Westcon Security Support Policy for F5 Networks. Rev. 2.0

Westcon Security Support Policy for F5 Networks Rev. 2.0

1.1 INTRODUCTION This Security Support Policy ( SSP ) between Westcon Group European Operations Ltd on behalf of itself and its affiliate, Westcon European Holdings, Ltd with an office at Chandlers House, Wilkinsons Road, Love Lane Industrial Estate, Cirencester, Gloucestershire GL7 1YT ( WESTCON ) and Customer is intended to identify the features and define the processes involved when WESTCON provides and Customer purchases technical after-sales support for F5 Networks Products. 1.2 MISSION STATEMENT WESTCON Support Services is committed to building strategic relationships with its Customers by providing consistent, dependable, high quality, measurable services which assist Customer to effectively utilize products purchased through WESTCON. 1.3 TECHNICAL SERVICES GENERAL PROCESS WESTCON Support Services utilizes a multitier support model for processing reported issues. When initial contact to obtain After-Sales Support Services is made, a Support Center Team Member will validate all contract information and gather details relevant to the question or issue. A unique trouble ticket number will be assigned and delivered to the contact, either verbally or via electronic mail. This trouble ticket number will be used to track any given issue from initial contact to final resolution. If appropriate, an issue will be reproduced in our Test Lab. Additional testing and problem duplication may take place in a network laboratory environment. Further investigation, including additional troubleshooting or debugging activity may be required. Based on the results of the Test Lab investigation, an issue may be brought to resolution, or, if an anomaly is identified, escalated to the Technical Services division of WESTCON s vendors. When an anomaly is identified, WESTCON will monitor escalation within our vendor s organization, via their Escalation Management to Research & Development Engineering. The response times and resolution of the anomaly can vary depending on the escalation scheme of the particular vendor. 1.4 TECHNICAL SUPPORT DEFINED Subject to the specifications of this SSP, Customer will be entitled to access WESTCON Support Services via web, telephone and email request. WESTCON agrees to provide Support, where appropriate, to Customer, which can include but is not limited to the following actions: receive technical questions; analyze the technical questions and provide answers to Customer; provide assistance in obtaining answers to questions that may arise concerning the operation and use of licensed product that cannot be resolved by WESTCON; and provide the escalation towards the corresponding vendor, if this escalation is required to provide a solution or workaround. Support does not include the following items or actions: Software subscription; Step-by-step installation of software or service packs; Professional Services or Educational Services; Modification of software code, security policy configuration, audits, or security design. Page 2 of 11

1.5 CONTRACT PERIOD Contract Start: The contract period is a minimum of 1 year, and will automatically renew for successive 1 year terms unless Customer notifies WESTCON at least ninety (90) days prior to contract expiration of its intent not to renew. WESTCON reserves the right to terminate any contract renewal if Customer fails to remit payment for the renewal term and to charge Customer time and material rates for any services provided after contract expiration. This SSP becomes effective on the start dates that are provided to WESTCON by F5 Networks whether the contract is purchased to obtain services only (i.e. separate from the associated software) or it is bought together with the applicable software, software renewal or appliance. Contract End: Depending on the term of the purchased contract, the contract ends after 1, 2 or 3 years after commencement of this SSP. 2. CONTACTING TECHNICAL SUPPORT WESTCON 2.1 CONTACTING TECHNICAL SUPPORT BY WEB PLEASE NOTE: DO NOT submit a Support Request for a Severity 1 issue using the web request form. For these cases, please call the number that is specified in the How to Contact pdf file. To submit a support request by web, Customer must log into the SupportWeb (The URL is specified in the How to Contact pdf file) and select Register a new case, located under the Case Requests Tab. Complete the request form with all of the appropriate information about your issue and submit the request. This will create a Trouble Ticket number in the WESTCON call tracking system. Once you have logged your support requests online, you can follow the complete history of the escalated support requests online, which will clearly show all the steps taken to remediate the issue. To obtain an On-line Password, go to the url that is specified in the How to Contact pdf file and provide the requested details. WESTCON will email your online username and password to each entitled individual. 2.2 CONTACTING TECHNICAL SUPPORT BY PHONE Dial: The number that is specified in the How to Contact pdf file Your call will be routed to a WESTCON dispatcher. The dispatcher will create a Trouble Ticket number in the WESTCON call tracking database. You will be asked to provide or verify some or all of the following information: Contact name, title, company name, email address, phone number, pager number, fax number, onsite phone number and onsite email address. 2.3 CONTACTING TECHNICAL SUPPORT BY EMAIL WESTCON does not recommend opening a Support Request via email. The email address is specified in the How to Contact pdf file Correspondence on an existing Support Request may be made via email, as long as the Customer promptly provides a written reply to emails received from WESTCON Support Services. All correspondence for a trouble ticket will be routed to the WESTCON call tracking database. All electronic mail transactions to and from WESTCON After Sales Support must include the assigned Trouble Ticket Number, respecting the usage of the right syntax for a Support Request, with [WS-XX- xxxxx ] in the subject line of every email, where xxxxx is a digit and XX is the appropriate country code (for example BE) Page 3 of 11

