Here is the documentation on all the network ports you may need to open for an Environment ActiveGate.
Thanks Jonathan! However, depending on if ActiveGate will need to receive requests from Dynatrace SaaS, it will have to be deployed in DMZ. The above link/document does not explicitly state that. Can it be assumed that ALL sessions are initiated by ActiveGate and not by Dynatrace SaaS?
Yes. The communication is always initiated from the ActiveGate to Cluster (SaaS in this case). This also applies for OneAgents. They connect to ActiveGate or to the Cluster directly (SaaS this case).