KPSN Schools Broadband, April 2010 This service level agreement (SLA) is between schools and the CFE / KPSN Schools Broadband Team for the supply of broadband connectivity and services. The SLA will develop as requirements from schools, government and Kent are incorporated; your suggestions are welcome. Aim To work in partnership with schools, KPSN, Kent-wide initiatives, Becta and DCSF to develop broadband Internet and WAN services for schools and the wider community. Objectives Develop the effective application of broadband in education through partnership with schools, innovative solutions and information exchange. Ensure that a range of advanced, appropriate and affordable broadband solutions is available to schools of all sizes, locations and interests. Ensure effective management of contractors for the delivery of managed broadband services and closely manage the service delivery. Work with other Kent and KCC groups including Higher and Further education to aggregate broadband requirements, share costs and exchange good practice. Liaise with DCSF, Becta and other agencies to ensure Kent schools requirements are understood at national level and that schools benefit fully from grant funding. Contents Benefits of KPSN Schools Broadband Organisation Government objectives, Regional Broadband Consortia Procurement, service delivery management Partnership with schools Schools responsibilities The range of KPSN broadband services
The Benefits of KPSN Schools Broadband Access to Government Funding: The DCSF Harnessing Technologies funding is accessed via membership of the Regional Broadband Consortium, the South-East Grid for Learning (SEGfL). Broadband funding is not available to individual schools. Access to Kent Funding: Kent is making a huge investment in the KPSN fibre backbone and school connections, considerably above the requirements of DCSF, to bring full broadband to all areas, whether rural, urban or coastal. National Education Network (NEN): Every student in any school should be able to collaborate with any other student across the UK bypassing the vagaries of the Internet. This flexibility is enabled by the KPSN direct connection to the NEN. KPSN Charge: Schools Broadband provides the basic broadband service specified by DCSF for which schools do not contribute. This comprises 2 Mbps Primary, 4 Mbps Special and 10 Mbps Secondary which is filtered and secure. Higher bandwidth levels are charged, but well below the commercial rate for an equivalent service. Best Value for Money: To drive down costs and reduce procurement overheads, KPSN has procured broadband connectivity for schools in Kent in accordance with DCSF rules and European Union procurement law. 24 x 365 Service: Schools now require Internet access at almost any time of day and evening including weekends and holiday periods. The service is always-on. Quality of Service: Streaming video and video conferencing will play an important part in future learning strategies. The KPSN network has been designed with Quality of Service (QoS), although further development on school LANs may be required for its full implementation. Educational Applications: Schools require a range of Internet applications such as web, video conferencing, mail relay and content filtering. These are complex areas, for instance filtering requires an understanding of education policy, law, filtering technology and public perception. Strong Contract Management: EIS monitors service delivery and drives problem resolution on behalf of schools. EIS also makes high-level representations to the contractors if the SLA is not met through regular management meetings. Difficult Locations: In some parts of Kent the installation and operating charges for broadband are very much larger than the average. For a KCC school, the contribution for a particular service does not depend on location or actual cost of provision. Technical Support: Broadband delivery is complex, involving the distant Web site, Internet, WAN and the school LAN. The EIS Help Desk, with dedicated broadband staff, works to resolve issues across several networks and suppliers. Government Policy: Kent represents schools views on ICT and broadband to DCSF and Becta. Particular aspects currently include future funding and ensuring the cost to schools is sustainable. 2
