Problem getting Endpoint Security & Control clients to talk to Endpoint Management Server

Hi, we are using the Endpoint Security and Control client (10.3) on several systems in a segregated subnet which is separate from the Endpoint Management Server.  At the moment clients cannot successfully connect to the EMS to retrieve updates.

We've opened these ports per the "Summary of port configurations in Sophos applications  (http://www.sophos.com/en-us/support/knowledgebase/38385.aspx):

TCP 80

TCP 135

TCP 139

TCP 445

TCP 8192

TCP 8194

UDP 137

However, our firewall reports packets from clients are being dropped.  Even though the DESTINATION port they're trying to connect to is 445, the SOURCE port on the client side varies from 2154 to 4553 to 2306; it appears the client is using a dynamic source port and our firewall is dropping that. 

We want to avoid opening dynamic port ranges if possible Is there a way I can adjust this (if applicable) on the client side to lock it to use TCP 445 as a source port?

Thanks in advance for any replies.