I did a post a while back on Firewall and connection requirements for the BlackBerry Internet Service ... but I still constantly see / hear people asking questions about what is required for BES.

Unfortunately the one recurring theme is people opening port 3101 inbound and I just shake my head. If you read the basic installation documentation you'll see this isn't needed and in fact makes your environment less secure and gives the appearance that BES is less secure as it would seem...