Government Objectives: By 2006, the government required all primary, special, middle and secondary schools, and PRUs to have broadband Internet connections. Government requirements for the broadband connectivity can be summarised: Primary schools must have at least 2 Mbps bandwidth. Secondary schools must have at least 8 Mbps bandwidth. The bandwidth must be symmetric, ie should be the same speed each way and there should not be any bottlenecks to use, i.e. a low contention ratio. Low quality services such as ADSL and satellite are no longer acceptable for any school, which require Full Broadband to deliver curriculum entitlement to pupils. Streaming video and video conferencing should be possible through the provision of low-latency bandwidth across all sections of the network. Schools must have a connection to the National Education Network to enable communication with a better quality of service than the Internet provides. All networks, both LAN and WAN, must follow industry standards as defined by the DCSF / Becta Functional Specifications. Kent also has wider plans for networking which include the whole community, particularly remote areas where broadband services are poor. South East Grid for Learning and Kent In 1999, the government set up the ten regional broadband consortia (RBC) to develop broadband strategy for schools. Kent with 10 other LAs formed the South East Grid for Learning, the RBC for South East England. SEGfL is the route to DCSF funding and enables major procurement, legal and development costs to be shared. The South East Grid for Learning (SEGfL) now comprises 17 LAs including Hampshire, Medway and Surrey. Bracknell Forest is the lead authority and Kent is on the Steering Group. Greg Hill is the SEGfL Director. The KPSN is owned by KCC and is a physically separate network to other LAs. KPSN is connected to LAs across the UK through the National Education Network. KPSN Procurement In 2008, a group comprising Canterbury City Council, Kent County Council, Kent Connects, Schools and Thanet District Council formed the Kent Public Service Network (KPSN). KPSN advertised in the Official Journal of the European Union (OJEU) on behalf of these Partners. This Europe-wide competition resulted in awarding the contract to Unisys in May 2008 for 4.5 years. Unisys is responsible for all aspects of the delivery of the service and for services provided by their subcontractors: BT (connectivity and hub hosting), Update (LLU circuits), Websense (filtering), Cisco (active elements) and Dell (servers). KPSN also has contracts with JANET(UK) for Internet and National Education Network connectivity, with Kentish MAN for connections in Kent and with EIS and the University of Kent for WAN Centre hosting. 3
Contract Management EIS has responsibility for the operational management of the Schools Broadband aspects of the KPSN. EIS will: Manage the day to day service delivery with Unisys and escalate any necessary issues to KPSN officers as required. Monitor service delivery closely and propose improvements. Pro-actively pursue continuous service improvement with the supplier. Represent schools future curriculum and administration requirements to KPSN management. Ensure that schools make reasonable use of KPSN. Partnership with Schools The requirement for high service availability and security is similar to business, but schools are additionally very heavy network users and require more frequent changes in configuration and facilities. Network access from locations beyond the school and internal threats can challenge security arrangements. On the other hand, few schools can afford business rates for broadband and Internet services. To achieve economies of scale and Best Value, KPSN works in partnership with schools and wider public services. KPSN also collaborates with higher and further education in Kent to share facilities and infrastructure. The partnership with schools works well and enables better value to be obtained than a purely commercial relationship. Schools working together can achieve far more than individually, particularly where schools share their expertise. DCSF and KCC cover full broadband installation costs for schools, representing an investment exceeding 10,000 per school, and sometimes ten times this. Partnership includes: Economies of scale mean that the cost of higher-quality Internet services is well below the commercial rate for a single school. Installation costs are met from KCC and DCSF funding. Schools in difficult locations are protected from excess costs. Schools can share Internet access with other local schools, where locations are suitable, to form a broadband cluster. This can bring broadband to small schools earlier and reduce costs to all parties. EIS Broadband Service Desk responds to broadband queries from schools. KPSN Schools Broadband creates the broadband strategy through discussion. Documents are published at www.eiskent.co.uk?broadband. Schools agree a common CFE / Schools Broadband security and e-safety policies, helping to protect all schools. 4