2.4 GENERAL INFORMATION REQUIRED FOR CASE SUBMISSIONS You must provide the following information: 1. Complete contact information, (name, title, company name, email address, phone number, pager number, fax number, onsite phone number and onsite email address) for all parties involved in the issue. If the issue is related in any way to licensing, your request will be forwarded to our Sales department. Please provide license details and purchase order numbers for the applicable product. These inquiries are not considered as a technical support issue. 2. Describe the hardware platform(s) details involved in this issue, for example the amount of memory, disk space, and NIC card types (manufacturer and model). 3. Describe the operating system(s) involved in this issue, including the version number and patch level information. (Include which service pack and hot fixes, which patches, etc.). 4. Provide a detailed description of the problem or issue, including any symptoms noted, any patterns seen (time of day or only certain users affected, etc ) and any specific error messages received. 5. The Support Engineer will then attempt to help resolve the issue. If the issue cannot be resolved, the issue will be transferred to the WESTCON Test Lab. 2.5 TECHNICAL INFORMATION REQUIRED FOR CASE FOLLOWUP You may be asked to submit some additional information or to perform certain actions which may include the following or other items not described below: 1 Execute debug or trace commands. 2 Provide a detailed description of the network topology including, but not limited to physical network parameters, media and protocols. 3 Provide location map (topology diagram) of all segment routers and transitional gateways. 4 Provide IP addresses of all equipment within the flow. 5 Provide general information about the network, including: approximate number of users, approximate number of simultaneous sessions per user, types of applications in use, etc. 6 When providing a topology diagram, an electronic topology diagram is preferred Visio or PowerPoint are suitable applications to use for this purpose. If this is not feasible, a fax or hand drawn diagrams is an acceptable alternative, provided the IP addresses or Host ID information is legible. 7 Provide a historical description of the problem or issue, detailing chronology and troubleshooting efforts already completed. 8 Provide any miscellaneous, related information. This would include debugging output, packet traces, core dump files, Event logs, etc. After it is verified that your Support request is valid, the WESTCON dispatcher will create a trouble ticket number in the WESTCON call tracking database. If it is not possible to provide this information, WESTCON may be hindered in its ability to bring resolution to an issue in a timely fashion. In all cases when an issue is reported, WESTCON will provide a respective trouble ticket tracking. In the event that WESTCON assesses the call is not related to the product covered by this contract, WESTCON will immediately inform the Customer that the contract does not include repair or assistance for the reported issue and, if Customer requests, will provide assistance on a time and materials basis. Page 4 of 11

