Cisco Managed Services Portfolio: Requirements Document

Transcription

1 Cisco Managed Services Portfolio: s Document

2 s Document Table of Contents Introduction 3 MSCP Service Descriptions 4 Managed Connectivity 4 Managed Security 5 Managed Unified Communications 5 Managed Mobile Communications 6 Managed Data Center 7 Managed Connectivity 8 MPLS VPN 9 Metro Ethernet 16 Managed Internet Service 21 IP Trunking 25 Router 32 IPSec VPN 33 LAN 35 Frame Relay/ATM 37 Managed Security 38 Firewall 39 IDS/IPS 44 Secure Router 50 Managed Unified Communications 52 Business Communications 53 Unified Contact Center (Managed) 58 Unified Contact Center (Hosted) 64 Hosted Unified Communications 70 Managed Mobile Communications 72 Wireless LAN 73 Managed Data Center 76 WaaS 77 Hosting/Co-Location 81 Appendix 1: Acronyms 83 V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 2

3 s Document Introduction This document outlines the managed service specific requirements at all levels of the MSCP model and should be used in conjunction with the Cisco Offer Based Channel Model Audit and Policies Document when preparing for a Managed Services Channel Program Audit. The Cisco Offer Based Channel Model Audit and Policies Document covers the core requirements of the MSCP regardless of the types of managed services offered; it focuses on the Network Operations Center service management according to ITIL recommendations. To qualify as a Cisco Managed Service, the offer must include proactive monitoring, remote troubleshooting capabilities from your NOC, and minimum 1-year SLA with the end-user customer, and must meet the additional requirements specified within this document. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 3

4 s Document MSCP Service Descriptions These tables provide an overview of services only. See linked sections for details. Managed Connectivity MPLS VPN Metro Ethernet Managed Internet Service IP Trunking Router IPSec VPN A Cisco Powered managed MPLS VPN service provides private IP networks with high quality, secure, any-to-any connectivity. The service is based on the Cisco IP NGN Architecture, Multi Protocol Label Switching (MPLS) and Cisco Design and Implementation Guides. The service delivers appropriate levels of latency, jitter, and packet loss to ensure the successful, concurrent handling of multiple types of traffic, especially voice and video, from customer site to customer site. The network classifies and prioritizes traffic flows from end to end, enabling SLAs for multiple classes of service. The service also provides comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. A Cisco Powered managed Metro Ethernet service provides high-speed, site-to-site connectivity. It supports the delivery of voice, video and other mission-critical applications. This service is based on the Cisco IP NGN Architecture, Cisco Design and Implementation Guide, and Metro Ethernet Forum standards and specifications. The service delivers a variety of point-to-point and multipoint Ethernet services over Layer 1, Layer 2, and Layer 3 topologies with seamless integration. It allows for QoS functionality, including classification and prioritization techniques to enable multiple levels of service. The service also provides comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. A Cisco Powered managed Internet service delivers secure Internet connectivity. This service is based on the Cisco self-defending network architecture and is built upon a secure infrastructure. The service delivers connectivity for users regardless of location and access methods. It is backed by comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. The service offers service-level agreements for network performance and service availability, supports quality of service (QoS) techniques, access control lists, and other industry best practices. A Cisco Powered managed IP Trunking service is a Session Initiation Protocol (SIP)-based trunk from the service provider to an IP PBX or key system, delivering voice, multimedia, and data traffic. The service provider provides basic connectivity, emergency services, dial plan management and operator services. Local and long distance call connections are completed by the service provider. A managed IP Trunking service includes the IP termination service and features a PBX with a gateway, an IAD or an IP PBX. The service provides comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. A managed router service provides remote router configuration, management, and maintenance. This service delivers 24x7 management and monitoring of customer site routers in a Wide Area Network (WAN). A managed security IPSec VPN service provides secure site-to-site connectivity through encrypted data streams over a private or public network. This service is based on RFC specifications and protocol, a framework of open standards. This service delivers IPSec encryption and tunneling protocols, data confidentiality, data integrity, and data authentication over unprotected networks such as the Internet. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 4