The School s Responsibility to KPSN Schools Broadband The following requirements and recommendations are important technical, design and management aspects of an effective WAN service. Exceptions may be possible, providing security can be maintained, and the school is prepared to accept any costs which the general school community would not accept as a reasonable shared cost. Ultimately if a substantial threat is presented to the security of other schools on the network, a school may be disconnected from KPSN. As much information, assistance and warning will be provided as possible. With the considerable installation costs covered by KCC and DCSF, schools are expected to honour the agreement to August 2011, at least. Schools must use KPSN bandwidth reasonably, in order to maximise services to schools in general and to make the best use of public finances. Continuous downloading of large files or inconsiderate streaming is not fair use. Before connecting to the KPSN, school networks must comply with the security audit. The school agrees to conform to the Schools Broadband CoCo (Code of Connection) incorporating the Standard Implementation Policy and Security Policy. Space is required in a suitable environment for the Unisys CPE, BT s NTU and for secondary schools a filtering server, with reliable power outlets. Secondary schools bear the responsibility to ensure that the filtering service is configured according to school policy and that no other applications are installed and no changes in configuration are made to the filtering server. The configuration of the LAN network is the school s responsibility, but co-operation in LAN-WAN issues with EIS will improve the service and is an essential aspect of the Schools Broadband partnership. Assistance with visiting EIS, Unisys or BT engineers is requested and will greatly reduce the time required to resolve a fault. Occasionally access outside core hours will help engineers fix a fault more quickly. To help us resolve issues, schools should provide Schools Broadband with contact names, generally a senior manager, the ICT coordinator and the network manager. Schools should keep up to date with KPSN Schools broadband developments published on the EIS site www.eiskent.co.uk?broadband and on www.clusterweb.org.uk?broadband. Continuous Service Improvement KPSN has financial penalties in the contract with Unisys, which can be used should the service not meet the SLA. Industry best practice suggests that where services are working well, the focus should be on improvement rather than on penalties. Accordingly KPSN and Unisys operate a Continuous Service Improvement Programme (CSIP), whereby Unisys will report on a service deficiency in detail and agree improvements with Kent to prevent its recurrence. The customer gains an improved service rather than a cash rebate, and in fact the cost of this work to Unisys is probably higher than a penalty. 5
The Range of KPSN Broadband Services KPSN Schools Broadband offers secondary, middle, special, primary and independent schools and other educational agencies a range of broadband services from Full DCSF specification broadband and above. KPSN also supplies District Councils, KCC and a range of other public sector agencies. KPSN School Connection Types Include: Local Loop Unbundling (LLU): A low bandwidth symmetrical circuit at 2 Mbps to 12 Mbps, suitable for smaller schools and PRU`s. LLU is available in most urban areas in Kent. Learning Stream: a 2 Mbps symmetric service that is suitable for some difficult rural locations. KPSN is moving schools away from this service to a fibre-optic, wireless or LLU service where possible. Optical fibre: The highest grade and most expensive connectivity to one of 45 KPSN hubs using BT fibre-optic circuits (WES or EAD). Primary schools generally have 2 Mbps bandwidth supplied over a 10 Mbps fibre, but some now require 10 Mbps. Secondary schools have a minimum of 10 Mbps, but others have as much as 50 Mbps served over a 100 Mbps fibre. A broadband cluster: Often a school is near a library, a museum, children s centre or council office. A group of such establishments can often share a single high bandwidth fibre feed and provide really high-quality broadband at a reasonable price. Wireless links are often used to connect the child establishments together. In all cases a Cisco router is provided in the school to provide intelligent and secure services. KPSN Full Broadband Local hubs connect the school to the dual WAN centres in Maidstone and Canterbury at a design contention ratio below 3:1. The traffic on these links is monitored and is maintained at below 70% of link capacity. This headroom backbone bandwidth ensures a 1:1 operational contention ratio. The KPSN backbone comprises nine resilient rings, which remove most single points of failure. The main 45 backbone hubs have at least 100 Mbps capacity, and often 1 Gbps. KPSN places all hubs in BT exchanges for security and reliable power including UPS. Engineers have 24x7 access for overnight fault resolution. Resilient Internet access is provided from the Maidstone and Canterbury WAN centres via 2 Gbps circuits on the Kentish MAN to the universities SuperJANET network. Two 10 Gbps SuperJANET links provide a direct connectivity with the National Education Network and the Internet. KPSN Schools Broadband Services: The KPSN service delivery is managed by Unisys from the customer premises equipment to the termination of the Internet feed at the KPSN WAN Centre. The Kent Learning Zone (KLZ) provides email, collaboration (sharepoint), instant messaging (OCS) and parental engagement. KLZ is currently free for staff, with pupil accounts available at 2.50 each per annum. KPSN provides SMTP email relay with anti-virus and anti-spam. Filtering is provided by WebSense. Secondary schools have a school-based server. Primary schools use central servers located within KPSN. 6
