Firewall Port for push notification

I am trialing FortiAuthenticator in our network which is behind Fortigate firewall. I can use FortiToken with 2FA and it works fine. I also tried push notification and it works too, however we have to open public ip:port to FortiAuth server to make the push notification working. Do we really need to open the port for the push notification to work. During test without opening the port the push notification shows up on the mobile but the approval/deny response does not reach to server.