5 s Document LAN Frame Relay/ATM A managed Local Area Network (LAN) service provides remote LAN switch configuration, management and maintenance. A managed Frame Relay/ATM service delivers Layer 2 site to site connectivity over a Frame Relay or ATM network. This service delivers 24x7 management, monitoring and maintenance of customer site routers in a Wide Area Network (WAN). Managed Security Firewall IDS/IPS Secure Router A Cisco Powered managed firewall service provides Cisco proven firewall technology solutions to help customers better protect their business infrastructure. The service is managed from a security operations center (SOC). It supports the key features available on the Cisco firewall solutions, such as network bandwidth optimization and anti-ip address spoofing, and conforms to Cisco and industry best practices. The service provides comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. A Cisco Powered managed Intrusion Detection (IDS)/Intrusion Prevention (IPS) service provides Cisco deep-packet, inspection-based technology to better protect a customer s business Infrastructure. This service delivers real-time monitoring and detection and mitigation of many types of malicious network traffic, such as DDoS attacks. The service is managed from a security operations center (SOC) and is deployed at strategic locations across the enterprise network. It supports the key features available on the Cisco IDS/IPS solutions and conforms to Cisco and industry best practices. The service provides comprehensive SLAs covering the overall performance of the service, and online access to real-time and historical service-performance reports. A managed secure router is a managed WAN router with integrated security to provide secure connectivity. This service is based on the Integrated Services Router (ISR) security bundles that are packaged in 3 forms: Entry bundle for basic security, enhanced bundle for added performance and scale, and V3PN for integrated security and IP communications. This service delivers 24x7x365 management, monitoring, and maintenance of network traffic flows. Included are comprehensive SLAs covering the overall performance of the service and online access to real-time and historical service-performance reports. Managed Unified Communications Business Communications A Cisco Powered managed firewall service provides Cisco proven firewall technology solutions to help customers better protect their business infrastructure. The service provides the integration of voice, video, and other collaborative data applications into intelligent network communications solutions. These solutions, including IP telephony, unified communications, and rich-media conferencing, take full advantage the power, resilience, and flexibility of an organization s UC network. The service is provided with quality of service (QoS) capabilities that ensure a consistent experience, service resiliency options for site design, and embedded security capabilities that protect the customer environment. The service provides comprehensive SLAs for service performance and a Web portal that provides real time and historical performance analysis. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 5

6 s Document Unified Contact Center (Managed) Unified Contact Center (Hosted) Hosted Unified Communications A Cisco Powered Managed Unified Contact Center Service provides an IP-based, centralized infrastructure that can support many distributed sites. The service offers a full suite of contact management services that can be implemented immediately or incrementally. The service enables customer deployments of < 10 agents and scaling up to > 1,000 agents and provides customers administrative control options for their environment. This service delivers intelligent call routing, network-to-desktop CTI, and multi-channel contact management over an IP network to contact center agents. The solution also delivers TDM to IP connectivity with Cisco VoIP gateways, and media termination with Cisco IP phones. The service provides comprehensive SLAs for service performance, a Web Portal that provides real time and historical performance analysis. A Cisco Powered Managed Unified Contact Center Service provides an IP-based, centralized infrastructure that can support many distributed sites. The service offers a full suite of contact management services that can be implemented immediately or incrementally. The service enables customer deployments of < 10 agents and scaling up to > 1,000 agents and provides customers administrative control options for their environment. This service delivers intelligent call routing, network-to-desktop CTI, and multi-channel contact management over an IP network to contact center agents. The solution also delivers TDM to IP connectivity with Cisco VoIP gateways, and media termination with Cisco IP phones. The service provides comprehensive SLAs for service performance, a Web Portal that provides real time and historical performance analysis. A Cisco Powered Hosted Unified Communication Service (HUCS) has been designed to deliver a suite of UC applications for deployments where a centralized, partitionable environment provides an economic advantage to a more traditional, on customer premises distributed deployment. The Cisco HUCS solution provides maximum scalability and simplified provisioning. The infrastructure equipment and service are both owned and managed by the service provider, so end users can eliminate the cost and complexity of buying and managing their own unified communications solutions. In a Cisco HUCS environment, each customer has a unique dial plan, set of phone numbers, voic , and other resources. The service provider operates one call-control network for all customers, enjoying significant economies of scale that can lead to lower capital and operational expenses, competitive prices to customers, and a new revenue stream. The Cisco HUCS gives managed service providers a new way to cost effectively leverage their network infrastructure to gain new revenue. For end users, the service saves time, money, and reduces complexity letting them concentrate on their core competencies. Managed Mobile Communications Wireless LAN Hosting/Co-Location A managed wireless LAN service extends the corporate network securely, allowing employees to conduct business anywhere, anytime, from any device. The service has integral security capabilities that protect both the device and the enterprise network with quality of service (QoS), availability, and reliability. It supports advanced wireless capabilities such as Wi-Fi Multimedia, virtual LANs, and fast, secure layer 2 and 3 roaming for seamless mobility. This Cisco Powered managed hosting service provides the secure hosting of Web or other application servers, and related Internet connectivity. The service scales from basic co-location, where the customer owns the equipment in the cage, to traditional Web hosting, where the provider owns the servers and all related equipment. Essentially, the baseline offering would provide space, power, and pipe in an environmentally controlled fire protected facility with redundant power and network connectivity. The higher end offering is a more complex service built upon a highly network secured and resilient infrastructure that conforms to Cisco s data center V-Frame design guidelines for virtual application/server functionality and application control server load balancing. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 6

