NUCLEUS UPTIME LEVEL AGREEMENT & SERVICE PACKS

Transcription

1 NUCLEUS UPTIME LEVEL AGREEMENT & SERVICE PACKS Table of contents 1. About Nucleus... 3 Healthy grower... 3 Hosting Solution Builder References Our Network... 5 Description... 5 Advantages Our datacenters... 7 Locations... 7 Description... 7 Advantages Security Physical security of the equipment Network security Monitoring the access rights at Nucleus ISO Uptime Level Agreement Physical security Power Automatic climate control Fire protection and water detection Network infrastructure & connectivity Availability Measuring method Quality and availability connectivity Availability bandwidth Availability of the supplied services Availability support Service Packs Review Summary Critical versus non-critical support Versie 4.1 ( ) - Page 1

2 8.4. Paid or free support? /7 emergency number Response period Solution Goal Updates and patches Server management Infrastructure monitoring Basic monitoring Advanced monitoring & trending Trending surveillance External Monitoring Backup check Restores Alert handling Traffic reporting Resource use Incident reporting Root Cause Analysis Report analysis and executive summary Advanced services Delivery and installations Delivery server Software installation Acceptable Use Policy Access to the systems Abusing the server Compensations and statutory provisions Compensation when not realising the ULA Difference between ULA and service pack description Submitting the claims Relationship with general terms and conditions Versie 4.1 ( ) - Page 2

3 1. About Nucleus Healthy grower Since its start in 2000 Nucleus has obtained a place at the top of the Belgian hosting companies. Our strength? The expertise of a small committed team. They are all specialists in their field of expertise who work complementarily. In the first place Nucleus wants to be a healthy company. No cowboy ways. A sensible policy in the operational and financial field. Stability on the balance sheet and in the racks. Hosting Solution Builder Nucleus is a hosting solution builder. We cannot formulate this any better. Hosting: The alpha and omega, our core business. Nucleus offers hosting and all things related to this. If there is no connection with hosting, we will not be involved. Solution: The background of the company managers is in consultancy. First listen, then speak, then take action. We identify the problems which (could) emerge and seek the optimal solution. Builder: Nucleus stands for a hands-on approach. Both in the field of software and hardware we are not afraid to soil our hands. We therefore do not depend on external technicians. This means that we can deliver tailor-made work for our clients. Efficient and effective. Versie 4.1 ( ) - Page 3

4 2. References Nucleus manages more than 1,600 servers divided over 4 datacenters. Below we show some of our clients, because it shows you that we have experience with working with large and small companies, private companies and the government, IT and other sectors, Versie 4.1 ( ) - Page 4

5 3. Our Network Description A double redundant dark fibre ring connects the datacenters in Nossegem, Antwerp, Zaventem and Diegem. The first ring connects Nossegem, Zaventem and Diegem. The second ring includes Antwerp, Zaventem and Diegem. All locations have redundant 10Gig Ethernet connections on this dark fibre ring, so that our network throughout the four datacenters form one logical network. Failover solutions in a multidatacenter approach are made possible in this way. In InterXion Zaventem and LCL Antwerp our backbone ring is connected with several national and international TIER1 providers. In order to always be able to offer sufficient capacity all these connections are equipped with at least 10GE uplinks. The network is also peered with all large providers in the largest hub of Europa through NL-IX and AMS-IX. These uplinks and Versie 4.1 ( ) - Page 5

6 peerings are evaluated on a regular basis. When selecting these uplink providers of peering connections we will always let the quality (latency etc.) prevail. If you want to let your solution at Nucleus be part of your own private network between, for example, various locations, we can also offer different solutions here. For example, Nucleus has partnerships with Proximus (Explore), Eurofibre, Destiny, Mobistar. Other providers are also always possible. The border routers in Zaventem and Antwerp are Juniper MX routers, with a total routing capacity of 480 gigabit/s. The core and distribution switches are fully connected with multiple 10Gig Ethernet connections. Clients can be connected from redundant distribution switches to multiple connections. For example, Nucleus can guarantee all requirements regarding bandwidth, however large. Each colocation datacenter is also equipped with redundant Juniper firewalls which can be switched on as a shared firewall for those who also want to subcontract the security to Nucleus. Besides this shared firewall solution it is also possible to install numerous dedicated firewall solutions for your project. Advantages Virtual Ethernet possible between datacenters Location non-bound IP network Backbone by the company itself Several TIER1 as uplink High bandwidth routing Optimal security for your hosting solution Versie 4.1 ( ) - Page 6

