The BES port for the Desktop software
 

There is a user who want to activate his handheld with blackberry desktop software. But the domino BES is guarded by a firewall. So are there any port on the firewall should be opened for the user?

No. If the Desktop Manager application running on his system is able to make a connection to the BES (it will say 'Online' at the bottom" then he will be fine to activate.

What is "online" meaning? I disable the NIC(network interface card), and restart the DM application, the "Online" still appears. Faint:S

When you open the desktop manager, it loads a mapi profile. if it makes a successfully connection to your exchange server (or domino) then it will say online. You will be able to do anything (including activate) if it says that.

this guy is using domino theres no MAPI in domino stop giving wrong information.

Domino RPC uses port 1352.
BlackBerry Device Manager talks to BlackBerry Router for wireless network bypass uses port 4101.

Your best reference is this RIM white paper, it has an excellent tabulation of the BES components against the required ports used. Give a copy to your network/firewall guys.

Placing the BlackBerry Enterprise Solution in a segmented network

For Domino ports, read this:

IBM Lotus Domino port number selection and configuration

Correct.....no MAPI in Domino, but try to be nicer about it in future please, I'm sure you get plenty of stuff wrong too!