7 s Document The service ranges from offering 24x7 continuous monitoring over servers and network, to incremental offerings of real time and historical traffic reporting and server performance via a customer portal with some level of customer control if required. Additionally, the hosted applications scale from being horizontally offered, to multiple vertically defined offers across industry sectors. The service is backed by comprehensive SLAs for service performance, including network availability, server availability, and server implementation timelines. Managed Data Center WAAS Hosting/Co-Location A Cisco Powered Managed Wide Area Application Service (WAAS) is a powerful application acceleration and WAN optimization solution that optimizes the performance of any TCP-based application delivered across a WAN. A Managed WAAS is a component of Cisco s Data Center 3.0 architecture that enables partners to offer a comprehensive portfolio of application networking solutions and technologies that result in the optimization and secure delivery of business applications from data centers to branches and mobile end users. This purpose-built software and hardware service allows customers to consolidate costly branch servers and storage into data centers, and deploy new applications centrally, while still offering LAN-like performance for any employee regardless of location. The service offers lower total cost of ownership (TCO), ease of operation through network transparency, reliable deployment of applications and preserves the security of accelerated traffic. This Cisco Powered managed hosting service provides the secure hosting of Web or other application servers, and related Internet connectivity. The service scales from basic co-location, where the customer owns the equipment in the cage, to traditional Web hosting, where the provider owns the servers and all related equipment. Essentially, the baseline offering would provide space, power, and pipe in an environmentally controlled fire protected facility with redundant power and network connectivity. The higher end offering is a more complex service built upon a highly network secured and resilient infrastructure that conforms to Cisco s data center V-Frame design guidelines for virtual application/server V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 7

8 s Document Managed Connectivity Benefits and s Benefit Eligible for Discount Eligible for Rebate Eligible for Global Procurement Eligible for Branding and Additional Marketing Benefits Trade-In Credits Incentive Programs, Rebates, Offers Description Cisco Powered Strategic Products within this category are eligible for program discount (upon certification or designation approval) Products within this category are eligible for program rebate (upon certification or designation approval) Products within this category are eligible for global procurement (upon certification or designation approval) Approved managed services within this category are eligible for branding and additional marketing benefits Approved managed services within this category can be combined with trade-in credits Approved managed services within this category can be combined with resale-based incentive program discounts (OIP, VIP, SIP), rebates, and offers Legacy Benefit Real-time Monitoring 24x7 Service Availability SLAs Technical Attributes Description Cisco Powered Strategic Managed Services are proactively monitored via the Partner s NOC Service management is available 24x7 Legacy The Managed Service provider must back SLAs with terms of one-year (or greater) Technical attributes for the managed services in this category are defined Service Management Service management requirements are stipulated POS Customer Reports Eligible Products 50% Cisco Infrastructure Partner must provide POS customer information on a monthly basis. Customer information collected as part of the requirement will be used for program governance only. Managed services within this category have a pre-established set of eligible Cisco products The transport Managed Services in this category must be based partially or wholly on Cisco infrastructure, with at least 50% of the provider edge provisioned on Cisco platforms and that absorb Cisco based infrastructure ports when the Managed Service is provisioned V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 8

9 s Document MPLS VPN Network s To qualify as a Cisco Powered Managed service, the IP transport must be based partially or wholly on Cisco infrastructure, with at least 50% of the provider edge provisioned on Cisco platforms and that absorb Cisco based infrastructure ports when the Managed Service is provisioned. Same as requirements Architecture and Technical Attributes Network foundation for VPN service must be based on IP/MPLS Connectivity provided to the Internet from the VPN Customer ability to select a full mesh VPN option where all sites can pass traffic directly to each other Customer ability to select a design configuration option that will emulate a hub and spoke environment Extranet access to VPN Network design diagram or Technical Service Description (TSD) demonstrating the deployment of MPLS over a Cisco IP network. Refer to RFC 2547 BGP/MPLS VPN. Partner must demonstrate that the service offers Internet connectivity across the MPLS backbone to eliminate the need to carry Internet bound traffic back to a customer s regional HQ site and then on to the external Internet connection. A default route to the Internet can be injected in to the VPN, drawing traffic that does not go to a specific location on the customer network. A managed firewall then screens traffic. Generally part of the Marketing Service Description (MSD); other service Part of the MSD, or Partner must be able to demonstrate network design option available to customer The service offering needs to include the ability to connect to a Community of interest network. This extranet allows interested companies to connect together to share information. Partner must demonstrate how this service is secured to ensure that each customer s VPN is protected from access by another company. Layer 3 network reach The network needs to support IP routing capability, as opposed to Layer 1 or Layer 2 backhaul services, to provide the full benefits of Layer 3 connectivity in each country or region the service is offered in. Partner must be able to demonstrate the existence of a network design process to ensure this. This must include the decision criteria of what the routing node distribution needs to be to adequately cover population densities in each country served. Customer Edge Provider Edge routing protocol support Remote access via Internet Partner must support BGP, OSPF, EIGRP and static routing protocols between the CPE and the Provider Edge Router Service must support the ability to gain access to VPN resources via the Internet. Partner must demonstrate how this is achieved. May require client software on remote User access devices. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 9

