I'm documenting my own confusion here, as I know it'll come up later.
When creating a Blackberry Professional Express server, it needs to have SRP access to the Blackberry servers (port 3101). They have a test for this connectivity here:
c:\Program Files\RIM\BlackBerry Enterprise Server\Utility\BBSRPTEST.EXE
I was having trouble with getting port 3101 to connect to the RIM server, and then I thought I made some firewall changes to make it work - but even after disabling the firewall changes I made, it still worked - so I figure it worked without my assistance. For my own knowledge . . .
I opened up port 3101 outbound to all blackberry.net addresses and I made sure the SBS Internet Access Rule was set for all users and was not set to read only for FTP. I made these changes and then it worked. Then I disabled all these things, and it still worked. I have replicated this issue multiple times. Very strange.
This is what the test gives you when it's successful:
c:\Program Files\RIM\BlackBerry Enterprise Server\Utility>BBSrpTest.exe
NetworkAccessNode is srp.us.blackberry.net.
Attempting to connect to srp.us.blackberry.net (220.127.116.11), port 3101
Sending test packet
Waiting for response