Hi Xing -
If you desire to connect 'backwards' from the service provider network to the customer Essentials server using the Essentials "remote console" scenario, you need these ports inbound published from the service provider to the Essentials server: TCP 5724 and TCP 8531.
The service provider connects individually to each Essentials customer to approve updates.
John Joyner
MVP-OM | MCTS: OM