10 s Document Network foundation for VPN service must be based on IP/MPLS Connectivity to the Internet must be available as an option for the service Customer ability to select a full mesh VPN option where all sites can pass traffic directly to each other Remote access via Internet Network design diagram or technical service description demonstrating the deployment of MPLS over a Cisco IP network. Refer to RFC 2547 BGP/MPLS VPN. Partner must demonstrate that the service offers Internet connectivity across the MPLS backbone to eliminate the need to carry Internet bound traffic back to a customers regional HQ site and then on to the external Internet connection. A default route to the Internet can be injected in to the VPN, drawing traffic that does not go to a specific location on the customer network. A managed firewall then screens traffic. Generally part of the Marketing Service Description (MSD); other service Service must support the ability to gain access to VPN resources via the Internet. Partner must demonstrate how this is achieved. May require client software on remote User access devices. Quality of Service Quality of Service (QoS) features that enhance the capabilities of the service to support all traffic types over a converged infrastructure At least 5 classes of service available If narrowband (< E1/T1) access links are supported, support mechanisms must be offered to help ensure that delay-sensitive traffic receives the required QoS Overall network design capability to transport customer settings across the network transparently, regardless of the number of classes of service supported and the QoS settings available The following QoS features must be implemented in the PE nodes: Policed High Priority-Queue Assured Forwarding Queue Packet Sequence Preservation At least 3 classes of service available Generally part of the Marketing Service Description (MSD); other service Network design criteria for narrowband links must include consideration for supporting multiple traffic classes; mechanisms may include MLPPP and FRF.12 Detailed in MSD or part of network design criteria Partner must demonstrate that a mechanism is in place to limit overall traffic entering the HP-Q such that the lower classes are not starved of bandwidth. Partner must demonstrate that the Video traffic from a customer can be streamed into the AF-Queue. This must be shaped to provide the required behavior for Video, allowing it to not be dropped but still receive predictable jitter and delay. If the customer sends more traffic for a class than is subscribed to, the excess traffic must not be put in to a separate class, but remain in the same CoS queue and marked for discard in the event of congestion. This avoids a TCP stream being split up and potentially being delivered via two queues which are drained at different rates, causing out of sequence arrival. Generally part of the Marketing Service Description (MSD); other service V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 10

11 s Document Device-Level Security Partner must be able to demonstrate adherence to the policies and best practices outlined within the Cisco Network Foundation protection framework, as described at Data Plane Partner must demonstrate that the following capabilities have been implemented to protect the data plane on each device: Access Control Lists (ACL) protects devices from malicious traffic by explicitly permitting legitimate traffic Unicast Reverse Path Forwarding (URPF) mitigates problems caused by the introduction of malformed or spoofed IP Source addresses Remotely Triggered Black Hole (RTBH) drops packets based on source address and can be used while device is under attack QoS tools used to protect against flooding attacks Clearly defined and documented security procedures that describe how the following are implemented as part of an overall security policy: Infrastructure ACLs are applied to the network core Drops packets without a verified source address A filtering method for dropping malicious traffic at the peering edge of the network Defined QoS policies to rate limit or drop offending traffic (identify, classify and rate limit) Note: Current specifications are applicable, but newer releases and revisions may supersede the herein outlined requirements. Note: Current specifications are applicable, but newer releases and revisions may supersede the herein outlined requirements. Control Plane Partner must demonstrate the following capabilities have been implemented to protect the control plane on each device: Receive ACLs limits the type of traffic that can be forwarded to the processor Control Plane Policing (CPP) provides QoS control for the packets destined to the control plane of the device. Ensures adequate bandwidth reserved for high priority traffic such as routing protocols Routing protection MD5 neighbor authentication protects routing domains from spoofing attacks Auto secure procedures in place Partner must Demonstrate use of ACLs in security policy Demonstrate use of QoS control in security policy Demonstrate use of MD5 neighbor authentication in security policy Demonstrate lock down of devices using industry best practices (NSA) Management Plane Partner must demonstrate the following capabilities have been implemented to protect the management plane on each device: CPU and memory thresholding protects CPU and memory resources of IOS devices against DDoS attacks Dual export syslog increases availability by exporting information to dual collectors Procedures to prevent unauthorized management access to devices Procedure in place to react to thresholds being exceeded or documentation in support of functionality Part of design for collection of management information from each device Partner must have security procedure in place. Can use features such as Secure Shell only access (SSH), VTY access control list, Cisco IOS software login enhancements, SNMP V3, TACACS+. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 11

