RACKSPACE MANAGED VIRTUALISATION SERVICE

Transcription

1 RACKSPACE MANAGED VIRTUALISATION SERVICE Date: 10 th April 2014 UK SALES: +44 (0) UK SUPPORT: RACKSPACE HOSTING 5 MILLINGTON ROAD HAYES, UB3 4AZ, UNITED KINGDOM

2 CONTENTS 1. Overview Information Assurance Backup / Restore / Disaster Recovery On-Boarding & Off-Boarding Service Management Service Constraints Service Levels Financial Recompense Training Ordering and Invoicing Termination Terms Data Restoration / Service Migration Customer Responsibilities Technical Requirements Additional Features Data Centre EU Code of Conduct Supporting Documentation /3131

3 1. OVERVIEW The Rackspace Managed Virtualisation solution is aimed at customers who need scalability but also guaranteed resiliency and the security of a dedicated hosting platform. Managed Virtualisation is based on the industry leading VMware technology, using the latest vsphere product suite to create dedicated resource clouds. Customers deploy fast scaling virtual machines, backed with Fanatical Support, for the highest levels of service and availability. All VMware hypervisors reside on dedicated physical hardware that is not shared with other customers. VMware vsphere s clustered hypervisor deployments make full use of cloud concepts by allowing customers to seamlessly introduce more capacity to their solution on demand and provision virtual machines quickly and easily to cope with changing demand. Rackspace fully manages the hypervisor tier and allows customers to concentrate on application delivery inside the virtual machines, without needing to employ qualified virtualisation engineers. Rackspace Managed Virtualisation solutions are available at three levels of Service Management: Intensive Hosting Service Managed Hosting Service Core Infrastructure Service Each service level offers different levels of support and assistance with the design, deployment and support of your infrastructure. Hybrid Cloud The ability to mix cloud solutions with dedicated servers allows Rackspace to offer you hybrid cloud solutions. Dedicated Managed Hosting + Public Cloud = Hybrid Solution To optimise the performance, security and scalability of your infrastructure, it is critical to have the right compute platform supporting each element of your hosted solution. Rackspace offers a complete portfolio of compute platforms as well as the ability to mix, match and combine to make them all work together seamlessly. RackConnect means you get the best of both worlds: managed dedicated hosting for mission-critical applications, plus the flexibility and fast provisioning delivered by the public cloud. Whether you require dedicated servers and Cloud Servers operating independently for different workloads, or an integrated architecture for bursting extra compute cycles, Rackspace RackConnect allows you to mix and match compute platforms to best suit your needs. For more information please refer supporting documentation on Hybrid Cloud. 3/3131

4 2. INFORMATION ASSURANCE Rackspace holds current ISO certification, which has been in place since October Rackspace works with CLAS consultants to deliver appropriately accredited solutions and has the capability to meet the solution requirements detailed by the consultant s risk assessment for IL2 requirements on a solution-by-solution basis. Where solutions need to be accredited to an appropriate Impact Level, the cost of the CLAS consultant is NOT included within the service. Rackspace currently delivers solutions up to IL2 for UK Public Sector organisations; these solutions are accredited at a departmental level on a solution-by-solution basis demonstrating that our security and technical controls are capable of protecting customer data at the appropriate level. 3. BACKUP / RESTORE / DISASTER RECOVERY 3.1. Managed Backup and Data Restoration Rackspace provides a variety of managed backup options for our Managed Virtualisation service. Rackspace will perform backups of data on your servers using CommVault data protection software. Data is streamed across a dedicated network interface in each server, eliminating the possibility of backups causing network congestion on publicly accessible interfaces. Backups are performed daily at a time you designate. The scope and type of backups are customer defined, although the most typical schedule tends to be weekly full + daily differential. Off-Site Tape Storage Options Rackspace can optionally provide 4, 12 and 52 week retention periods with offsite rotation depending upon the Customer s requirements. For offsite tape subscribers, tapes are taken from the libraries, placed into locked bins, and carried to inventory for transport to Iron Mountain facilities once a week. Using the AES-256 encryption standard, Rackspace encrypts off-site tape data at the tape layer. LTO Encryption keys are retained and managed by Rackspace, and stored in secure locations, allowing drives to be safely and securely unlocked as required. Rackspace will be responsible for data restoration should the need arise. We will initiate restoration of your data stored onsite within two hours of the time that you request the restore via a support ticket, or within six hours if the tapes containing the required data are located offsite. As our backup options are fully managed by Racksapce. Data restoration is simply a matter of calling your Rackspace support team or creating a support ticket in the MyRackspace portal as described in section 5.2 below. Alternatively we can also offer a Virtual Machine snapshot backup service called Rackspace VM Recovery. This backup option creates a daily snapshot copy of each virtual machine with the same retention options as the standard backup service. 4/3131