2.6 AVAILIBILITY OF AFTERSALES SUPPORT After-Sales Technical Support via telephone, email and web is available (subject to conditions beyond our control) on all days of the year, 24 hours a day in accordance with the information set forth in the Severity Level Response Time Commitments described in the table on page 6. Only Support Requests with P1 Severity are handled with priority between 5:30 pm and 9:00 am central European time. These P1 Severity reports are also handled during weekends and public holidays. During business hours all support requests are handled between 9.00am and 5.30 pm central European Time. 2.7 SOFTWARE VERSIONS COVERED To be eligible for a Contract, the Customer must have the most current or previous to current Software and/or firmware. The product must be maintained in an appropriate operating environment and may not be modified without prior written approval of WESTCON or its vendor. For each site, Customer must purchase the same level of Service for all components from the vendor. If Customer has purchased a Contract, Customer is entitled to access and receive all major and minor releases of F5 Networks Systems software updates and release notes for purchased software that is covered by the Contract. All Software provided pursuant to a Service Option will be governed under the same terms and conditions as set forth in the license agreement accompanying the original software licensed by Customer. Customer has the right to duplicate documentation for its own internal use, provided that all copyright, trademark, and other proprietary rights notices are also reproduced in the same form and manner as on the original media provided. Customers should be running an active operating system to ensure WESTCON and F5 Networks Technical Support are able to provide software support. The last two Generally Available dot releases for an operating system are considered active versions unless declared as End of Availability on the F5 Networks Systems download site. When the third dot release of a minor release is generally available, the previous minor release will be declared inactive. In the event Customer s Service Agreement has lapsed, WESTCON or its vendor will determine, in its sole discretion, whether to maintain the Product subject to performance of an on-site review and Product certification performed by WESTCON or its vendor (at Customer s expense) to determine whether the Product is operating in accordance with manufacturer s standards for service and maintenance. Customer agrees to pay WESTCON s thencurrent time and material rates for such certification efforts. If WESTCON is requested to maintain modifications performed by a third party that is not its vendor, Customer hereby acknowledges that modifications, including software upgrades, performed or supplied by unauthorized parties may result in a denial of: (i) warranty services from the manufacturer of the Product; (ii) Maintenance from WESTCON; or (iii) void the Software license. 2.8. SEVERITY LEVEL RESPONSE TIMES COMMITMENT Some work items (especially those associated with critical situations) may need to be handled or expedited faster than usual. When this is the case, Customer must notify WESTCON that the issue has caused a critical situation. Depending on the impact, an initial Severity Level is assigned to the Support Request; and may be determined by the Customer if the Customer has a legitimate reason to consider the particular report as a critical outage. If the Customer s preference for the Severity level is unknown, WESTCON will determine the adequate Severity Level in accordance with the information provided by the Customer and its general business practices. If WESTCON determines that sufficient information has been provided by Customer to classify the report and categorize the Severity level and the support request is accepted, work on resolving the incident begins in accordance with WESTCON s standard business practices. Page 5 of 11

WESTCON agrees to use commercially reasonable efforts to respond to Customer calls based on the severity of the issue as follows: Severity Level P1 Major P2 Moderate P3 Minor P4 Feature Req. Definition An error that renders product inoperative or causes the product to fail catastrophically; e.g. major system impact, system down An error that substantially degrades the performance of the Product or materially restricts customer s business; e.g. moderate system impact, system hanging An error that causes only a minor impact on customer use of the Product; e.g. minor system impact, performance/operational impact A reported anomaly in the licensed product which does not substantially restrict the use of one or more features of the licensed product to perform necessary business functions. Support Commitment Response Time 1 Hour WESTCON Security and customer will commit full-time resources to resolve the situation or obtain a work around 2 Hours WESTCON Security and customer will commit full-time resources during normal business hours to resolve the situation or obtain a workaround 6 Hours WESTCON Security and customer will commit the necessary resources during normal business hours to restore 8 Hours WESTCON Security and customer will provide resources during normal business hours to provide information assistance as requested. Expected Resolution Time Same Day 2 working days 5 working days 10 working days 2.9 SERVICE REQUEST CLOSURE WESTCON agrees to use commercially reasonable efforts to work with the Customer for Problem Resolution for an issue in accordance with the specifications of this SSP. Timely efforts must be made by all parties involved. If communication from Customer ceases without notice, after 5 business days, WESTCON may notify customer that it has closed a Support Request due to inactivity on the part of the Customer. A Support Request may be reopened within 30 consecutive days of closure. Once a Support Request is closed for 30 consecutive days, the issue will be considered permanently closed and it cannot be reopened. If further work is necessary, a new Support Request will be opened and all pertinent materials may need to be resubmitted before work can continue. Page 6 of 11

