When deploying a replica, the `puppet infrastructure provision replica` command runs `reinitialize_replica` on the replica, which queries node groups from the classifier. This is done over port 4433.
Port 4433 needs to be shown on the charts for Large and Extra Large installations between the primary and replica on the following page: https://puppet.com/docs/pe/2019.8/system_configuration.html
Ports 8081, 8170, and 4433 also need to be listed in the "firewall" subsection of the "System requirements" section of the following page: https://puppet.com/docs/pe/2019.8/dr_overview.html
Within that subsection, the bulleted descriptions for those port requirements can largely be pulled from the System Configuration docs page.
* Please see Zendesk Support tab for further comments and attachments.