5 Restoration can be made at the file or VM level and as with the standard Managed Backup service, Rackspace is responsible for data restoration should the need arise Disaster Recovery Customers are advised that in regard to Disaster Recovery (DR) it is the responsibility of the customer to design their solution architecture to meet their required recovery time objective (RTO) and recovery point objective (RPO). Rackspace has a variety of options that can be used to meet your desired objectives. We can offer a solution based on replicated storage between two Rackspace data centres that utilises VMWare Site Recovery Manager to provide a sophisticated DR offering. As this service is custom designed and built to your specific requirements, pricing is available on request Cloning Snapshots provide increased data protection during your OS and application upgrades, providing a real time copy of your VM with a click of a button. This is available via the MyRackspace customer portal. 5/3131

6 4. ON-BOARDING & OFF-BOARDING 4.1. On-Boarding At Rackspace, we make an investment in our relationship from the beginning by providing a fully managed implementation. The Customer s deployment will be led by your Service Delivery Manager and Implementation Manager. These employees will ensure that your environment is built and configured to your specifications. During the implementation, the Service Delivery Manager will get to know you, your focal points and concerns. He/she serves as a single point of contact, available 24/7, and work with you to understand all your business requirements, including software and application configuration, to ensure that your environment will work efficiently for your business. The implementation process is designed to capture the specific customer requirements regarding the hosted configuration. Some of this will already have been captured during the sales process however the implementation call / meeting is an opportunity for both Rackspace and the Customer to confirm all specific requirements Intensive Service Implementation The diagram below describes in detail the steps involved in the rigorous deployment process of our Intensive solutions. 6/3131

7 4.3. Managed Service Implementation For the Managed and Core Infrastructure implementations, the timeline is approximately 23 days Off-Boarding The Customer may raise a request for decommissioning devices through the MyRackspace customer portal. We ask for 90 days written notice if your contract term with Rackspace has expired and you are on a rolling monthly term. If your contract term has not expired yet, appropriate termination fees would also apply (see Termination for Convenience section for further details). The Service Delivery Manager picks up the ticket to decommission devices in our internal proprietary ticketing system. An automated a ticket is then sent advising the Customer the device has been scheduled for cancellation. This ticket will be sent to every contact affiliated to the device. A second automated ticket will also be sent to every contact affiliated to the device to remind them of the imminent cancellation, 1 business day prior to decommissioning. This process ensures that the Customer is completely aware when a device is due to be cancelled, removing the need for last minute calls asking for a stop to the initial decommission request. If you wish to leave Rackspace, we will work with you and your new hosting provider, if applicable, to help you transition away smoothly. Rackspace will not perform any transition services, however we are available to answer any questions you have on the solution set-up Drive Destruction Process Rackspace offers a variety of data destruction options for our Managed Virtualisation service depending on customer requirements. This ranges from simple wiping and secure LUN wiping to industry best practice standards providing a certificate of erasure. 7/3131

8 5. SERVICE MANAGEMENT 5.1. Service Delivery Team At all times, the Customer will have access to a team of experienced IT professionals, all of whom work to really understand your systems, your business priorities, and how you like us to interact with your organisation. We assign dedicated personnel to manage the service delivery, technical and commercial needs on your account, who are, in turn, supported by an extensive team of technical experts. Your service delivery team will monitor your infrastructure and analyse trend reports to identify and resolve potential issues before they become problems. Furthermore, we will proactively investigate tactical options for improving your system s performance, and work with you on proposals to evolve your hosting environment in the longer-term. Service Delivery Manager: Your dedicated Service Delivery Manager will be responsible for ensuring the service delivered is in line with our obligations but, more importantly, to endeavour that it is to your satisfaction. He/she will be your primary point of contact for all operational issues and will co-ordinate resource within Rackspace for projects, service requests and high severity incidents on your behalf. Lead Engineer: Rackspace will nominate a dedicated Lead Engineer to work alongside the Service Delivery Manager. He/she is responsible for managing the performance, stability and change within the hosted infrastructure provided by Rackspace. In addition, the Lead Engineer is responsible for ensuring uptime meets the agreed levels as defined in the Hosting Services Agreement and works with the Customer to ensure all hosted applications meet your required performance levels. The Lead Engineer is offered with the Intensive service level only. Solution Architect The Solution Architect is a pre-sales resource who is responsible for governing the technical design activity, to ensure that the overarching strategic objectives and of the Customer are realised in the design. For existing customers under Intensive service level, he/she works alongside the Lead Engineer when architecting new elements within an existing hosted solution. This includes but is not limited to, working with you to define outage impact assessments for all business services and risk profiling them to ensure that disaster recovery principals weighted correctly using the Rackspace probability-impact-cost design methodology. He/she will apply a broad technical and product understanding to scope the most appropriate technical solution for the Customer. Working together with the Sales Representative, the Solution Architect will ensure that we are not only considering budgetary and technical constraints, but also make recommendations to you based on suitable alternatives that you may not have considered. 8/3131