7 4. Our datacenters Locations At present Nucleus operates from four datacenters: Antwerp, Nossegem, Diegem and Zaventem. Nossegem and Antwerp are completely equipped as high density datacenters. This datacenter is owned by Mobistar and is located along Leuvensesteenweg in Nossegem. The Antwerp datacenter is situated in the North Trade Building, Noorderlaan 133 in Antwerp. Diegem is equipped as a network datacenter. Diegem is also our location where we connect our fibre network to various uplink providers. After all, Diegem has more than 50 carriers. The datacenter is owned by LCL and is located at Kouterveldstraat in Diegem. Zaventem is our second location in our Brussels ring. Here we only develop colocation services after an explicit request and do not have an own suite. The aim of this POP is to guarantee the full redundancy of our network. After all, Zaventem also has more than 50 uplink providers to which we can connect, including the known BNIX hub. Zaventem is operated by InterXion and is located at Wezenbeekstraat in Zaventem. Description Own suites In Nossegem and Antwerp we have our own suites. This means that we can check everything within our own space ourselves: each cable is placed under our supervision and we can therefore place installations and connections without any restrictions. Strict security All our racks and rack compartments are locked with individual combination locks. Clients who use shared colocation or dedicated servers only have access after a request and under supervision. Clients who have dedicated racks or compartments, have independent 24/7 access on the basis of previously defined access lists. All buildings and spaces are fully monitored by all kinds of access and alarm systems. Nossegem and Zaventem are monitored 24/7 by a security agent on the spot, while Diegem and Antwerp are under surveillance of a video room. Versie 4.1 ( ) - Page 7

8 It is obvious that there are also extensive movement detection systems and camera surveillance systems through a CCTV system. At the same time there are also extensive fire detection, extinguishing and water detection systems. Cold contained corridors create high density In our datacenters we work with the principle of cold contained corridors (sometimes also called aisles). In this set-up a double row of racks is always arranged as a closed island. The middle corridor is closed by automatic doors along both sides and is under pressure of cold air. The hot air is therefore blown this island at once outside by the servers and sucked off again alongside the outside above. Inside in the racks we strictly monitor the use of blinding panels in order to avoid that cold air mixes with hot air. This method of working has numerous advantages: high density (until 32 amperes per rack), whereby we guarantee that servers at the top in the racks are also cooled sufficiently, but at the same time are used less (your fans have less work) and your servers have a longer life. For these systems we rely on Minkels, which does not only supply high-quality material to us, but is also involved in designing our rooms, so that they can make use of their worldwide expertise in arranging data center rooms in an efficient way. The cooling of the air is guaranteed by redundant air-conditioning units. The control units of the air conditioning are double in our suites. The cooling takes place outside by a whole battery of chillers, whereby various chillers may fail without any problems for the datacenter. This therefore also implies transparent maintenance. Extensive power supplies The Brussels datacenters are all arranged according to the 2N principle regarding their power supply. Antwerp has been built up according to the N+1 principle. Each building has two separated high-voltage lines, each of which has an own transformer and is fully redundant. That is to say, if one transformer would fail, the other transformer is powerful enough to fully power the datacenter. From there the power goes to two separated UPS rooms. Each UPS room has been built redundantly, so that each separate UPS is sufficient in itself to power the double circuits. This is not only handy when the external electricity network fails, but also when maintenance has to be performed. This is always planned for each UPS separately. In Antwerp the situation is slightly different: there are 3 UPSs in 1 room (1 UPS per circuit and 1 as a backup for both active UPSs). Versie 4.1 ( ) - Page 8

