Port need to be open between Client Access server and Mailbox server

Hi All,

We are planing to implement Exchange Server 2013 in our origination in split role model. The  Client Access server and Mailbox server  will be in different VLAN, I would like to know which all  port need to open for the communication and configuration of these roles.

1. Client Access server > Mailbox server (bi-direction)

2. Client Access server > Active Directory (bi-direction).

Mailbox server and Active Directory will be in same VLAN

Also

Firewall > Client Access server required port for Outlook,Outlook Anyware, SMTP from spam filter.

Does the Mailbox server required any access to external network or only Client Access server required.