9 Business Development Consultant The Business Development Consultant will facilitate the expansion of the Customer s hosted solution. He/she will create relationships with the key stakeholders within your team and other areas of your business where applicable to help you maximise your operating efficiency through the take up of our product and services. Shared Resources In addition to the team members mentioned previously, there is an extended team of specialists available to support the delivery of the solution. Details of the various roles are listed below. Data Centre Technicians Operations System and Infrastructure Support Network Security Managed Backup Storage Operations Managed Virtualisation (VMWare) Engineers Database Administrator (DBA) Monitoring Rackspace support team is available to the Customer 24x7x365, and will supplement your internal IT team by taking responsibility for managing the day to day operations of your hosted infrastructure. We utilise a follow-the-sun support structure and have teams of Red Hat and Microsoft certified engineers available on a 3 x 8 hour shift system, to ensure we provide global coverage Rackspace Engagement The Customer can engage the Rackspace support team in a number of ways by creating a ticket on the MyRackspace portal, by calling the free support number directly, or escalating to a member of your dedicated account team, the latter is recommended for high severity incidents. All customer phone calls and automated alert tickets come in to the Support Specialists. They are our 1 st line technical support staff who provide support for the physical infrastructure. Urgent and emergency issues are escalated immediately to the appropriate level System Administrator (L1/L2/L3). For standard issues, if the Support Specialist cannot resolve your issue within 15 minutes, they escalate to a System Administrator. The Customer generated tickets go directly into a ticket queue, which the Support Specialists monitor and assign. L2 and L3 System Administrators are assigned the more complex, higher level, and urgent tickets. Rackspace uses its own ticketing system and proactive monitoring systems to achieve the above. As our support team progress the ticket they will provide the Customer with regular updates documented within the ticket. These updates trigger alerts to be sent to the named recipients on the ticket to inform them of update. They can be reviewed and commented on by the Customer via the MyRackspace portal. 9/3131

10 5.3. ITIL Aligned Processes Rackspace processes and procedures are aligned to the most widely accepted approach to service management, ITIL. These procedures provide the structure behind Fanatical Support our proprietary approach to service management. Our process and procedure methodologies provide the framework within which our service delivery teams and the rest of our service operation deliver service to our customers. Rackspace aims to be responsive, flexible and easy to deal with and our processes provide the dependability and consistency in day to day activities, and cover the following areas: Account Administration Contract Escalation Service Level Management Financial Management Infrastructure Implementations Infrastructure Decommissions Security Patch Management Anti-Virus Management Change Management Incident Management Configuration Management Backup & Restores Capacity Management These are best practices as they pertain to service level management in a hosting environment. They describe a framework for how we successfully manage and support our customers environments of critical applications, by aligning our process with the industry best practice ITIL and delivering exceptional service via our commitment to Fanatical Support. As part of Fanatical Support, the Customer will have direct access to our highly skilled technical support contacts 24x7x365, who will work with you to find a rapid solution to any incidents that may impact your solution. For more information please refer to supporting documents on RAX Managed Virtualisation Intensive Service Description and RAX Managed Virtualisation Managed Service Description. 10/3131

11 6. SERVICE CONSTRAINTS 6.1. Support Boundaries / Interfaces of the Service MyRackspace portal is a secure Rackspace self-management customer portal, which provides a suite of account management and reporting tools, and incorporates a ticket communication system between Rackspace and the Customer. Access via the MyRackspace customer portal allows you to: Turn virtual servers on/off (chargeable on a daily basis) Cloning Snapshot Templates (for deployment of new virtual servers) Create and manage support tickets 6.2. Data Centre Maintenance Windows Rackspace maintenance windows modification or repairs to shared infrastructure, such as core routing or switching infrastructure that we provide notice of at least seventy two (72) hours in advance and that occurs during off peak hours in the time zone where the data centre is located Scheduled Customer maintenance maintenance of your configuration that you request and that we schedule with you in advance (either on a case by case basis, or based on standing instructions), such as hardware or software upgrades Emergency maintenance critical unforeseen maintenance needed for the security or performance of your configuration or Rackspace s network 11/3131

12 7. SERVICE LEVELS The Managed Virtualisation is available at three different service levels. Details of each service level can be found in the attached terms and conditions. Common to all Rackspace Hosting Solutions Performance Goals Account Team Process Monitoring Issue Response Core Infrastructure Elements to Service Offerings Managed Hosting In addition to Core Infrastructure elements Intensive Hosting In addition to Managed Hosting elements Fanatical Support Unlimited Access to Support Personnel 24/7 Managed Multi-Homed, Tier 1 Network 100% Network Uptime Guarantee (SLA) 1 Hour Hardware Replacement (SLA) World class data centre facilities with redundant power and HVAC Mean time to resolve network, HVAC, power and hardware issues Technical Service Delivery Manager Technical Account Coordinator Network Security Engineer Support Specialist Rackspace hardware provisioning, installation and maintenance Customer logical configuration and management Rackspace 101 introduction to Core Infrastructure Coordinator for scaling Customer is responsible for administering and responding to system alerts (ping, port, URL, etc.) Notification preferences and standard response specifications Mean time to resolve hardware, software, network or DC issues Dedicated Service Delivery Manager and Business Development Consultant 24x7 team focused on your platform and complexity type Rackspace 101 introduction walk through for smooth start into Managed Hosting Comprehensive standard monitoring (ping, ports, services, URL and server disk capacity) with reactive response Notification preferences and standard response specifications Platform infrastructure uptime SLA (where applicable) Dedicated Support Engineer performs ongoing needs analysis and consulting 24x7 supporting team of experts on supported OS, database and applications Priority vendor escalation Extensive implementation and migration planning and assistance Monthly account consultation Change Management Coordinator for scaling Custom Monitoring of all hardware and software elements Advanced performance monitoring to proactively identify issues Detailed run book established during implementation consultation 12/3131