9 The UPS rooms are not only connected to the double transformers, but are also back-upped by at least 4 emergency generators, of which in principle only 2 are necessary to keep the datacenter in operation. They are tested monthly under a full load, so that surprises are excluded. A circuit leaves from each UPS room. This A+B arrangement is continued up to each rack. Each rack is separately fused. If there are smaller compartments all compartments are even fused. This gives you a guarantee, in contrast with other providers, that you cannot be a victim in your quarter rack of a short-circuit of your neighbour. With compartmented racks all cables, both the power and network cables, are fully separated from the other racks. Network cabling of the new generation All cabling between the core and distribution switches as well as to the individual racks consists of CAT6A/10GigE cabling. We decide to prepare our internal backbone for 10 gigabit Ethernet, that we can not only comply with high bandwidth requirements on our fibre network, but also for your switch or servers. However, if you also need fibre connections, we can also build this for you tailor-made. Due to the expansion of our distribution switches and the VRPP protocol, we can give each switch a redundant uplink, without you having to apply extensive configurations yourself or place complex and unreliable voltage tree switches. Just plug in two Ethernet cables and you can start, Nucleus will do the rest. Due to our own fibre network we can also offer you a virtual Ethernet connection between Nossegem and Antwerp. We will give you an extra Ethernet cable along both sides and your both locations will act as one virtual LAN. It is obvious that we make extensive use of VLAN s to separate your traffic from other traffic, so that you can always have the best guaranteed uplink speed. As a standard all our connections are burstable up to 1 gbit/s. Advantages Own suites for more flexibility Extensive security measures High density, up to 32A per rack Cold contained corridors Qualitative Minkels racks Versie 4.1 ( ) - Page 9

10 2N+1 power supplies Double redundant network CAT6A/10GigE cabling up to the racks Separate fuses per rack compartment Versie 4.1 ( ) - Page 10

11 5. Security Physical security of the equipment The datacenter is 24/7 guarded by a security team on the spot. This team makes rounds and has a CCTV system which monitors the perimeter around the building, as well as all accesses and passageways. The entrance itself is closed with gates and a barrier, which is operated by the security agent. Access to the building is only possible by persons who have been placed on the access list in advance. Nucleus manages this access list for its suite. Furthermore, the building is equipped with access and movement detectors. The suite itself is equipped with fire and water detection systems. Fire is combated on the basis of Argon gas. The gas supply is sufficient to fill the entire building in one go. The suite itself is filled with a cold contained aisle racks. Each rack is locked with an individual combination lock at the front and back. Its code is only known by the competent persons. Each individual server is equipped with sensors which detect unauthorised opening. It is also detected when the power is removed (and therefore switched off). The functioning of the servers is also checked by an external monitoring system. In case of failure of a component, our NOC will be informed automatically at once, 24/7. Versie 4.1 ( ) - Page 11

12 Network security Another aspect of security is what goes to the servers through the internet. Optionally we work with a double security: First of all, the perimeter is monitored. The redundant Juniper Firewalls have been placed near the border routers. These physical firewalls are suitable for inspecting high traffic in depth. These firewalls provide protection as follows: Flood attacks: detection of superfluous traffic of one of several origin points if these certain parameters are exceeded. In a cascade of counter measures these attacks are blocked automatically and reported to the NOC. If necessary, the NOC will then nullroute such origins to definitely guarantee the traffic to the network. Scans: IP and port scans are detected very fast and the traffic coming from such scans will then be blocked from access to the network during a random period. Repeated attempts of the same origin may result in a longer blockage of this origin. Intrusion Detection: based on the renowned system of Juniper itself it is checked whether there is intrusion in masked packets on the basis of in-depth scanning of the IP packets. In case of detection they are blocked and reported at once. Access control: clients who take this option can obtain certain access rights through VPN. The VPN tunnels are then terminated on the Juniper firewalls which can set up fully IPSEC compliant tunnels with other branch connection points, also of other brands. By using high-level Juniper technology these tunnels can be set up with AES encryption without loss of network speed. Setting and configuring the security may only be done by Nucleus staff that has been trained and authenticated for this purpose. Monitoring the access rights at Nucleus We apply a central access policy. A central authentication server manages the access rights of each individual staff member. Revoking rights of an employee therefore takes place on a central basis and can be done with one push on the button. Managing this central security is the responsibility of both managing partners. The second highest clearance is reserved to the senior system engineers. Only the above-mentioned persons can delegate rights to others. Each individual employee of Nucleus has included the following provision in its employment agreement: During the term of this agreement and after its termination the employee is obliged to not provide any reliable information or confidential procedures and programs regarding Versie 4.1 ( ) - Page 12

