None of the Hardware Firewall products have access to the private network.  A Network Gateway is required to supply these capabilities in-line and the NetScaler products have access to both the public and private networks.

Not all firewalls offer VPN and not all VPN options are the same.  The general options for VPN are:

• Each customer receives unlimited SSL VPN connections to our private network. These connections can be established by clicking the VPN link at the top of the page while logged into the customer portal.
• Customers also receive one PPTP VPN per account. They can add additional PPTP VPN users to their account in packs of 5 for $5/month extra.
• SoftLayer also offers a basic multi-tenant IPSec VPN service starting at $99/month.
• The Fortigate Security Appliance provides SSL and IPSec VPN options with Public network access only (no access to the SoftLayer private network).
• The Network Gateway provides SSL, IPSec and OpenVPN capabilities on the public or private network
• The NetScaler products can provide SSL and IPSec VPN on the public or private network.
• Customers can also deploy a VPN solution on to a server within their SoftLayer environment.

SoftLayer offers many different services that you can utilize with your server including Evault, SNMP and Nagios monitoring. These services require that our internal systems communicate with your server to some degree. The grayed out ports you see in the Exceptions list are ports open on the internal network port only. They are still blocked on the public (internet) network connection. Since the internal network is a secured network having these ports open is considered secure.

These ports generally cannot be modified however if you reset the firewall rules it will clear them from the Exceptions list. Please beware that resetting the firewall rules may have an adverse affect not only on these additional services but also could cause other issues as well with your server depending on its current configuration.

The primary advantage of having a firewall is that your server only has to handle “good” traffic – this means your resource is solely being used for its intended purpose as opposed to handling unwanted traffic, too.

No.  Portable IPs are not available for protection because they can be moved between servers.  Exceptions are made on a case by case basis as there are numerous caveats and require additional details about the customer's system design.

The Hardware Firewall (Shared) is locked to the public uplink port speed of a server.  You can upgrade in place by cancelling the firewall, upgrading the port speed for the server, and ordering a new firewall.  Alternatively, you can deploy a new server with the desired uplinks and associated firewall.

Yes.  The Hardware Firewalls (shared, dedicated, or Fortigate) are compatible with the standard and dedicated load balancers as well as the Citrix Netscaler VPX and MPX.

No.  The Hardware Firewall platform is enterprise-grade and highly durable, but true High Availability (redundant devices) is not an option for the shared Hardware Firewall.  For HA, a Hardware Firewall (Dedicated w/ High Availability) or Fortigate Security Appliance (High Availability) is required.  The Network Gateway product also has an HA option with firewall capabilities.