12 s Document Data Plane Policy for protection against security attacks Access Control Lists (ACL) protects devices from malicious traffic by explicitly permitting legitimate traffic QoS tools used to protect against flooding attacks Clearly defined and documented security policy covering protection of infrastructure from security attacks Infrastructure ACLs are applied to the network core Defined QoS policies to rate limit or drop offending traffic (identify, classify and rate limit) Control Plane Routing protection MD5 neighbor authentication protects routing domains from spoofing attacks Auto secure procedures in place Management Plane Procedures to prevent unauthorized management access to devices Demonstrated use of MD5 neighbor authentication in security policy Demonstrated lock down of devices using industry best practices (NSA) Partner must have security procedure in place. Can use features such as Secure Shell only access (SSH), VTY access control list, Cisco IOS software login enhancements, SNMP V3, TACACS+. Security Infrastructure: DDoS Protection Partner must be able to demonstrate adherence to the policies and best practices outlined within the Cisco Cleanpipes DDoS infrastructure protection detailed at Regional Cleaning Centers deployed using Cisco Guard solution Network based mechanism to identify, classify and mitigate attacks based on anomaly characteristics Process to baseline normal traffic loads periodically, at least weekly; must be repeated on a regular basis as agreed with the customer Ability to conduct network based traffic tuning on the detection network for at least 24 hours at peak traffic time Not a requirement at this level Evidence of network design that includes Cleaning Centers Demonstrated process to identify, classify and mitigate attacks based on anomaly characteristics Demonstrated process for periodic baseline of traffic loads; must be at least weekly and repeated as agreed with customer Demonstrated process for network based traffic tuning on the detection network for at least 24 hours at peak traffic time V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 12

13 s Document Resiliency and Redundancy Implementation of technology that enables network wide resiliency for IP networks, as described at en/us/partner/products/ps6550/products_ios_technology_home.html Device level resiliency H/W effective design process to ensure deployment where applicable to enhance device level hardware resiliency Device level resiliency S/W effective design process to ensure use of software features enhance device level resiliency Transport level resiliency effective deployment of link or transport level resiliency features within network design Protocol level resiliency effective deployment of protocol level resiliency features to enhance availability Convergence time tuning procedures procedures in place to tune convergence times where applicable Application level resiliency procedures to ensure availability of critical applications Network architecture design to meet the levels of guaranteed service availability Design processes or sample PE node config. which makes use of features such as redundant processors, line cards, switch fabric and power Use of Non-Stop Forwarding (NSF) and Stateful Switchover (SSO) Design features such as SONET/SDH APS, Resilient Packet Ring (RPR), Etherchannel, Spanning-Tree Protocol (STP) Layer 3 protocols. These should include: Hot Standby Routing Protocol (HSRP) RFC 2281, Virtual Router Redundancy Protocol (VRRP) RFC 2338, MPLS-TE, BGP graceful restart, NSF on OSPF/IS-IS. Demonstrated use of features such as fast reroute (FRR), BGP multipath, failure detection and recovery tuning, routing protocol optimization, IP even dampening Use of features such as Global server load balancing, S NAT, Stateful IPSec, DNS, DHCP, Cisco server load balancing Demonstration of design process in place to ensure target network availability can be met. Should include reference to areas of availability specified in requirements. Options for Site Network Resiliency Implementation of technology that enables network wide resiliency for IP networks, as described at en/us/partner/products/ps6550/products_ios_technology_home.html If leased lines are delivered over a SONET/SDH infrastructure, protection must be offered for the circuit Customer option to backup a link from a site into the VPN network Ability to dual home the CPE into 2 separate nodes in the aggregation network Customer option to encrypt the access link between Customer premises and Provider Edge Marketing Service Description (MSD) must include this as an option, or Partner must demonstrate service designs that have incorporated this feature MSD must include an option for sites to connect to the same PE node. Technology such as ISDN, EVDO may be used depending on access type and speed. Consideration in network design must be given for impact on traffic supported, such as rerouting Voice traffic to an alternate path. As above, MSD should include this option or Partner must demonstrate use of it in network designs Partner must demonstrate support for IPSec encryption, or similar solution, for additional level of security before the traffic gets into the MPLS VPN V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 13