13 Managed Security Rackspace manages physical DC security, customer manages application security Elements to Service Offerings Automated OS patching Server Compromise checks on demand Managed anti-virus Customised patching and roll-back capabilities Managed anti-virus Managed firewall (required) Intensive Service Level is our highest level of support. Intensive provides a dedicated Service Delivery Manager and Lead Engineer to proactively manage your environment. The services consist of "proactive" support where Rackspace is responsible for deep multi-layer monitoring, patching, management and planning for the environment. In this model, Rackspace is truly an extension of your IT staff. Highly customised and/or critical implementations generally fall under this level of support. Managed Service Level consists of infrastructure 24x7 monitoring, patching, maintenance and "on-demand" support for the operating system level. The Customer is comfortable with managing the day to day operations for the OS and above, but Rackspace staff are available to assist and manage with a wide array of services when the customer requires additional assistance Core Infrastructure Level this service level offers support of the data centre, network and hardware layers. The Customer is responsible for managing from the operating system up. This is well suited for organisations that have IT resources but do not want to own or manage the data centre, hardware and staff that manage them Platform Availability Guarantee (PAG) Rackspace recognises that hosting availability is critical for each organisations mission-critical hosting environment and we have therefore designed a Service Level Agreement (SLA) to provide unsurpassed levels of availability and meaningful refunds for failure to comply with them. This includes: 100% network uptime guarantee 100% infrastructure availability guarantee 1 hour hardware fix Where the risks posed by downtime are particularly sensitive, the Platform Availability Guarantee (PAG) provides an additional level of comfort that the organisations Hosted Systems are protected. The PAG is an extension of the Intensive Terms and is only available to customers under the provision of the Intensive service level. It guarantees the stability and dependability of the hosted platform up to a maximum of % availability, when running a geographically redundant solution. PAG is only available to customers who meet specific infrastructure design requirements. Details of the different tiers of Platform Availability that we offer are shown in the Platform Availability Guarantee terms and conditions. 13/3131

14 Acceptable Use Policy Rackspace expects all customers to observe relevant lawful practices. The Acceptable Use Policy (AUP) is a description of types of activities that are not allowed on the Rackspace network. The Internet is still evolving, and the ways in which the Internet may be abused are also still evolving. Therefore, we may from time to time amend this AUP to further detail or describe reasonable restrictions on your use of our services. Please review the AUP at 14/3131

15 8. FINANCIAL RECOMPENSE The Intensive Service Level offers an industry-leading SLA, which includes guarantees on the major elements of your hosted solution, such as response times, network uptime, hardware replacement, managed backup and storage uptime and performance. For full details of Rackspace s financial recompense, please refer to: RAX Managed Virtualisation Intensive Terms and Conditions For full details of Rackspace s financial recompense for our Managed Virtualisation Managed service, please refer to: RAX Managed Virtualisation Managed Terms and Conditions For full details of Rackspace s financial recompense for our Managed Virtualisation Core Infrastructure service, please refer to: 9. TRAINING RAX Managed Virtualisation Core Infrastructure Terms and Conditions Rackspace provides all new customers a 101 introduction to the service, which includes an overview of the service level, including the support team functions, the monthly account review (Intensive service level), service delivery team engagement, change and escalation processes and the MyRackspace portal walk-through. The MyRackspace portal is a self-management customer tool, which includes a knowledge base feature, and allows the Customer to search through a wealth of documents, covering a variety of hosting-related topics, to answer your questions or help you solve technical issues. For the Intensive Service, your Rackspace Service Delivery Team will deliver informal training for your technicians on particular topics they would like more information on. 15/3131

16 10. ORDERING AND INVOICING Our pricing model is very simple and very transparent. We price up a bespoke solution for each customer to include all the components that makeup the solution, as well as support options and value add services. We will provide the Customer with a breakdown by line item of each of the components making up the solution with their respective costs associated. Billing is as follows: Monthly Recurring Charge This is a monthly recurring charge and is billed on a monthly basis for the lifetime of the contract (typically between 6 and 60 months). One Time Charge This is a one-time installation charge for setting up the platform and is applied for any new components added to the solution All charges relate to a specific environment and may be added to at any time. If additional components / capacity / functionality are added, the new charges will be reflected as in increase in the monthly recurring charge and one time installation charge. We may also allow some flexibility to reduce the size of the solution and the monthly recessing charge if needed. Billing increments occur as follows: Managed Hosting (physical hardware and networking) monthly in advance Virtual Machines based on daily utility and billed monthly in arrears Our standard payment terms are payment on receipt. 11. TERMINATION TERMS The Customer may terminate this Agreement for convenience at any time, by giving us 90 days advance written notice. In this case, in addition to other amounts are owed, the Customer must pay an early termination fee equal to the total monthly recurring fees for the remaining portion of the then-current term. However, the Customer will not be charged an early termination fee if this Agreement is terminated as part of an agreement to establish a replacement for the hosted system in a different Rackspace service segment, even if the overall fees for the replacement system are less than those for the current hosted system, provided that the replacement system is the functional equivalent of the current hosted system. Please refer to attached Terms and Conditions for our Managed Virtualisation service. 16/3131

