Ports required for AD SSO

When configuring NAC for AD SSO, the last place you'd think to look would be the documentation, right? We'll, this would be one time that it makes a lot of sense to RTFM. On page 9-7 of the PDF version of the 4.1.3 Clean Access Server Installation and Configuration Guide they have all the ports required for AD SSO.

Here are the TCP ports required, in the unauthenticated role, for AD SSO to work: 88, 135, 389, 445, 1025, and 1026.

The one thing that isn't listed in the documentation is that ICMP is also required. Part of the login process includes trying to ping the AD server. If this fails, then AD login doesn't work