Virtual Network Services (VNS) Welcome Kit

The Managed Service Implementation Manager is your primary contact regarding your Virtual Network Services deployment. The Managed Service Implementation Manager is responsible for the overall implementation and serves as your single point of contact throughout the course of the project. Your Managed Service Implementation Manager will arrange a Customer Kickoff Call/Order Verification Call to review and approve the Engineering Design Document and begin the implementation process.

Below is a list of activities to be performed by the Managed Service Implementation Manager:

• Schedule and run the Customer Kickoff Call/Order Verification Call.
• Perform overall project management services for the timely delivery and successful activation of the network with Verizon.
• Act as the ultimate point of escalation for the project team.
• Drive on-time delivery of the project and will pursue/escalate any unmet milestone deadlines.
• Host conference calls among all relevant parties.
• Develop the project plan jointly with you, the Verizon Account Team, and other support groups.
• Secure and matrix-manage all the resources necessary for project execution.
• Coordinate resource scheduling with Design and Implementation Engineers.
• Lead the development of processes and procedures required for network implementation.
• Oversee the completion of all steps in the defined process.
• Publish open action items and status reports.
• Establish reporting procedures with you and Verizon.
• Maintain the order tracking with milestone details for circuit/CPE Orders.
• Interface with Verizon organizations to collect status information.
• Act as the point of contact for any order-related issues.
• Confirm overall project delivery is compliant with the contract
• Conduct project closeout meeting. Transitions any remaining non-project issues for follow up.
• Provide re-engagement and, if applicable, change management instructions to you and the Verizon Account Team.

Note: E-mail communication sent by your assigned Managed Service Implementation Manager (MSIM) will contain their contact information along with escalation contact information in the signature section of the email.

Your Order Manager will communicate as needed in the form of periodic emails and/or follow up calls to provide status on key information regarding the implementation and activation of your Virtual Network Services. The Order Manager will work all aspects of the order directly with you and will gather any additional information needed. The Order Manager and Managed Service Implementation Manager will be in full communication with each other as your order progresses through completion.

Your Design Engineer is responsible for the physical and logical design and development of your network.

Below is a list of activities to be performed by the Design Engineer:

• Create your organization’s custom Engineering Design Document.
• Work with you to help develop an application Test Procedural Document (if applicable).
• Review & verifies your hardware and software configurations.
• Review redundancy, availability requirements, and security requirements.
• Make revisions to Engineering Design Document, as required.
• Review IP addressing scheme & request IP Addressing allocation for secondary addressing for network management.
• If required, implement the necessary controllers, either on premises or in the Verizon data center.
• Responsible for Proof-of-Concept Implementation (typically the hub and a few remotes), including testing of VNF functionality.
• Verify visibility to your network for network management (i.e., management PVCs) once the link has been provisioned.
  
• After a successful Proof of Concept implementation, will provide the activation/technical requirements template and transition the project to the Implementation Engineer.

The role of your Implementation Engineer is to act as the technical point of contact during any required device installations while providing virtual support on all managed equipment or circuits, taking over the network implementation from the Design Engineer after the first few sites are implemented.

Below is a list of activities to be performed by the Implementation Engineer:

• Communicate with you as necessary for required technical information.
• Confirm out-of-band modem and Layer 1, 2, and 3 connectivity for the hardware and access.
• Validate all necessary WAN circuits are passing IP traffic as designed.
• Build logical configurations for connectivity to your network.
• Act as your technical point of contact during device activation.
• Test devices to verify they meet standards for security and compatibility with your existing network devices.
• Testing of VNS policies as necessary.

If the project has a security feature (VNF), your Network Security Engineer (NSE) is responsible for the logical design and implementation of your Security VNF.

Below is a list of activities to be performed by the Network Security Engineer:

• Review redundancy, availability requirements, and security requirements.
• Make revisions to Engineering Design Document, as required.
• Provide activation/technical requirements template for applicable Security Services.
• If required, implement the necessary element managers, either on premises or in the Verizon data center.
• Work with you to apply your Initial Security policy configuration.
• Provide support for external server integration when required for Next Generation services.
• Confirm visibility to your Security with Virtual Network Functions (VNFs) for network management.
• Communicate with you as necessary for required technical information.
• Act as your technical point of contact during device activation.
• Test devices to verify they meet standards for security and compatibility with your existing network devices.
• Assist in testing of initial Security policies as necessary.

