None.  When ordered in HA, SoftLayer automatically provisions the appliances in HA configuration.  In the event that the primary device fails, a secondary passive device will take over as the primary active instance and begin passing traffic.  While this failover is typically automatic, it is best practice to monitor servers and ensure traffic is being passed successfully. 

The Hardware Firewall (Shared), Hardware Firewall (Dedicated), and Fortigate Security Appliance are not metered for bandwidth.  Additionally, these products can reduce total bandwidth utilization by limiting the traffic that servers must respond to.

A firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the server is reached.

Frontend (public) network:

Ports to allow:
All TCP/UDP ports
ICMP – ping (for support troubleshooting and monitoring)

Load Balancer IPs:

DOS Mitigation Systems:

Ports to allow:
All TCP/UDP ports

Vulnerability:
To ensure successful completion of a vulnerability scan, please permit access for the following IP addresses: 173.192.255.232 and 172.17.19.38.

Backend (private) Network:
IP block: your private IP block for server to server communications (10.X.X.X/X)
Ports to allow:
ICMP – ping (for support troubleshooting)
All TCP/UDP ports
For EVault port-specific information, click here.

Service Network (on backend/private network):
Be sure to add rules for both DAL01 and the location of your server.  If your server is in AMS01, you'll need to add rules allowing traffic from both DAL01 and AMS01.

For Flex Image Provisions (both image creation and server provisions), it is also necessary to allow DAL05 through as well.

SSL VPN network: (on backend/private network)
ICMP – ping (for support troubleshooting)
All TCP/UDP ports (for access from your local workstation)

SSL VPN Datacenters

SSL VPN POPs

PPTP VPN Datacenters

PPTP VPN POPs

LEGACY NETWORKS

If your server uses a Red Hat Enterprise Linux (RHEL) license provided by SoftLayer, you will additionally need to allow access to the service network as follows, otherwise updates and licensing will not function properly:

No. Portable IPs are used for the VMs in a hypervisor environment and portable IPs are not protected by the shared hardware firewall.  A Hardware Firewall (Dedicated) or Fortigate Security Appliance is recommended.

The Hardware Firewall (Shared) does need to match the public uplink speed of the server. However, because it only protects the public side of the network, the public uplink speed is what must match the firewall selection.  Customers can create a ticket to request a downgrade of only the public interfaces if desired.

To support 10Gbps public uplinks, a Network Gateway is required.  If 10Gbps is only required on the private network (for database, backup, storage, etc), then customers can request a downgrade of only their public uplinks and order any of the Hardware Firewall products.

Both the Dedicated Hardware Firewall and the Fortigate Security Appliance can protect every server on a Public VLAN.  However it is important to note that since these FW devices are connected with 2Gbps Uplink we recommend scaling the number of firewall instances to meet the performance needs of your app. Customers can simply do so by deploying additional public VLAN Firewalls within a pod to allow for additional firewall and assocaited compute resources to be added.