14 s Document Customer option to backup a link from a site into the VPN network Customer option to encrypt the access link between Customer premises and Provider Edge MSD must include an option for sites to connect to the same PE node. Technology such as ISDN, EVDO may be used depending on access type and speed. Consideration in network design must be given for impact on traffic supported, such as rerouting Voice traffic to an alternate path. Partner must demonstrate support for IPSec encryption, or similar solution, for additional level of security before the traffic gets into the MPLS VPN Service Level Management: Required SLA Components Mean Time to Respond (MTTN): May vary according to severity levels; best case of 20 minutes supported for high-priority issues Mean Time to Fix/Repair (MTTR): May vary according to customer needs; best case of 4 hours available as an option Service Availability: Must offer an SLA for per-customer service availability Jitter: Jitter guarantee of <30 msecs Packet Delay: Guarantee of <150msecs Intra-continental (e.g., within Europe or U.S.) and <300 msecs for Global (e.g., between Europe and U.S. Trans-Oceanic) Packet Loss Ratio: Guarantee of 1% or less packet loss for voice, video and business class data Mean Time to Respond (MTTN): May vary according to severity levels; best case of 60 minutes supported for high-priority issues Mean Time to Fix/Repair (MTTR): May vary according to customer needs; best case of 24 hours available as an option Service Availability: Must offer an SLA for per-customer service availability Jitter: Must offer an SLA for High Priority service class Packet Delay: Must offer an SLA for High Priority service class Packet Loss Ratio: Must offer an SLA for at least one class of service Partner must provide actual SLA offering MTTN for high priority issues of 20 minutes Partner must provide actual SLA offering MTTR for high priority issues of 4 hours Partner must provide actual SLA offering Service Availability, e.g., 99.99% availability Partner must provide actual SLA offering Jitter guarantee of <30 msecs Partner must provide actual SLA offering guarantee of <150msecs Intra-continental (e.g., within Europe or U.S.) and <300 msecs for Global (e.g., between Europe and U.S. Trans-Oceanic) Partner must provide actual SLA offering guarantee of 1% or less packet loss for these classes of service Partner must provide actual SLA offering MTTN for high priority issues of 60 minutes Partner must provide actual SLA offering MTTR for high priority issues of 24 hours Partner must provide actual SLA offering Service Availability, e.g., 99.9% availability Must offer an SLA for Jitter for High Priority service class Must offer an SLA for Packet delay for High Priority service class Must offer an SLA for Packet Loss for at least one class of service V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 14

15 s Document Service Level Management: Service Reports VPN Service Reports distributed on a regular schedule agreed with the customer: Asset Report Parameter Settings Report Trend Report Resource Utilization Report Configuration Report Secure Web portal to communicate current status and performance, including specific reports available online as agreed with the customer Separate performance reports for each class of service supported VPN Service Reports distributed on a regular schedule agreed with the customer Separate performance reports for each class of service supported Example reports provided or demonstration of Web portal with ability to select reports listed Demonstration of portal from customer viewpoint, including real-time view of connectivity and status of individual VPN. Mechanisms may include password protection or similar restrictions to access the online Web portal for downloading reports. Example reports for each class of service Example reports provided or demonstration of Web portal with ability to select report(s) Example reports for each class of service Service Level Management: CIO Dashboard Summary level dashboard to communicate key performance criteria, including: Network health Real-time status map Trouble ticket status Summary reports Network monitoring and periodic reporting (Daily/Weekly/Monthly/Quarterly) Demonstration of summary dashboard on Web portal provided to customer or description provided in customer documentation of capabilities to be expected Not a requirement at this level V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 15

16 s Document Metro Ethernet Network s To qualify as a Cisco Powered Managed service, the IP transport must be based partially or wholly on Cisco infrastructure, with at least 50% of the provider edge provisioned on Cisco platforms and that absorb Cisco based infrastructure ports when the Managed Service is provisioned. Same as requirements Architecture and Technical Attributes If Partner can provide evidence of certification to Metro Ethernet Forum 6 and 10.1 or MEF 9 test suite then this section is considered compliant. See Support for at least two of the three service types defined in the Metro Ethernet Forum (MEF) guidelines sections 6 and 10.1 Ability to connect multiple CPE devices from the same site Service frame transparency deliver frames across the service without adversely affecting the format Partner must demonstrate support for at least two of the three following service types: point-to-point EVC (E-Line), root-to-leaf EVC and multipoint to multipoint EVC (E-LAN), as described in section 6.1 Documented evidence in the Marketing Service Description (MSD) or equivalent documentation outlining customer design options See MEF 10.1 sec Layer 2 control processing requirements Conformance to the mandatory requirements in MEF 6 section 7 table 9 E-LMI support Service must support the E-LMI functionality mandated in MEF 16, specifically the ability to auto-configure the CE and to provide EVC status information Provision of a service that allows the customer to specify which VLAN ID they use Support for at least one service as defined in the Metro Ethernet Forum (MEF) guidelines sections 6 and 10.1 Ethernet Virtual Leased Lines or Virtual Private LAN Service Service frame transparency deliver frames across the service without adversely affecting the format See MEF 10.1 sec 7. The service must allow the preservation of the CE-VLAN ID, or for this to be different at the ingress and egress UNI. Partner must demonstrate support for at least two of the three following service types: point to point EVC, multipoint EVC E-Line) and multipoint to multipoint EVC (E-LAN), described in section 6.1. UNI 1.1 or UNI 1.2 as specified in MEF 13 See MEF 10.1 sec Layer 2 control processing requirements Conformance to the mandatory requirements in MEF 6 section 7 table 9 V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 16

