I just thought i'd put a reply in here in case it helps someone out there with 
this....

It seems that the information i was given by colleagues was incorrect.

>From reading the docs (not the most helpful as i'm sure most will agree) and 
>some testing i can confirm that the only config changes i required were for 
>the service ports.

As our backup servers use locally attached tape drives, the firewall needed to 
be configured to allow the number of ports required for connection to a storage 
node, in our case, this was 17 ports from server to client and client to server.
Connection ports were left as 0-0 and from monitoring the flow of traffic in 
both directions can confirm the only traffic registered is the initial 
connections taking place on the service port range.

Simple really having got on with it myself instead of listening to people here 
saying its not possible without opening hundreds / thousands of ports!

+----------------------------------------------------------------------
|This was sent by afairthorne AT caci.co DOT uk via Backup Central.
|Forward SPAM to abuse AT backupcentral DOT com.
+----------------------------------------------------------------------

To sign off this list, send email to listserv AT listserv.temple DOT edu and 
type "signoff networker" in the body of the email. Please write to 
networker-request AT listserv.temple DOT edu if you have any problems with this 
list. You can access the archives at 
http://listserv.temple.edu/archives/networker.html or
via RSS at http://listserv.temple.edu/cgi-bin/wa?RSS&L=NETWORKER