This article explains the firewall exceptions for the Sophos Remote Management System (RMS) TCP ports - including direction.
Known to apply to the following Sophos product and version
Sophos Anti-Virus for Windows 2000+
Enterprise Console
Sophos Control Center
Sophos Enterprise Manager
What to do
See diagram below for clarification. NOTE: TCP port 8193 is not used for communication but you will see RMS listening on the port.
Click image to zoom in.

Technical details
Port 8193 was used in the past for unencrypted communications. At the moment all our products that use RMS work on port 8192 for the IOR and port 8194 for SSL encrypted communication so 8193 is currently unused.