After deploying a Tenant, you need to configure networking between Tenant Broker and Tenant in order to allow the following communications:
Tenant Connection Broker > Tenant Broker Connection Broker: port 20003
Tenant Broker Gateway > Tenant Broker Connection Broker: port 20002
Tenant Broker Gateway > Tenant Connection Broker: port 20002
Tenant Broker Gateway > Servers hosting published resources: port 3389
These are standard RAS ports, which are also described in the Port reference section.