17 s Document Quality of Service Quality of Service (QoS) features that enhance the capabilities of the service to support all traffic types over a converged infrastructure Ability to support hierarchal shaping, including: Class level VLAN level Physical or port level Demonstrated capability in the network design Bandwidth profile for ingress and egress ports At least 2 classes of services are available Full range of Access Support As specified in MEF 10.1 table 12 Ability to scale bandwidth offered to the customer through remote configuration, including offering customer access to different bandwidth options over the physical link Support for a VLAN connected to the Internet with appropriate security support (see below) Support of access to an MPLS VPN; if this option is used, the customer must be able to use this service as a connection option with the same QoS/CoS characteristics Ability to support Gigabit Ethernet access Support for a VLAN connected to the Internet See MEF 10.1 sec Partner must offer the ability to enforce a bandwidth profile on both the ingress and egress UNIs. Coloring must be in accordance with table Generally part of the Marketing Service Description (MSD); other service Demonstration of capability from customer portal or description from Marketing Service Description (MSD) Generally part of the Marketing Service Description (MSD); other service Generally part of the Marketing Service Description (MSD); other service Detailed in Marketing Service Description (MSD) or part of network design criteria Generally part of the Marketing Service Description (MSD); other service V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 17

18 s Document Options for Site Network Resiliency: Service Protection If Partner can provide evidence of certification to Metro Ethernet Forum 2 then this section is considered compliant. See Ability for subscriber of the service to request different protection parameters for Ethernet services Partner must provide the following options for site network resiliency: Unprotected service: Basic service with no resiliency options Fully load shared links: Traffic is load shared down redundant paths Active/passive links: One link is active and monitored. Under failure conditions the backup link is enabled See MEF 2 section Demonstrated in Technical Service Description (TSD) or other available document Site resiliency options MSD (or other available document) must detail at least two levels of site resiliency. Features to enable this include Layer 1 protection (SONET/SDH), option to connect multiple CPEs onsite, dual homing Service Level Management: Required SLA Components If Partner can provide evidence of certification to Metro Ethernet Forum 2 then this section is considered compliant. See Mean Time to Respond (MTTN): May vary according to severity levels; best case of 20 minutes supported for high-priority issues Mean Time to Fix/Repair (MTTR): May vary according to customer needs; best case of 4 hours available as an option Service Availability: Must offer an SLA for per-customer service availability Service Restoration Time: Measures how quickly the network will respond to failure on a specific service to restore connectivity without operator intervention Jitter: Jitter guarantee of <30 msecs Packet Delay: Guarantee of <150msecs Intra-continental (e.g., within Europe or U.S.) and <300 msecs for Global (e.g., between Europe and U.S. Trans-Oceanic) Packet Loss Ratio: Guarantee of 1% or less packet loss for voice, video and business class data Partner must provide actual SLA offering MTTN for high priority issues of 20 minutes Partner must provide actual SLA offering MTTR for high priority issues of 4 hours Partner must provide actual SLA offering Service Availability, e.g., 99.99% availability See MEF 2. SLA must offer all of the four options from 50 msecs to sub 5 secs specified in R4 Partner must provide actual SLA offering Jitter guarantee of <30 msecs Partner must provide actual SLA offering guarantee of <150msecs Intra-continental (e.g., within Europe or U.S.) and <300 msecs for Global (e.g., between Europe and U.S. Trans-Oceanic Partner must provide actual SLA offering guarantee of 1% or less packet loss for these classes of service V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 18

19 s Document Mean Time to Respond (MTTN): May vary according to severity levels; best case of 60 minutes supported for high-priority issues Mean Time to Fix/Repair (MTTR): May vary according to customer needs; best case of 24 hours available as an option Service Availability: Must offer an SLA for per-customer service availability Service Restoration Time: Must offer an SLA for Service Restoration Time Partner must provide actual SLA offering MTTN for high priority issues of 60 minutes Partner must provide actual SLA offering MTTR for high priority issues of 24 hours Partner must provide actual SLA offering Service Availability, e.g., 99.9% availability See MEF 2. SLA must offer all of the four options from 50 msecs to sub 5 secs specified in R4 Service Level Management: Service Reports VPN Service Reports distributed on a regular schedule agreed with the customer: Asset Report Parameter Settings Report Trend Report Resource Utilization Report Configuration Report Secure Web portal to communicate current status and performance, including specific reports available online as agreed with the customer Separate performance reports for each class of service supported Bandwidth on Demand: Partner must offer the customer the option to provision bandwidth via a Web portal without Partner intervention Example reports provided or demonstration of Web portal with ability to select reports listed Demonstration of portal from customer viewpoint, including real-time view of connectivity and status. Mechanisms may include password protection or similar restrictions to access the online Web portal for downloading reports. Examples of separate reports for each class of service Capability demonstrated via Web portal Partner must provide service performance reports to the customer on a regular basis that compare actual performance to agreed service levels Example reports provided or demonstration of Web portal with ability to select report(s) V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 19

