I have an Apple TV connected to my guest zone (VLAN segregated network). After some trial and error, based on this, I enabled airplay screen mirroring from devices on my LAN zone with the following traffic rule:
According to Apple, ports 49152-65535 on tcp correspond to Xsan network filesystem. So I guess that is what screen mirror uses albeit on udp not tcp?? Does it REALLY need ~17,000 ports open ports to do this?