Schools can opt for a local DMZ hosted on their CPE to facilitate on-site hosting of web sites, VLEs and other resources such as outlook web access. Primary and Special schools have free EISite websites, which school staff can maintain without software expertise. Cisco IPSEC and SSL VPN provides remote access to school LAN for remote working and administration. KPSN provides authoritative domain hosting, MX record hosting and internal and external DNS resolution. Through the National Education Network connection, Kent schools have free access to nationally procured or developed content providers. A multipoint conferencing unit is provided at the core to enable multi-way video conferences and connections between IP and ISDN videoconferencing. Not included in the base service: E-mail filtering for unsuitable content, other than anti-spam or anti-virus, is not provided for secondary schools. KPSN does not support school-based email servers as part of this SLA, although Schools Broadband will offer advice where time permits. LAN virus scanning is the responsibility of the school. Kent schools have access to a centrally negotiated anti-virus product at reduced cost. The school is responsible for the LAN up to the WAN interface. KPSN, where time permits, will discuss LAN/WAN issues such as DNS. Discretionary Services In the spirit of partnership, Schools Broadband will endeavour to meet school s individual requirements within reason, although charges may apply in some cases. For instance, firewall changes for a new online software package would not incur a charge if many schools would benefit from its use. These requirements must: comply with the requirements of the Kent Schools Security Policy not place an unreasonable load on the overall system be of reasonable cost (ie other schools would consider reasonable) or be paid for by the school as an additional charge. 7
Internet Connection Speed Fast, reliable and responsive Internet access is essential for schools. However, parts of the path between school workstation and distant Internet server are not under KPSN control or can be affected by school usage. The link between the school and the KPSN hub is a dedicated line where the whole bandwidth is available for that school. The bandwidth available can be increased without installing a new fibre. In broadband clusters two or more schools share this bandwidth but each school receives at least the DCSF required bandwidth.. Schools can access the Schools Broadband Orion system to monitor their usage statistics. Usage of any IP link should be kept below 70% to ensure the highest quality of service, particularly for time-critical data such as video conferencing. The KPSN backbone links are monitored and generally usage of 70% or below will be maintained. The design contention ratio is below 3:1, but management ensures headroom bandwidth, effectively a contention ratio of 1:1. The Internet links are monitored and will be upgraded when average usage reaches 70% on a regular basis. Current peak usage of the Internet feed is below 20% of feed capacity of the 10 Gbps JANET links (December 2009). Heavily contended services such as ADSL cannot guarantee bandwidth delivered as generally 20 establishments share the advertised bandwidth. Schools using ADSL will experience periods of slow Internet access particularly during the day when local business is using the same bandwidth. Bandwidth Delivered Bandwidth is the most expensive element in broadband and schools need to take responsibility for its reasonable and appropriate use. This will ensure they get the fastest Internet response and the best value for their school contribution. The KPSN connection is priced on the basis that bandwidth usage is typical i.e. mostly Web access with large file download such as software updates generally outside peak hours. In a typical secondary school, occasional peaks of 10 Mbps are acceptable on a 10 Mbps connection, but average usage within core hours should be below 30%. Schools should aim to keep their 99th percentile useage (statistics available through Orion) below 70% of bandwidth allocation to allow sufficient headroom for peaks. Additional bandwidth is available on request, prices and application forms are published on the website. Very high usage of streamed video or Internet radio, or downloading many large files in teaching time such that the contracted bandwidth is saturated on a frequent basis has two effects. The latency (delay) inevitably rises, degrading