In the DMZ (outer interface) you will have to open HTTP(S) port(s). Between DMZ and the internal network where the SAP backend systems are you will have to open message server port(s), HTTP message server port(s) and the ports used by the SAP backend applications (AS ABAP, AS JAVA). See the attached links for details.
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/48/99ac3a7f020e27e10000000a421937/frameset.htm
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4e/c26cdc58e968b9e10000000a42189e/frameset.htm
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/a2/f9d7fed2adc340ab462ae159d19509/frameset.htm