
to limit the connections through port 1500 only to the TSM server address.
If you change the default port of 1500 for the TSM server you need to change
ALL of your clients to use this new port number. If you use POLLING (which
the TSM Clients manual says is the only supported schedmode for backups thru
firewalls) then you only need the 1500 port open. I wouldn't recomment
running the CAD server for webclient on those servers outside the firewall,
either. Just gives those hackers another open port to play with...

Bill Boyer
DSS, Inc.