Upon successfully completing the requirements of your Virtual Network Services, your network services will be handed off to the Verizon Network Operations Center). The Verizon Network Operations Center will be responsible for incident and change management activities after your solution is accepted under management.

Within the Verizon Network Operations Center, your organization will have a Project Engineer assigned. Below is a list of activities to be performed by the Project Engineer:

• Verify that the order meets the criteria for the Verizon Network Operations Center to manage the service.
• Act as Point-of-Contact for non-real-time-service issues.
• Act as Point-of-Contact for your Terminal Access Controller Access Control System (TACACS) account requests and password resets.
• Act as Point-of-Contact for your WAN Analysis account registration and password resets.
• Set up your Netflow Customer Product Administrator (NCPA) on the WAN Analysis Portal.
• Maintain the Enterprise Service Portal (ESP), the Managed Network Service (MNS) Database of Record
• Act as Point-of-Contact for Customer contact notification and device inventory audit reports via ESP.

For more details, click on the Network Operations Center in the left navigation of this welcome kit.

Virtual Network Services Routing expands customers’ options for what routing services are available with the premises-based Deployment Model. Not only are customers are able to select from different sizing models, but they are able to choose the router image that matches with the rest of their network architecture. Due to the nature of routing, all Virtual Network Services - Routing offerings are service package feature set “Core,” encompassing all the standard features provided by the router vendor.

Virtual Network Services Routing is delivered with integrated full service management and transport services by Verizon and Verizon 4G LTE. “Monitor Only” is not available with the Routing at this time. The following vendor is currently part of the Virtual Network Services – Routing portfolio: 

• Cisco cSR1000V

Virtual Network Services – SD WAN takes Verizon’s Managed WAN service offering to the next level by moving from a proprietary hardware Deployment Model to virtual services that can be spun up and deployed using a pre-defined catalog of virtual functions. Customers are able to select from different network capacity models to accommodate their bandwidth requirements. Virtual Network Services - SD WAN offerings are available in feature sets “Essential,” “Core,” or “Complete,” depending on the features provided by the vendor.

Virtual Network Services SD WAN is delivered with integrated full-service management, Co Management  or Monitor Services provided by Verizon. SD WAN services are available on premise either dedicated or on uCPE, on Verizon or third-party hosted platforms. The following vendors are part of the Virtual Network Services – SD WAN portfolio:

• Cisco vEdge (Viptela OS)
• Cisco cEdge (IOS XE SD WAN)

Virtual Network Services - Software Defined Secure Branch expands customers’ options for a new combination of SD WAN and Security services in one package delivered on premise either purpose-built, on uCPE, or on Verizon or third-party hosted platforms. the Hosted platform Customers are able to select from different network capacity models to accommodate their bandwidth requirements. Virtual Network Services - Software Defined Secure Branch offerings are available as service packages “Essential,” “Core,” or “Complete,” depending on the features provided by the vendor. 

Virtual Network Services - Software Defined Secure Branch is delivered with integrated service management, provided by Verizon. Software Defined Secure Branch is available with Full Management, Co Management and Monitor service levels. Co-Management is not available for the Software Defined Secure Branch + WAN Optimization (Riverbed) solution bundle. 

The following vendor is currently part of the Virtual Network Services – Software Defined Secure Branch portfolio:

• Fortinet
• Versa

Virtual Network Services - Security includes end-to-end, full-service management and can protect Private IP (MPLS-based VPN), Internet network circuits, or wireless provided by Verizon or other carriers.

All the security products offered have built-in Essential functionality. Both the Core and Complete options build on the Essential level offering. The services are available either on premises or on the Hosted platform. Customers are able to select from several different network capacity models, to accommodate their capacity requirements. Detailed information about the features included in each feature set can be provided by your Account Manager.

With Virtual Network Services-Security, Customers have the choice of Full Management or Monitor Only Service Levels. Details about the differences are found in Managed Network Services Support Options above. The following vendors are currently part of the Virtual Network Services – Security portfolio:

• Palo Alto
• Fortinet
• Check Point

Virtual Network Services (VNS) – SBCaaS expands customers’ options for securing their VoIP infrastructure via SBCs deployed and managed as a service. VNS - SBCaaS has two distinct and separate service bundle offerings, defined below.  Both SBCaaS service bundles are available on the Hosted Network Services (HNS) platform with full management only.  Customers are able to select from different sizing models to match their expected call capacity (simultaneous sessions) requirements.  The “Session Border Controller” feature for VNS provides various levels of service, leveraging standard license options from the technology partners. Detailed information about the features included in each feature set can be found on Insite, Virtual Network Services Feature Matrices.

