...
In order to check which ports should be open for the eduroam end users, please check out the eduroam Policy Service Definition document, particularly Chapter 6.3.3.
Proxy Settings
As an eduroam SP, you have a choice of not deploying a network-side proxy at all (pereferred!), or to deploy a transparent web content proxy. It is not acceptable and technically not possible to deploy a proxy that requires manual settings: doing so would require any incoming eduroam visitor to modify their device configutation with the manual proxy settings at hand.
Client devices can typically auto-detect proxy settings easily: the automatic WPAD discovery protocol allows the eduroam SP operator to point users to the proxy address if any, or to announce that no proxy is in use. eduroam installers configure client devices to look for such configuration information on the network.
As an eduroam SP, you shold always provide proxy configuration information either (preferably) in DHCP responses or in specially crafted DNS replies, to allow clients to work seamlessly on your network.
Set up of networking equipment in the network core
...