3 HARDWARE SUPPORT SERVICES WESTCON Security Hardware Services are provided in the following modes below. In addition to obtaining the approval of a WESTCON Security Support Engineer, all hardware replacement requests are subject to the approval of the vendor. 3.1 FIVE-DAY HARDWARE REPLACEMENT OPTION 3.2 NEXT-BUSINESS DAY HARDWARE REPLACEMENT OPTION 3.3 FOUR-HOUR HARDWARE REPLACEMENT OPTION 3.4 HARDWARE RETURN PROCESS Full details of these hardware services can be found on the F5 Networks Website. Neither WESTCON or F5 Networks shall be responsible for any software, firmware, information or memory data contained in, stored on, or integrated with any Hardware or Software returned to F5 Networks under this Agreement. These hardware services can be extended with the following hardware field services : 3.5 NEXT-BUSINESS DAY FIELD ENGINEER ONSITE OPTION The next-business day field technician onsite option is available with the next-day hardware replacement option for purchase at the time of placing the service contract order (not on demand). A technician will be dispatched to the site in coordination with the hardware delivery. 3.6 FOUR-HOUR FIELD ENGINEER ONSITE OPTION The four-hour field technician onsite option is available with the four-hour hardware replacement option for purchase at the time of placing the service contract order (not on demand). A technician will be dispatched to the site in coordination with the hardware delivery. 3.7 HARDWARE SOFTWARE AND SERVICES WARRANTY, DISCLAIMERS F5 Networks warrants that it will perform F5 Networks Services in a professional and workmanlike manner consistent with the standard industry practices. Customer s sole remedy, and F5 Networks s entire liability, for breach of the foregoing will be the re-performance of the F5 Networks Services. ANY LIABILITY OF F5 NETWORKS WITH RESPECT TO THE F5 NETWORKS SERVICES, HARDWARE OR SOFTWARE OR THE PERFORMANCE THEREOF UNDER ANY WARRANTY, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY WILL BE LIMITED EXCLUSIVELY TO REPAIR, REPLACEMENT OR REPERFORMANCE AS APPLICABLE. IF REPAIR, REPLACEMENT OR REPERFORMANCE IS INADEQUATE AS A REMEDY OR, IN THE SOLE OPINION OF F5 NETWORKS, IMPRACTICAL, F5 NETWORKS MAY REFUND THE FEES PAID THEREFORE. EXCEPT FOR THE FOREGOING, THE F5 NETWORKS SERVICES, HARDWARE AND SOFTWARE ARE PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. F5 NETWORKS SPECIFICALLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, WITH RESPECT TO THE F5 NETWORKS SERVICES, HARDWARE, SOFTWARE AND THE SUBJECT MATTER OF THIS AGREEMENT INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, NONINFRINGEMENT, TITLE, AND FITNESS FOR A PARTICULAR PURPOSE. FURTHER, F5 NETWORKS DOES NOT WARRANT RESULTS OF USE OR THAT THE HARDWARE OR SOFTWARE IS BUG FREE OR THAT THEIR USE WILL BE UNINTERRUPTED. Page 7 of 11

4. ADDITIONAL ONSITE SUPPORT SERVICES Instead of the onsite field engineer onsite options mentionned under 3.6 and 3.7, WESTCON provides also onsite technical support service for all reported support requests with Severity levels P1 or P2 only. These support options covers on top of hardware replacement services, also the onsite dispatching of a L2 support engineer for software support requests. 4.1 NEXT-BUSINESS DAY ONSITE SUPPORT OPTION The onsite support engineer will arrive the next business day (NBD) during normal business hours during regular business hours (9x5) and when deemed necessary by Technical Support before 13:00 local time. Customer is responsible for providing full and correct case details during case submission. The onsite support option is only valid for support requests with Severity Levels P1 or P2. Delivery of the support engineer will take place the following business day, if approved prior to the 13:00 local time. The next-business day onsite support option is available with the next-day hardware replacement option for purchase at the time of placing the service contract order (not on demand). 4.2 FOUR-HOUR ONSITE SUPPORT OPTION The onsite support engineer will arrive within 4 hours of the request, 7 days a week, 24 hours a day, when support requests are deemed necessary by Technical Support. Customer is responsible for providing full and correct case details during case submission. The onsite support option is only valid for support requests with Severity Levels P1 or P2. 5. ESCALATION Some work items (especially those associated with critical situations) may need to be escalated. When this becomes the case, Customer will notify WESTCON of the critical situation and WESTCON will agree to work with Customer on providing the appropriate solution for each critical situation. If WESTCON determines that sufficient information has been provided by Customer and the escalation is accepted, work on resolving the escalation begins in accordance to WESTCON standard business practices: 1. Problems statement, including early evaluation of possible resolution. 2. Confirmation, when possible, that WESTCON can reproduce the problem. 3. Problem status. 4. Actions required. 5. Who needs to perform the actions (where "who" refers to WESTCON, customer, vendor, etc...?) It does not necessarily require the identification of a specific person). 6. Projected date for resolution (when possible). Page 8 of 11

