Need help with host disconnecting - firewall question

We currently have our vCenter and 7 hosts on the same network, they all run great.

I am trying to add 2 new hosts that a vendor set up and put on a separate network.

We have a firewall between the two networks.

Currently we have a rule allowing all ports from the vcenter server to communicate out to the hosts via NAT.

I am able to connect the hosts to vcenter but they quickly stop responding.

My question is what ports may need to be open originating from the ESXi host through the firewall to the vCenter server?

Can they support NAT in this scenario?

Thanks