20 s Document Service Level Management: CIO Dashboard Summary level dashboard to communicate key performance criteria, including: Network health Real-time status map Trouble ticket status Summary reports Network monitoring and periodic reporting (Daily/Weekly/Monthly/Quarterly) Demonstration of summary dashboard on Web portal provided to customer or description provided in customer documentation of capabilities to be expected Partner must demonstrate the capability to pro-actively inform the customer on key issues that affect the ability for the service to meet agreed performance levels. Demonstration of summary dashboard on Web portal provided to customer or description provided in customer documentation of capabilities to be expected V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 20

21 s Document Managed Internet Service Device-Level Security Partner must be able to demonstrate adherence to the policies and best practices outlined within the Cisco Network Foundation protection framework, as described at Data Plane Partner must demonstrate that the following capabilities have been implemented to protect the data plane on each device: Access Control Lists (ACL) protects devices from malicious traffic by explicitly permitting legitimate traffic Unicast Reverse Path Forwarding (URPF) mitigates problems caused by the introduction of malformed or spoofed IP Source addresses Remotely Triggered Black Hole (RTBH) drops packets based on source address and can be used while device is under attack QoS tools used to protect against flooding attacks Clearly defined and documented security procedures that describe how the following are implemented as part of an overall security policy: Infrastructure ACLs are applied to the network core Drops packets without a verified source address A filtering method for dropping malicious traffic at the peering edge of the network Defined QoS policies to rate limit or drop offending traffic (identify, classify and rate limit) Note: Current specifications are applicable, but newer releases and revisions may supersede the herein outlined requirements. Control Plane Partner must demonstrate the following capabilities have been implemented to protect the control plane on each device: Receive ACLs limits the type of traffic that can be forwarded to the processor Control Plane Policing (CPP) provides QoS control for the packets destined to the control plane of the device. Ensures adequate bandwidth reserved for high priority traffic such as routing protocols Routing protection MD5 neighbor authentication protects routing domains from spoofing attacks Auto secure procedures in place Partner must Demonstrate use of ACLs in security policy Demonstrate use of QoS control in security policy Demonstrate use of MD5 neighbor authentication in security policy Demonstrate lock down of devices using industry best practices (NSA) Management Plane Partner must demonstrate the following capabilities have been implemented to protect the management plane on each device: CPU and memory thresholding protects CPU and memory resources of IOS devices against DDoS attacks Dual export syslog increases availability by exporting information to dual collectors Procedures to prevent unauthorized management access to devices Procedure in place to react to thresholds being exceeded or documentation in support of functionality Part of design for collection of management information from each device Partner must have security procedure in place. Can use features such as Secure Shell only access (SSH), VTY access control list, Cisco IOS software login enhancements, SNMP V3, TACACS+. V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 21

22 s Document Data Plane Policy for protection against security attacks Access Control Lists (ACL) protects devices from malicious traffic by explicitly permitting legitimate traffic QoS tools used to protect against flooding attacks Clearly defined and documented security policy covering protection of infrastructure from security attacks Infrastructure ACLs are applied to the network core Defined QoS policies to rate limit or drop offending traffic (identify, classify and rate limit) Control Plane Routing protection MD5 neighbor authentication protects routing domains from spoofing attacks Auto secure procedures in place Demonstrated use of MD5 neighbor authentication in security policy Demonstrated lock down of devices using industry best practices (NSA) Management Plane Procedures to prevent unauthorized management access to devices Partner must have security procedure in place. Can use features such as Secure Shell only access (SSH), VTY access control list, Cisco IOS software login enhancements, SNMP V3, TACACS+. Demonstrated in Technical Service Description (TSD) or other available document No device-level security requirements at this level Security Infrastructure: DDoS Protection Partner must be able to demonstrate adherence to the policies and best practices outlined within the Cisco Cleanpipes DDoS infrastructure protection detailed at Regional Cleaning Centers deployed using Cisco Guard solution Network based mechanism to identify, classify and mitigate attacks based on anomaly characteristics Process to baseline normal traffic loads periodically, at least weekly; must be repeated on a regular basis as agreed with the customer Ability to conduct network based traffic tuning on the detection network for at least 24 hours at peak traffic time No DDoS protection requirements at this level Evidence of network design that includes Cleaning Centers Demonstrated process to identify, classify and mitigate attacks based on anomaly characteristics Demonstrated process for periodic baseline of traffic loads; must be at least weekly and repeated as agreed with customer Demonstrated process for network based traffic tuning on the detection network for at least 24 hours at peak traffic time V4.0 05/01/08 This document is Cisco Confidential. For Channel Partner use only. Not for distribution. 22