Answer
Agent Communication: TCP 1116
When the agent is installed, the GFI EndPointSecurity Agent Service communicates back to port 1116 on the GFI EndPointSecurity Console server. This can be changed in Configuration > Advanced Options > Communication.
Agent installation and updating: TCP 135, 139 & 445
When the GFI EndPointSecurity Console machine installs or updates agents, it communicates from a random port to port 139 & 445 on the target agent machine. These are the standard SMB /RPC ports enabled on the clients by Microsoft File and Folder Sharing.
SQL Server Communications: 1433
The GFI EndPointSecurity Console server connects to the Microsoft SQL Server service instance on the SQL Server machine. This is normally TCP 1433, but may be configured differently on the SQL Server (it can be a dynamically assigned port or statically defined).