17 12. DATA RESTORATION / SERVICE MIGRATION Data Restoration Backup restores are a top priority for the Managed Backup team. With the Intensive service level, Rackspace will initiate restoration of your data stored on-site within two hours of the time that you request the restore via a support ticket. You are allowed two free local restoration events per calendar month. Additional restores will be billed at Rackspace s standard hourly rate of one 100 per hour or part thereof. The time it takes to restore all the data from the backup can vary based on the backup schedule chosen, the amount of data that needs to be restored and other factors. Managed Backup policy is to never to overwrite files or folders. Should you require a restore of a file or folder, we will always restore to a separate file or folder and will not overwrite the current copy unless expressly required, by you, to do so. In case of offsite backup requirements, and where the disks are stored offsite, Rackspace has a two hour SLA with Iron Mountain to return the tapes to the data centre. In the Intensive service segment, Rackspace will initiate restoration of your data stored offsite within six hours of the time that you request the restore via a support ticket. You are allowed one free local restoration event per calendar month. Additional restores will be billed at Rackspace s standard hourly rate of one 100 per hour or part thereof Migration Rackspace offers fee-based migration services delivered by approved subcontracted Rackspace Partners. All services are provided on a time and materials basis and are subject to scoping by a Professional Services Consultant. When scoping your current environment, Professional Services will perform discovery of the infrastructure to be migrated, and conduct a migration feasibility assessment which is a chargeable service. The scoping effort has a defined deliverable a Migration Statement of Work with associated cost for the approved Rackspace Partner to perform the migration. As all data and application migrations are different we have provided as a guide the following methodology and phase approach taken for a typical server migration: Phase 1 (Discovery and Planning) Identify applications and tools on all servers Identify configurations on all servers Document general operation and purpose of all systems and services Identify what is to be migrated Write a detailed migration and cutover plan Phase 2 (Migration) Have all servers setup and configured at the new site Install all applications and tools Setup all VIPs, firewall rules and perform other networking tasks Import all the code, databases and user data on to the new servers 17/3131

18 Perform functionality testing, load testing and general QA of the applications in the new environment Execute the cutover plan Phase 3 (Testing and Optimisation) Perform functionality testing, load testing and general QA Perform and security audit Perform optimisations of servers and applications Create Documentation 13. CUSTOMER RESPONSIBILITIES For a demarcation of responsibilities between the Customer and Rackspace, please refer to supporting document RAX Customer Responsibility Matrix. Customers must also adhere to the Rackspace Acceptable Use Policy. This Acceptable Use policy is a description of types of activities that are not allowed on the Rackspace network. We may from time to time amend this AUP to further detail or describe reasonable restrictions on your use of our Services. Please refer to 18/3131

19 14. TECHNICAL REQUIREMENTS Technologies behind Managed Virtualisation Rackspace Managed Virtualisation makes cost-efficient scaling a practical reality. With managed virtualised servers, you get the most out of your servers and you only pay for the resources that you are using at any given time. So if your organisation experiences high growth or fluctuations in capacity, this is the smart solution for you. As with all Rackspace solutions, it is wrapped with Fanatical Support so you benefit from the best expertise, infrastructure and support available 24/7/365. Scale the smart way with Managed Virtualisation: Rapid VM provisioning makes scaling easier and on-demand computing capacity possible, so you can meet your performance and capacity needs (with pre-defined virtual machines) The security of dedicated virtual servers provides greater peace of mind if you are concerned about the compromises, unanticipated traffic spikes and security breaches that have plagued some shared virtualisation providers Automatic recovery keeps you up and running, delivering redundancy by recovering data from a second host machine (multiple servers and SAN required) Snapshots provide increased data protection during your OS and application upgrades, providing a real time copy of your VM with a click of a button Save the smart way with Managed Virtualisation: Maximise your hardware investment by better utilising your servers through virtual machines Only pay for what you use with utility billing which only charges you for your virtual machines when they are turned on. This is charged on a daily basis. Quickly get to a stable and secure virtualised environment without investing your own time and resources. Host the smart way with Managed Virtualisation: The Rackspace Managed Virtualisation support team includes VMware specialists to manage your physical server, virtualisation layer and virtual machines, so you can make the most out of your solution Fanatical Support working to support you and your environment 24x7x365 Maximum uptime with Zero-Downtime Network Guarantee, 1 hour hardware replacement guarantee and our world-class infrastructure. 19/3131

