MANAGED FIREWALL SERVICE. Service definition

MANAGED FIREWALL SERVICE Service definition

of 4 Version 1.2 (03/02/2015) NSMS Managed Firewalls Service Definition Understanding of a firewall service The function of any firewall service is to filter traffic coming in to Local Area Network (LAN) and going out in to the Wide Area Network (WAN), based upon predetermined criteria. No firewall can protect against all protocol or application weaknesses and new software vulnerabilities, which are discovered all the time. Any device being protected by a firewall should be administered with the same level of vigilance as if a firewall was not present. Service outline The NSMS Managed Firewall Service (MFS) provides customers with a firewall configured to their requirements, to provide control of access to local devices (such as servers and desktops) and the LAN. The MFS is designed for passive defence. The Service will provide restrictions on the source and destination TCP/IP addresses and service ports which are allowed to pass through the firewall. The service offers: Market leading firewall technology (FortiNet); Fully trained staff from NSMS; Rolling support for the firmware, patches and upgrades of the device, for the duration of its supported life (5 years); Single device or failover dual device solutions (HA) are available; Site-to-site Virtual Private Networks (VPN) and/or IPsec tunnels; Remote client VPN service (e.g. work from home); Network Address Translation (NAT) to hide the customer's network addresses from the Internet, if desired; Fully configurable rule base, managed by trained professionals; Advice and guidance on firewall security; IPv4 and IPv6 compatibility. Firewall options NSMS deploys three models from the FortiNet firewall range (FortiGate 70D, FortiGate 100D and 300D). These models allow for NSMS to manage the smaller units with only a handful of users and/or low bandwidth demands, to the medium sized units with many users and/or high bandwidth demands. Units with even higher demands may contact us directly for further discussions. Support options Once a model has been identified, we will advise on whether Unified Threat Management (UTM) is also required. Once a device has been chosen and deployed, NSMS offers an all-inclusive package for the continual support of the given device. In the support package, NSMS will provide comprehensive management of the device. From the updates issued by the vendor to notifying the customer of

of 4 Version 1.2 (03/02/2015) when the hardware lifecycle is due to come to an end, this will be managed by NSMS. In addition, all support matters relating to the Firewall s rule set, such as: changes to the system setup, creationamendment-deletion of rules and so on, will be deployed by NSMS. Other support information Support renewal is performed every twelve months from the date of deployment of the firewall device. Support is paid for in yearly blocks and in advance. Should a customer wish to change or terminate the support contract, this can be done at any point, with three month s notification, of the yearly support contract and any difference will be refunded. Life expectancy of device A newly purchased firewall is protected for 5 years by the vendor and therefore given a life of 5 years. After this time the customer will be contacted by NSMS, to advise on the renewal process, should the customer wish to continue with this service. To ensure the best technology is adopted for our customers, NSMS reviews the chosen firewall hardware provider and supplier every 2.5 years. It is important to note, at the end of a firewall s life the replacement device may be from a different manufacturer and/or supplier. Generic firewall configuration The NSMS default configuration policy is: All outbound traffic is permitted All inbound traffic is denied NSMS will discuss and create the best configuration for your needs during the design stages. Installation/Configuration consultancy The Service offers a basic level of security policy development from NSMS s technical specialists. The aim of which is to understand the required network traffic restrictions, identify and document network objects and applications, and to agree appropriate access controls. The standard consultancy time required for this installation will typically be under half a day, but can last up to two days (dependant on the customer s requirements and setup), this is covered by a one off startup cost (please refer to the Firewall pricing document). Should the installation have special requirements (e.g. proprietary equipment requiring access through the firewall) additional consultancy may be required and will be charged for in accordance to our usual hourly or daily rates. Firewall management NSMS manages all FortiGate firewall solutions via a dedicated centralised and virtualised interface (FortiManager). NSMS will retain admin rights to any NSMS deployed firewall during a valid support contract. Read rights will be issued to a unit adopting the MFS.

of 4 Version 1.2 (03/02/2015) Monitoring The NSMS automated monitoring service will monitor the firewall on a 24/7 basis for availability and critical events, included in the support costs. All flagged events will be viewed by our in-house technical specialists during our normal support hours. Backups Complete system configuration backups are automatically taken, assuming yearly support is adopted, every time a change is made to the configuration, and the last seven versions are kept before being deleted. Syslogs Traffic system logs (syslogs) are extracted live and stored for a period of 90 days before being deleted. Support hours NSMS offers a support service between the hours of 9am and 5pm, Monday to Friday, with the exception of public holidays, bank holidays and periods of forced closure as advertised on the University of Oxford and IT Services websites. There is no formal commitment for NSMS to respond to support requests or service change outside these hours. At risk periods Configuration changes, upgrades or hardware replacement, are carried out during the detailed NSMS support hours. 24hrs notification will be given where possible. Non critical changes requiring a reboot will be performed during the NSMS at risk period (Tuesdays between the hours of 9am and 11am). Customer Responsibilities Customer must provide their own DNS server for resolving internal addresses where appropriate. Changes to the firewall will only be actioned from pre-agreed authorised contacts for that unit. It is the customers' responsibility to ensure that NSMS have an up-to-date list of authorised technical and administrative contacts at all times. The customer is responsible for defining the security policy for their organisation. The customer should be administering servers and other network enabled devices with the same level of vigilance as if the firewall were not present. Should the customer have a local security policy or data policy or any other similar document relating to digital security, then it is the customers' responsibility to ensure that NSMS have an up-to-date copy at all times. Customer to provide a secure and a temperature controlled environment for the firewall device(s). Customer to provide NSMS staff with access to the firewall device(s) as and when requested.

of 4 Version 1.2 (03/02/2015) Continued service delivery NSMS service delivery staff will review the proposed rule base with the customer, as and when requested by the customer to provide feedback and recommendations as required. Email communication should be used to submit any firewall related change requests throughout the duration of the contract. Please refer to the SLD for further information. Further detail and contacting NSMS Please refer to the Service Level Description for further detail relating to this service, or contact NSMS directly on nsms-firewalls@it.ox.ac.uk or 01865 (2)73209 and ask for the firewall team. Thank you.