13 the functioning and policy of the company to third parties, irrespective of its importance and possible impact. Confidential information refers to the details, data, programs or procedures which are not known to the public, or which can be known to others through an illegal action. This clause regarding the confidential handling of data also applies to the data and documents received by the company as part of its work for clients. This information is owned by clients and may never be used for other purposes than those for which the company received an assignment. They may never be made available to non-accepted third parties. The labour regulations also clearly state the following: At the company the following actions, amongst others, are considered as serious shortcomings which make all forms of professional cooperation impossible at once and definitely: [ ] violation of business secrets; [ ] violation of business secrets of clients. We attach much importance to this and our employees know that this violation will be sanctioned at once. If they cause damage, to us or the client, they will be prosecuted. Since we started we never have had to make use of these provisions. Versie 4.1 ( ) - Page 13

14 ISO Nucleus has had an ISO certificate since June This quality label is the result of an extensive external audit in the field of Security Management. We therefore offer our clients an extensive guarantee for the security of their hosting solution bij Nucleus. ISO/IEC 27001:2005 is part of the growing family of ISO/IEC standards. ISO/IEC 27001:2005 is a standard regarding an Information Security Management System (ISMS) and was published in October 2005 by the International Organisation for Standardization (ISO) and by the International Electrotechnical Commission (IEC). The norm specifies requirements for establishing, implementing, carrying out, monitoring, assessing, updating and improving a documented Information Security Management System (ISMS). The ISMS has been designed to guarantee the choice of adequate and proportional security measures that protect the information and give confidence to interested parties. The ISO standard regards all aspects of data protection: 1. Policy-related (management) 2. Organisational (responsibilities) 3. Operating assets (infrastructure, network, systems and other operating assets) 4. Staff (company rules, errors, theft, fraud, abuse) 5. Physical (locks, fire protection) 6. Communication and operation (managing systems, processes and procedures) 7. Access control (logical & physical) 8. System and software development and maintenance (documentation, processes) 9. Incident management (anticipating and responding to security problems) 10. Continuity (disaster provisions) 11. Regulations (Computer Crime Act, Personal Data Protection Act) ISO requires that the management: systematically investigates the security risks of the company and makes others aware of the threats, weaknesses and their impact; designs and implements a coherent and comprehensive system of security control, so that all forms of risk management (such as risk avoidance) and the risks which are considered to be unacceptable are tackled; introduces a coordinating management process to constantly to monitor the evolving security risks. Versie 4.1 ( ) - Page 14

15 The advantages of ISO are: It is an expansion of the general quality system to include everything related to security; It offers an opportunity to map and manage all risks in connection with IT systems; Creates confidence with and a guarantee of a sound security management for commercial partners and clients; Offers an independent audit of all procedures related to security. Versie 4.1 ( ) - Page 15

