What are some recommendations with securing Java Web Services
application behind a firewall?
As far as getting pass the firewall, I heard of recommendations of
putting ip address/ port , public key, private key, etc. information
inside of the SOAP header.  Then the network guys would setup port
forwarding to an actual ip address or port. I new at the security and
firewall, so I am not sure how to do this. What do you recommend?

Links to information related this is welcomed.

Thank!