Firewall port requirements can be found under the following link:
https://help.sap.com/viewer/fsm_system_requirements/Cloud/en-US/sap-ecc-requirements.html
The firewall needs to allow access via HTTPS to auth.coresuite.com:443 and [de|eu|us|cn|au].coresuite.com:443. Please also make sure to use TLSv1.2 for transport encryption as support for TLSv1 and TLSv1.1 is about to be sunset soon.
TLS root certificate change announcement: https://help.sap.com/viewer/fsm_general_information/Cloud/en-US/announcing-root-certificate-change.html