16 6. Uptime Level Agreement Nucleus has rooms in four different carrier neutral datacenters: Antwerp (LCL), Nossegem (Mobistar), Zaventem (InterXion) and Diegem (LCL). These datacenters are all equipped with UPS (Uninterruptable Power Supply), an emergency power generator, automatic climate control, fire detection, temperature control, access control, circuits and network connections. Nucleus sees to it that the facilities are extended redundantly. In Nossegem and Antwerp we have our own suites. This means that we can check everything inside our own rooms ourselves: each cable is placed under our supervision and we can therefore place installations and connections without any restrictions Physical security Our datacenters are guarded 24/7 by an external security company. There is also camera surveillance and movement detection in each room. Access to the datacenter is either checked though electronic access, or through checks by the security agent. Access is only allowed by persons who are reported individually on the access list. All our racks and rack compartments are locked with individual combination locks. Clients who make use of shared colocation or dedicated servers only have access after requesting this and under supervision. Clients who have dedicated racks of compartments have the same independent access 24/7 on the basis of previously defined access lists Power The datacenters are all arranged according to the 2N principle regarding their power supply. According to the 2N system, there are two separated high-voltage lines, each of which has an own transformer and is fully redundant. That is to say, if one transformer would fail, the other transformer is powerful enough to fully power the datacenter. From there the power goes to two separated UPS rooms. Each UPS room has been extended redundantly, so that each separate UPS is sufficient in itself to power the double circuits. This is not only handy when the external electricity network fails, but also when maintenance has to be performed. This is always planned for each UPS separately. The UPS rooms are not only connected to the double transformers, but are also back-upped by at least 4 emergency generators, of which in principle only 2 are necessary to keep the datacenter in operation. They are tested monthly under a full load, so that surprises are excluded. Versie 4.1 ( ) - Page 16

17 In Antwerp the situation is slightly different: there are 3 UPSs in 1 room (1 UPS per circuit and 1 as a backup for both active UPSs) and 1 emergency generator. A circuit leaves from each UPS. This A+B arrangement is continued up to each rack. Each rack is separately fused. If there are smaller compartments all compartments are even fused. This offers you a guarantee, in contrast with other providers, that you cannot be a victim in your quarter rack of a short-circuit in another compartment. With compartmented racks all cables, both the power and network cables, are fully separated from the other racks Automatic climate control In our datacenters we work with the principle of cold contained corridors (sometimes also called aisles). In this set-up a double row of racks is always arranged as a closed island. The middle corridor is closed by automatic doors along both sides and is under pressure of cold air. The hot air is therefore blown this island at once outside by the servers and sucked off again alongside the outside above. Inside in the racks we strictly monitor the use of blinding panels in order to avoid that cold air mixes with hot air. This method of working has numerous advantages: high density (until 32 amperes per rack), whereby we guarantee that the servers at the top in the racks are sufficiently cooled, but at the same time are used less (your fans have less work) and your servers have a longer life. For these systems we rely on Minkels, which does not only supply high-quality material to us, but is also involved in designing our rooms, so that they can make use of their worldwide expertise in efficiently arranging data center rooms. The cooling of the air is guaranteed by redundant air-conditioning units. The air conditioning in our suites has double control units. The cooling takes place outside by a whole battery of chillers, whereby various chillers may fail without any problems for the datacenter. This therefore also implies transparent maintenance. The cooling of the air is guaranteed by redundant chillers. The air conditioning in our suites has double control units. This therefore also implies transparent maintenance. The cooling of the rooms guarantees that the inlet temperature of the equipment never fluctuates very fast and remains below the critical point of the servers (18-28 Celsius). At the same time the air humidity is normalised (35-65%). Versie 4.1 ( ) - Page 17

18 6.4. Fire protection and water detection All suites are equipped with extensive detection and smoke, fire and water combatting systems. The detectors can be found on top and below the floor. The necessary alarm systems give an adequate response in order to prevent fire or water seepage Network infrastructure & connectivity We decided to prepare our internal backbone for 10 gigabit Ethernet, so that we can not only comply with high bandwidth requirements on our fibre network, but also for your switch or servers. The Nucleus network is built up on the basis of two connectivity POP s (Zaventem and Antwerp). Because of the geographic distribution of both POP s we offer the guarantee that we are independent from similar fibre backbones. The border routers are Juniper MX routers, with a total routing capacity of 480 gigabit/s. The core and distribution switches consist of Juniper and Cisco equipment. As a standard all our connections are burstable up to 1000 mbit/s. Each colocation datacenter is also equipped with redundant Juniper firewalls, which can be switched on as a shared firewall for those who also want to subcontract the security to Nucleus. A double redundant dark fibre ring connects the datacenters in Nossegem, Antwerp, Zaventem and Diegem. The first ring connects Nossegem, Zaventem and Diegem. The second ring includes Antwerp, Zaventem and Diegem. All locations have redundant 10 gigabit Ethernet connections on this dark fibre ring, so that our network forms one logical network throughout the four datacenters. In InterXion Zaventem and LCL Antwerp our backbone ring is connected with several national and international uplink providers. The Nucleus network is also connected with the AMS-IX and NL-IX. The Amsterdam Internet Exchange (AMS-IX) is the most important internet hub of the Netherlands and the second largest one in the world. Versie 4.1 ( ) - Page 18

