Yes.  The Hardware Firewalls (shared, dedicated, or Fortigate) are compatible with the standard and dedicated load balancers as well as the Citrix Netscaler VPX and MPX.

No.  The Hardware Firewall platform is enterprise-grade and highly durable, but true High Availability (redundant devices) is not an option for the shared Hardware Firewall.  For HA, a Hardware Firewall (Dedicated w/ High Availability) or Fortigate Security Appliance (High Availability) is required.  The Network Gateway product also has an HA option with firewall capabilities.

Coming from the public internet in, the Local Load Balancer, Dedicated Load Balancer or Enterprise Load Balancer products are first, the Hardware Firewall products are next, and the NetScaler products are last (along with the customers servers).

None.  When ordered in HA, SoftLayer automatically provisions the appliances in HA configuration.  In the event that the primary device fails, a secondary passive device will take over as the primary active instance and begin passing traffic.  While this failover is typically automatic, it is best practice to monitor servers and ensure traffic is being passed successfully. 

SoftLayer offers many different services that you can utilize with your server including Evault, SNMP and Nagios monitoring. These services require that our internal systems communicate with your server to some degree. The grayed out ports you see in the Exceptions list are ports open on the internal network port only. They are still blocked on the public (internet) network connection. Since the internal network is a secured network having these ports open is considered secure.

These ports generally cannot be modified however if you reset the firewall rules it will clear them from the Exceptions list. Please beware that resetting the firewall rules may have an adverse affect not only on these additional services but also could cause other issues as well with your server depending on its current configuration.

A firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the server is reached.

Frontend (public) network:

Ports to allow:
All TCP/UDP ports
ICMP – ping (for support troubleshooting and monitoring)

Load Balancer IPs:

DOS Mitigation Systems:

Ports to allow:
All TCP/UDP ports

Vulnerability:
To ensure successful completion of a vulnerability scan, please permit access for the following IP addresses: 173.192.255.232 and 172.17.19.38.

Backend (private) Network:
IP block: your private IP block for server to server communications (10.X.X.X/X)
Ports to allow:
ICMP – ping (for support troubleshooting)
All TCP/UDP ports
For EVault port-specific information, click here.

Service Network (on backend/private network):
Be sure to add rules for both DAL01 and the location of your server.  If your server is in AMS01, you'll need to add rules allowing traffic from both DAL01 and AMS01.

For Flex Image Provisions (both image creation and server provisions), it is also necessary to allow DAL05 through as well.

SSL VPN network: (on backend/private network)
ICMP – ping (for support troubleshooting)
All TCP/UDP ports (for access from your local workstation)

SSL VPN Datacenters

SSL VPN POPs

PPTP VPN Datacenters

PPTP VPN POPs

LEGACY NETWORKS

If your server uses a Red Hat Enterprise Linux (RHEL) license provided by SoftLayer, you will additionally need to allow access to the service network as follows, otherwise updates and licensing will not function properly:

No. Portable IPs are used for the VMs in a hypervisor environment and portable IPs are not protected by the shared hardware firewall.  A Hardware Firewall (Dedicated) or Fortigate Security Appliance is recommended.