the school s service. The school will also consume more bandwidth than is reasonable for the financial contribution and a bandwidth upgrade will need to be obtained. Schools can monitor their bandwidth usage through the Orion system web interface. Network Availability The KPSN service is always on. It is available 365 days/year, 24 hours per day. The overall contracted service availability is 99.9% during working hours/days, and supplier performance is closely monitored. All service disruptions are taken very seriously and are escalated by KPSN with Unisys. Wherever possible planned network maintenance will be performed outside core service hours and schools will be informed in advance if this carries the possibility of a service disruption. A weekly maintenance window is scheduled on Tuesdays from 07:00am to 09:00am, during which service is usually maintained, but is not guaranteed. Maintenance always starts at 07:00am, and very rarely lasts past 08:00 as the last hour is for roll-back should an upgrade fail. 8
Service Hours and Call-out times KPSN service is designed around schools requirements to use WAN and Internet services at any time of the day or evening, both weekdays and weekends during the whole year. Network and Internet services are therefore supplied and monitored 24 x 7, 365 days per year. Within this continuous service, core service hours are weekdays, 08:00 to 18:00. (09:00 to 18:00 Tuesdays), excluding bank holidays. The KPSN Helpdesk is available currently 08:30 to 17:00, working days. We have had no requests for these hours to be extended. Unisys engineer call out is 08:00 to 18:00 normal working days with a 5-hour response time within core service hours. (Calls logged after 2.00pm may be attended the next morning). Please note that this is not a guaranteed fix time. Also note that an engineer could be dispatched to either end of a communications link and activity may not be visible to the school. The availability of school staff is vital to ensure speedy fault resolution and is initially assumed to be the same as KPSN core service hours. Change Requests Changes should be submitted by e-mail to or over the phone for advice. Schools should give as much notice of required changes as possible. Standard changes are completed according to the following target timescales; Core Filtering Policy Change Secondary School Websense Assistance DNS Change CPE/Local DMZ Configuration Firewall Rules/Public IP assignment 4 hours 4 hours 3 days 3 days 5 days Change requests requiring a security assessment or design work can take longer and may incur a charge. 9
Schools Broadband Filtering Schools Broadband filtering is provided by Websense. Default filtering levels are provided but secondary schools have the ability and the responsibility to manage the level of filtering applied to individual users or groups. Primary schools generally have a single level of filtering, although greater control can be provided on request. For Email, Ironport appliances apply anti-spam and anti-virus protection. Websense uses several strategies to protect pupils, including: Comprehensive URL lists to ban access to a wide range of sites in many languages. Schools can select from over 90 categories of site content. Lists are updated automatically by the Websense team on a daily basis. Keyword filtering. Schools may add sites to either a local deny or a local accept list to override the default URL filtering. Comprehensive reporting available to schools, for instance to provide a report on an individual pupil to be sent to parents. Force safe search=on for search engines such as Google and Yahoo. Schools may import pre-defined groups of users from the school network directory service and set filtering for these groups. Secondary schools have local servers integrated into schools domain to provide integrated authentication and AD based policy, ie per user or per AD group. Websense is a sophisticated application and gained Becta filtering product accreditation in January 2007, which includes the following requirements: The provider must offer support for all aspects of the service provided. The product must block 100 per cent of illegal material identified by the Internet Watch Foundation (IWF). The product must be capable of blocking 90 per cent of inappropriate content in each of the following categories: Pornographic, adult, tasteless or offensive material Violence (including weapons and bombs) Racist, extremist and hate material Illegal drug taking and promotion Criminal skills, proxy avoidance and software piracy The product must enable users to customise the product restrictions. Websense overview: www.eiskent.co.uk >> broadband >>Secondary and Middle Schools More information can be obtained from Websense: www.websense.com/global/en/resourcecenter/ IndustrySolutions/Education/ The Websense documentation is available for download from: www.eiskent.co.uk >> broadband >>Technical Information 10