20 14.2. Operating Systems Rackspace supports the following operating systems as standard: Databases Microsoft Windows Server 32- and 64-bit versions available; Microsoft Cluster Service supported for high availability Red Hat Enterprise Linux 32- and 64-bit versions available; Red Hat Cluster Suite supported for high availability. VMware ESX Server for customers that have purchased a solution where all the prerequisites for vmotion are met, DRS, VMware HA and vmotion are enabled and supported by default, Rackspace will provide the Customer full administrative access to all physical and virtual instances of Windows Server and Red Hat Enterprise Linux. Access to the VMware hypervisor is limited to Rackspace personnel only, however, the Rackspace customer portal allows for basic control over virtual machines (such as taking snapshots). Microsoft SQL Server SQL Server 2008 & SQL Server 2012 (Standard /Enterprise Editions); replication configuration, clustering & database mirroring MySQL Version typically varies depending upon the Red Hat OS version deployed; specific versions can be deployed on request; master / slave replication and clustering via Red Hat Cluster Suite Oracle Oracle 10g and 11g (Standard and Enterprise Editions); support for replication and clustering (via Oracle RAC) as allowed by version deployed Standard database support capabilities include monthly licensing (Microsoft and Oracle solutions), software installation, availability monitoring and backup / restore. Rackspace also offers Database Administration services at an additional fee Supported Hardware Underlying hypervisor servers are deployed on performance-driven Dell servers. Infrastructure can be customised to suit diverse business needs, and effectively secured with the myriad supporting services that Rackspace offers including: Flexibility Redundancy Hardware Replacement Scalability Performance Memory, CPU and disk storage is customisable on a per-server basis to offer the desired flexibility, while choice of operating systems, server chassis and CPU are priced according to performance specifications. Each system features multiple redundant power supplies connected to diverse power distribution units in the data centre, ensuring isolated power failures do not affect uptime Rackspace data centres are equipped with substantial stock inventory to help ensure that the one hour hardware replacement guarantee is always met in the event of a hardware failure CPU, memory and disks can be upgraded to provide additional compute resources as required, within the hardware limitations Utilises enterprise-grade components such as Intel Quad, Hex and Octo Core processors 20/3131

21 Four server chassis options are available, each offered in bronze, silver and gold configurations based on storage capacity: Performance Performance Enhanced 2 Enhanced 1 High-performing dedicated server offering four eight-core CPUs as standard Choice of memory allocations up to 1.5TB to suit your 2 needs Best suited for highly transactional databases or large, virtualised environments Two-socket server offering single or dual CPU configurations 1 Ideal for customers hosting complex applications, smaller databases or virtualised environments Two-socket server represents a cost effective mid-range server ideal for most needs Available with a minimum specification and standard configurations only Offered with a minimum specification and with standard configurations only Entry-level, dedicated two-socket server, ideal for costconscious customers requiring a basic compute solution Storage Options Rackspace offers a wide range of storage options. For our Managed Virtualisation offering, we generally recommend virtual machine local definition files (VMDK) are stored on either: shared SAN on silver tier storage (further details below) or local hypervisor server storage Rackspace will provide the architecture, design, and planning processes for the development and installation of the storage and backup Infrastructure in accordance with the Customer s requirements and the Technical Design approved by both parties. Other storage options include: Direct Attached Storage Dedicated Network Attached Storage Dedicated Storage Area Network Further details of these options are available on request. 21/3131

22 Shared SAN Storage Rackspace provides different tiers of storage dependant on performance requirements. Storage within the arrays is tiered based on performance in to the following three categories: Tier Average I/O Per Initial allocation Upgrade Increment Second per GB Gold GB 25GB Silver GB 25GB Bronze GB 25GB Gold Tier This performance focused storage solution has the highest performance of the three available tiers by using smaller, Fibre Channel attached disks (FC SAN). Gold tier storage is a great fit for mission critical databases, where high input/output levels are absolutely necessary, and storage amounts are relatively small. Silver Tier This flexible storage solution still uses Fibre Channel attached disks (FC SAN), however it uses larger disks to strike a balance between storage space and performance. Silver tier storage can be a great fit for larger databases or virtual machine stores, where higher levels of performance are still needed. Bronze Tier Using Serial ATA attached disks (SATA SAN), this solution allows you to maximise your storage space. Since SATA attached disks offer larger drive sizes, SATA SAN is recommended for applications that require very large amounts of space with moderate to low performance requirements, such as the storage of image files or document archives. Shared SAN Security For every single host Rackspace creates a new zone configuration. This zoning includes the unique World Wide Name (WWN) for the Host Bus Adapter (HBA) which is physically installed in each server and the WWN of the particular storage array that contains their disk assignment. This association prevents servers from even "seeing" any storage array to which they are not explicitly provided access. This is similar to ACLs used in networking. This level of access enforcement is managed by our SAN fabric. If the WWNs are not defined within a zone, access is denied. 22/3131

