Outlook hangs on updating folders
The values that you provide to Outlook Anywhere settings can be classified into 2 types of properties - client facing and server facing.
As you see above, the client specifies the VIP of the Load balancer (or direct CAS FQDN if the CAS is exposed to the Internet) as the HTTP endpoint and the mailbox server as the RPC endpoint.
Note that setting this value to 0 turns off the Rpc Http Configurator.
When the Rpc Http Configurator runs, it picks up the IISAuthentication Methods and SSLOffloading values from the AD and stamps it on the \rpc vdir settings in the IIS metabase - overwriting any previously set value.
When the RPC server component receives the RPC_IN_DATA and RPC_OUT_DATA with the same client session id, it knows that for any request received on the RPC_IN_DATA connection, it must reply back on the RPC_OUT_DATA connection. Ok, so you already know this, but I'll reiterate - the mailbox server has 3 ports that are used for RPC/HTTP: port 6001 is used for Mail connections, port 6002 is used for directory referral, port 6004 is used for proxying directory connections to AD.
The Referral Service running on port 6002 and DSProxy running on port 6004 are part of the same process, and the Referral Service just refers clients back to DSProxy to establish their Directory connections.