There are 3 types of network traffic going on, normally
a) log traffic from forwarder to indexer, one-way, default port tcp/9997 - but that is configurable.
b) intra-splunk communication. Default port tcp/8089 (configurable but don't)
- between Search Heads and Indexers, initiated by Search Heads.
- between Deployment Clients and Deployment Server. Initiated by the Deployment Client.
c) Web browser to splunkweb, default port 8000, configurable
Add anything you need for syslog (see below). Also, it's good to be able to connect to the splunk servers on ssh (tcp/22) - and possibly to the splunkd REST api on port 8089 - from the admin's workstation.
Put forwarders on the servers.
Let the network devices send syslog to a syslog daemon. Let the syslog daemon write the incoming data to files. Have a forwarder monitor those files.
For the storage arrays, I'm not sure, but I think you'd do the same as with the network devices.
Universal forwarders in most cases.
On hosts that will collect data from other systems (syslog daemon, or for executing data collection scripts) a Heavy Forwarder might be useful, since it will offload the main indexer of some tasks.