23 Firewall Beyond the SAN fabric, we impose additional security from the storage array. Once a host has been granted access to the storage array from the SAN fabric, additional authorisation is required and enforced by the storage array which contains their disk assignment. Each disk assignment, or LUN, is assigned to a specific host WWN. If the host WWN is not specifically assigned to their LUN, it will be denied access. Firewalls are a vital part in the protection of a system. They provide robust, integrated network security, creating a strong multi layered defensive service for dynamic network environments. Firewalls are implemented, configured and managed by experienced network security specialists and backed by our 1 hour hardware swap out guarantee. Security Firewall Rackspace partner with industry leading manufactures to ensure the reliability of your solution. The Cisco ASA 5510 and above are available in a redundant (high availability) configuration. Secure Access for Administration of servers Rackspace would recommend deploying a site to site IPSEC VPN tunnel for the secure administration of your server environment. This will encrypt the traffic to Triple Data Encryption Standard (3DES). In addition the range of IP addresses can be restricted on the Cisco ASA firewall to only allow specific client computers to connect via the VPN port. Web Application Firewall (WAF) A WAF is a Layer-7 firewall capable of protecting customer web applications from malicious activity and preventing vulnerabilities and exploits being used to steal or deface sites. Rackspace uses the Imperva WAF to help customers protect applications from current and future security threats by combining multiple security engines into a cohesive Web defence. Certified by ICSA Labs, SecureSphere provides ironclad protection against the OWASP Top Ten, including SQL Injection, XSS and CSRF, and it addresses PCI /3131

24 Load Balancers F5 BIG-IP 1600 & 3600 LTM Load Balancers The BIG IP F5 Local Traffic Manager (LTM) is a high performance traffic management solution that intelligently manages high volume traffic to improve application performance and avoid downtime. Details on the models available are shown below. Description Big-IP 1600 Big-IP 3600 Throughput 500 Mbps In-bound 500 Mbps Out-bound 1 Gbps In-bound 1 Gbps Out-bound Connections/sec. 100, ,000 SSL Compression 500 One-Off: 5,000 Max. (w/license Upgrade) 50 Mbps One-Off: 1 Gbps Max. (w/license Upgrade) 500 One-Off: 10,000 Max. (w/license Upgrade) 50 Mbps One-Off: 1 Gbps Max. (w/license Upgrade) 1 Additional Module (One-Off) N/A Brocade ADX 1000 Series Load Balancers WebAccelerator, ASM, GTM, MSM The Brocade ADX 1000 is a high performance, industry leading layer 4-7 application delivery controller that provides increased throughput and in-platform capacity on demand for companies needing a dedicated solution. Advanced performance and flexibility on demand: The Brocade ADX 1000 Series is the next generation of high performance load balancers designed to scale your site s features and performance with ease. Rackspace and Brocade have partnered to deliver a solution that allows you to grow within your current hardware platform, rather than needing to migrate to another platform to meet your performance needs. Solution highlights include: Advanced Architecture With an industry-leading layer 4-7 application delivery controller, you will get up to twice the throughput, due to separation of application, data, and management resources. Capacity On-demand Scale your site s performance and features without switching hardware platforms. Global Load Balancing Achieve multi-site presence for location-based performance and redundancy needs. IPv6 support Get support for both IPv4 and IPv6 network traffic. 24/3131

25 14.3. Performance Attributes Monitoring Intensive support provides customers with deep monitoring of critical services and applications, and responds quickly to alerts generated from our various monitoring tools. Monitoring is a critical component of the Rackspace solution. We understand that ensuring site uptime is a key requirement for your business. Knowing this, Rackspace will monitor your entire solution stack, including services and applications. We utilise the following systems to monitor every critical aspect of application availability and performance to provide thorough end-to-end application monitoring: Rackwatch RackWatch provides for TCP port monitoring with simple response content checks (protocol banner) as an option. Polling frequencies and timeouts are configurable parameters. ICMP ping tests are standard on the primary IP of all devices, however, additional ping monitors may be configured in this system. Intensive customers are able to select six protocols from the below list per server in addition to Ping and Webport for monitoring through RackWatch: HTTP HTTPS DNS Telnet MySQL PostgreSQL SMTP POP3 FTP SSH Cold Fusion MS SQL If any of these ports should fail, a support ticket will be created and your Fanatical Support team will begin work on fixing the problem NimBUS / SCOM (Agent-Based Monitors for Servers) Rackspace offers agent based monitoring solutions for servers from NimSoft (NIMBUS) for Linux devices and Microsoft System Centre Operations Manager (SCOM) for Windows devices. Intensive customers can rest assured knowing that their servers are in safe hands and are monitored around the clock by our team of experts. The agents gather server performance data that may be viewed for each device in near real-time via the MyRackspace portal. These platform-specific tools capture a wide variety of system and applications events, and monitor key performance metrics such as CPU, disk and memory utilisation. As performance thresholds are crossed (e.g. abnormally high CPU utilisation is detected on a server), Rackspace technical teams will be alerted and investigate. This information is also used to generate server performance reports, thereby allowing Rackspace to identify trends and alleviate bottlenecks before they impact application performance. 25/3131

