What firewall ports should be opened for central management server
When you attempt to enlist the Target (TSX) to the Master (MSX), the step that is failing is "Make sure the Agent service for '{MSX Server}' is running." This step simply checks to see that the SQL Server Agent is running on the MSX Server.

You can instead try to use msdb.dbo.sp_msx_enlist (documented here), which is run on the TSX to enlist it on the MSX. This may provide a more helpful error message, or it may even succeed. 

If it succeeds, you can query msdb.dbo.systargetservers on the MSX to confirm that the server has been successfully enrolled, and is polling for instructions to download. Next, you can poll msdb.dbo.sysdownloadlist to see those instructions, and see if they are being consumed correctly by the TSX. There is an error_message column which should include download errors. Note, errors being logged here would be dependent on the TSX successfully connecting to the MSX--so your TSX would need to be able to connect to the MSX's DB Engine port (1433 by default) in order to even write the error messages.