If you get the following error when you try to seed a CCR/SCR target node, you may have a Windows Firewall problem.

WARNING: Replication for storage group 'MyCluster\SG01' is still suspended. If needed, you can use the Resume-StorageGroupCopy cmdlet in the Exchange Management Shell to resume replication.
Update-StorageGroupCopy: Seeding failed : Database seeding error: Error returned from an ESE function call (0xc7ff1004), error code (0x0).

If you take a network trace while this cmdlet is running, you'll find numerous unanswered TCP SYNs from the source node to the target node. Looking in TCPView from Sysinternals, you'll find the PowerShell.exe process listening on the port these SYNs are sent to. If you're using the Windows Firewall, you'll need create a rule that permits PowerShell.exe to listen.

I initially assumed these were RPCs so I created a Dynamic RPC rule for PowerShell.exe, but, this didn't work. Thus I just fell back to a rule which permitted TCP connections on any port to PowerShell.exe. I scoped the rule to the subnets which had my CCR and SCR targets.