26 SiteScope SiteScope is an agentless monitoring solution that delivers real-time information on the availability of web-enabled applications. SiteScope is used for URL monitoring and custom port monitoring. Polling frequencies and timeouts are configurable parameters. URL monitoring is a useful mechanism for end to end testing in the following ways: URL monitoring may take the form of simple HTTP GET or POST (with POST data) or more complex synthetic transaction tests Simple URL monitoring monitors HTTP response code (200 by default) match and payload content string matches URL Synthetic Transaction Monitoring verifies that your visitors can complete a series of steps successfully without any site errors Network Device Monitoring All Rackspace customer firewalls are monitored through the use of SNMP. For certain events, an alert is created which will automatically generate a ticket in the relevant Network Security queue. Each of the events monitored are outlined below, along with response instructions for Network Security personnel. All our firewalls are polled every 5 minutes, with the exception of ICMP Ping, which is polled at 1 minute intervals. The PING, SNMP Down, and Failover Event alerts will create new tickets for each occurrence. CPU Usage, Memory Usage, Network Interface Usage, and Network Interface Errors will create a new ticket unless a ticket for one of these same alerts already exists, in which case it will simply append an additional alert to the same ticket Trending and Reporting Under Intensive support, Rackspace provides a sophisticated set of reporting tools that track, analyse and explain every important detail of the performance of a customer s web platform and applications, from bandwidth, servers CPU and memory performance reporting to security events and web traffic reporting. 26/3131

27 The information is then customised into an easy-to-access and understandable report. Reports generated on all aspects of your environment are relayed in your monthly account review. Any alerts or excesses are communicated to you with the aim of averting problems before they arise. Escalation lists can be created to automatically alert chosen individuals (including 3 rd parties if required) should thresholds be exceeded on elements of your system. More formally, Rackspace will provide a monthly report (Monthly Account Review), which incorporates the information below: All incidents raised during the reporting period (including incident number, detail and status) Breakdown on type of incidents during reporting period Processor utilisation chart Free space chart Alerts during reporting period Bandwidth usage reports (monthly and trend analysis) Component availability Database file growth Network availability Application availability 27/3131

28 15. ADDITIONAL FEATURES INTRUSION DETECTION SYSTEM (ALERT LOGIC THREAT MANAGER) An Intrusion Detection System (IDS) inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system. The variety of attacks on a system are endless, the IDS works in conjunction with other Rackspace Security components, to efficiently protect our customers data and information infrastructure against threats. The Intrusion Detection System used within the solution will be provided by Alert Logic. The device will scan traffic between network segments for vulnerabilities and malicious activity. The device is managed by Alert Logic, which receives the threat alerts into their 24x7 manned control centre and process and escalate as appropriate to Rackspace. In addition to alert management, they are also in a position to perform on demand external and internal vulnerability scans on your network for no additional charge. Alert Logic IDS Key Features and Benefits: The Alert Logic IDS rapidly and accurately identifies network threats to minimise their dissemination and damage on customer and partner networks. Leverages thousands of threat signatures Detects network threats in real time Correlates threats with host vulnerabilities Incident creating, routing and notifications Correlation of disparate event sources to detect complex attack patterns Event archiving for post-mortem forensic purposes Leverages thousands of vulnerability checks On-demand and scheduled vulnerability scanning Network topology scans and host discovery Continuous monitoring and management by security experts 28/3131

29 15.2. DDoS Prevention Rackspace offers an optional Distributed Denial of Service protection called Rackspace DDoS Mitigation. This is a hardware-based DDoS mitigation that helps to ensure customer uptime in the event of a DDoS attack. Rackspace DDoS Mitigation learns normal traffic thresholds by monitoring a server s normal peace time bandwidth usage. This service will report a denial of service condition to the Rackspace NOC or send the server s traffic directly to mitigation when an anomaly is discovered. While in protect mode, Rackspace DDoS Mitigation passes legitimate traffic to its intended destination with less than 1 ms of added latency. Many DDoS attacks include payload that is difficult to distinguish from legitimate service requests. For this reason, it is important to understand that Rackspace DDoS Mitigation cannot completely eliminate DDoS attacks altogether. If denials of service attacks are anticipated, the hosted solution should be built to withstand malicious traffic not completely filtered by the service. As a general rule, Rackspace recommends at least two load balanced web /application servers if possible Critical Application Services Rackspace Critical Application Services service level has been created for businesses that rely on their online presence for customer acquisition / retention, revenue generation, customer service, and building brand equity (e.g. ecommerce, SaaS, media, advertising). This optional service level is available as an overlay service to our Intensive service levels. Please refer to supporting documentsion for an overview of Rackspace Critical Application Services DBA Services Beyond traditional basic troubleshooting, installation, and administration services already offered to Managed and Intensive Service levels, customers purchasing Rackspace DBA Services will receive the following services (summary): Architecture and Design: including architecture and design, replication and performance recommendations. Advanced Administration and Monitoring: including replication monitoring, advanced restores, point-in-time recovery, and customised maintenance plans. Advanced Troubleshooting: including performance and availability issues in production. Includes advanced administration support for Oracle, SQL and Microsoft SQL databases. 29/3131