5.1 INTERNAL WESTCON ESCALATION PROCESS In the event that response timeframes are not met, the case would automatically be escalated to the next level. In addition, there is an automatic management escalation path described below, and such escalation procedure keeps WESTCON personnel informed through its helpdesk system. In general, anybody involved in a case can request that a case be escalated at any time, independent of the below matrix. However WESTCON personnel may choose to remove a case from Escalation should that case not merit escalation in WESTCON personnel s opinion. Where escalation is the result of a customer request, then there should be a parallel escalation within the customer s organization this ensures that the proper resources are in place and are identified in each organization, thereby enabling the problem to be resolved more efficiently and expeditiously. Additionally a justification for requesting Escalation should be provided so that WESTCON can understand why Escalation is necessary, the context of the Escalation request & what resources may be needed. Regardless of the total elapsed time of an outstanding Support Request, the point of escalation is initiated at the first line support level, escalated to the Support Supervisor, followed by Services Manager. Should an issue require managerial attention, any Technical Support team member will, upon request from the Customer, connect Customer to a manager directly. The formal manager escalation path within WESTCON is:. Support Supervisor. Services Manager. General Manager Escalation Path: Elapsed Time Without P1 Major Action Severity 2 hours Support Supervisor P2 Moderate Severity P3 Minor Severity 4 hours Services Mgr Support Supervisor 12 hours General Mgr Services Mgr Support Supervisor 24 hours General Mgr Services Mgr 60 hours General Mgr Page 9 of 11

5.2 RESOLUTION ESCALATION PROCESS WESTCON does not specify SSP related resolution times and instead defines targets for escalation based on Severity Level. An expected resolution time is provided on request, within the specified time based on priority and the feedback from the respective vendor. 6.1 EXCLUSIONS WESTCON shall have no obligation to Support: 1. Altered damaged or modified product or any portion of the product incorporated with or into other Software or Hardware; 2. Product problems caused by customer negligence, or misuse or misapplication, use of product other than as specified in the user manual or outside the environmental range specified by the F5 Networks documentation for such product or by any other causes beyond the control of WESTCON Security; 3. any work to repair the Product other than as specified in the F5 Networks documentation or Program Guide for such Product; 4. Any modifications performed by Customer or a third party to the Hardware or the Software; 5. Any F5 Networks for Hardware or Software which is beyond F5 Networks s published end-of-life policy matrix, unless F5 Networks in its sole discretion elects otherwise. or 6. Product installation on any computer hardware that is not supported by F5 Networks. 6.2 SSP CHANGES This SSP and related details are operational in nature and may be modified at any time by WESTCON. WESTCON will take appropriate measures to inform Customer of modifications. This Service Level Agreement supersedes any previous service level agreements. 6.3 LIMITATION OF LIABILITY IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING SUCH DAMAGES ARISING FROM BREACH OF CONTRACT OR WARRANTY OR FROM TORT (INCLUDING NEGLIGENCE) OR STRICT LIABILITY), OR FOR INTERRUPTED COMMUNICATIONS, LOST DATA OR LOST PROFITS, ARISING FROM OR IN CONNECTION WITH THIS AGREEMENT. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF WESTCON SECURITY AND ITS SUPPLIERS AND LICENSORS WITH RESPECT TO ANY SUBJECT MATTER OF THIS AGREEMENT EXCEED, IN THE AGGREGATE, THE AMOUNTS ACTUALLY PAID TO WESTCON SECURITY UNDER THIS AGREEMENT DURING THE TERM (OR RENEWAL TERM, AS THE CASE MAY BE) THEN IN EFFECT. CUSTOMER AND WESTCON SECURITY AGREE THAT THE FOREGOING LIMITATIONS OF LIABILITY FAIRLY ALLOCATE THE RISKS IN THE AGREEMENT BETWEEN THE PARTIES, THAT THIS ALLOCATION IS AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES, AND THAT THE FOREGOING LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR ANY LIMITED REMEDY HEREUNDER. THE LIMITATIONS OF LIABILITY CONTAINED IN THIS AGREEMENT WILL APPLY ONLY TO THE MAXIMUM EXTENT PERMISSIBLE UNDER APPLICABLE LAW, AND NOTHING IN THIS AGREEMENT PURPORTS TO LIMIT EITHER PARTY S LIABILITY IN A MANNER THAT WOULD BE UNENFORCEABLE OR VOID AS AGAINST PUBLIC POLICY IN THE APPLICABLE JURISDICTION NEITHER PARTY WILL BE LIABLE FOR ANY DELAYS OR FAILURES IN PERFORMANCE DUE TO CIRCUMSTANCES BEYOND ITS REASONABLE CONTROL THAT COULD NOT BE AVOIDED BY ITS EXERCISE OF DUE CARE. Page 10 of 11

6.4 CHOICE OF LAW The applicable law of this SSP is that of the country in which the Service activity is being performed under the contract. 6.5 TERMS AND CONDITIONS WESTCON Security General Terms & Conditions are applicable. See: http://be.securitypoint.westcon.com/static/?content=terms Page 11 of 11