19 7. Availability 7.1. Measuring method For the calculation of the availability, Nucleus applies the following formula A (T S) 100 Whereby A = the actual availability of the service, expressed in minutes, as measured by the Nucleus monitors T = total number of minutes in the month in question S = number of minutes scheduled downtime Scheduled downtime = each announced maintenance to the service in question. Nucleus always must announce this maintenance at least 5 working days in advance, unless it is necessary to intervene at once in order to not interrupt the general service or because security reasons Quality and availability connectivity The availability of the Nucleus network is measured both inside and outside the own network. The network is considered as unsuitable when more than 1.5% packet loss is established from these contact points. Nucleus also guarantees that the average latency on its network within Europe will be 90 ms or less and will be 200 ms or less on the transatlantic part. Nucleus reserves the right to carry out urgent interventions on the network when required. Nucleus cannot be held responsible by Denial of Service for attacks from outside its network. Average latency on the European Nucleus network <= 90 ms Average latency on the transatlantic Nucleus network <= 200 ms Average packet loss on the Nucleus network <= 1.5% 7.3. Availability bandwidth Nucleus always guarantees sufficient burst capacity on its uplinks. Every 5 minutes Nucleus measures the average speed on its network. Nucleus guarantees at least an overcapacity of 30% on the average of the top 5% measurements. In this way we do not guarantee an extra capacity above the average, but the certainty of extra peak capacity on top of the already measured peaks. Availability bandwidth >= 30% compared to top 5% peaks Versie 4.1 ( ) - Page 19

20 7.4. Availability of the supplied services At Nucleus we do not apply complex ULA s for the various components. You purchase a service from us and you want to be sure that it is available. What difference does it make that your server cannot be accessed because of a cooling or a network problem. The guaranteed availability is laid down for each service in the following way: Max unavailability ULA per month shared hosting best effort not applicable DNS 99.95% 22' colocation 99,90% 44 dedicated server 99.25% 5hr30 Open Cloud 99.50% 3hr40 VMWare Cloud 99.97% Availability support Our support services are available for everybody during office hours (Monday-Friday from hours). The emergency number is available 24/7 for all clients with a colocation, dedicated server or Open/VMWare cloud server contract. Versie 4.1 ( ) - Page 20

21 8. Service Packs 8.1. Review Essentials Essentials+ Managed Managed+ 24/7 emergency number þ þ þ þ Including support Infrastructure Infrastructure Unlimited Unlimited Critical support Response period <2hrs <30 <15 <15 Solution goal <4hrs <1hr <30 <30 Non-critical support * Operations Monitoring Response period NBD <8hrs <4hrs <1hr Solution Goal RE <16hrs <8hrs <2hrs Update & patch management þ þ Server management þ þ Infrastructure þ þ þ þ Basic monitoring þ þ þ Advanced monitoring þ þ þ Trending graphs & alerts þ þ þ Trending surveillance External monitoring Alert follow-up By the client By Nucleus 24/7 þ þ Reports Traffic use þ þ þ þ Resource use þ þ þ Incidents þ þ RCA Report analysis & executive summary þ þ þ þ þ Advanced services** Security testing Penetration testing Stress testing þ þ þ Versie 4.1 ( ) - Page 21