Virtual Network Services – SBCaaS (Session Border Control as a Service) solution utilizes an all Verizon Private IP interconnect.  The VNS - SBCaaS connects to both the Enterprise Private Branch Exchange (PBX) and Verizon SIP Trunking via Verizon Private IP network.

Note: Intra-enterprise routing must traverse Verizon retail VoIP Session Border Control (SBC.).

Virtual Network Services - SBCaaS Integration with Third Party Unified Communications (TPUC) solutions provides SBCaaS to customers who utilize a third party unified communications platform instead of an on premise PBX. The solution uses public IP addresses over the Internet to interface with the TPUC and Verizon’s Private IP network and SIP Trunking networks.

Only approved TPUC platforms will be supported by this solution offering.  It is the customer’s responsibility to obtain any and all signed digital certificates, as required for encrypted connections, from the TPUC. Verizon will not have a relationship with the TPUC; as such, Verizon will not resell or in any way commercially participate with the TPUC.  Furthermore, Verizon will not assume any responsibility for managing or maintaining the TPUC.  Enterprise customers are fully responsible for managing their relationship with the TPUC. 

Note: Intra-enterprise routing must traverse Verizon retail VoIP Session Border Control (SBC.).

Approved third party unified communications platforms: Currently, there is only one TPUC platform approved by Verizon for use with this feature:

• Microsoft Teams

Virtual Network Services - SBCaaS is delivered with integrated “Full” management provided by Verizon. The following technology partner is currently part of the Virtual Network Services – SBCaaS portfolio:

• Ribbon Communications

Virtual Network Services - WAN Optimization (Current Platform) is delivered with integrated full-service management and supports a variety of transport services, such as Private IP and Internet Dedicated Services, provided by Verizon. It also is able to support Verizon 4G LTE. The services are available either on premises. Customers are able to select from different sizing models to match their expected capacity (connections) requirements.

Customers have the choice of Full Management or Monitor Only Service Levels. Details about these Service Levels and the differences between them are found in the Managed Network Services Options listed above. The following vendors are part of the Virtual Network Services – WAN Optimization portfolio:

• Riverbed

VNS Application Edge is an entirely different way of orchestrating, hosting, deploying, and managing customer containerized applications at the network edge and across heterogeneous clouds.

 VNS Application Edge, available as a VNS service on the premise-based uCPE, provides a means for application lifecycle management and multi-cluster deployments of containerized applications.

 This is possible by giving you the ability to securely and easily host, manage, and control your own applications at your remote locations through the Verizon VNS Application Edge portal while helping to optimize performance by deploying applications where you need them to be in your networks.

That means, latency sensitive or data intensive applications can be deployed on site helping to provide a better user experience and a more efficient use of bandwidth.

An added benefit of the solution is Verizon manages both your network and the application infrastructure at the edge. This premise based complete Kubernetes cluster is securely and logically separated from any other VNS network services on the same uCPE device.

You manage the Kubernetes platform—monitoring and upgrading the platform as required, while Verizon monitors and manages the underlying uCPE hardware and network infrastructure, just as Verizon would do with any other VNS service.

Figure 1: VNS Application Edge in a Nutshell

The power of VNS Application Edge comes from the VNS Application Edge management portal that enables you to deploy and manage all your Kubernetes clusters through the entire Software Development Lifecycle (SDLC).

This means that you can easily manage of your applications across your WAN networks, without having to worry about managing the network itself, while having the ability to centrally manage all of your Kubernetes clusters, wherever they are in your network, at their remote edge locations, or in multiple public or private clouds. 

VNS Application Edge is network and VNS Solutions Bundle agnostic enabling you to deploy your applications on whatever LAN or WAN network environment you choose.

Note: You will need to have at least one of these VNS functions deployed: SD WAN, , or Routing in order to implement VNS Application Edge. You must also have or allow Internet connectivity to enable access to the portal.

Figure 2: Application Edge Network Diagram

Key features of this service include:

• App Ready Kubernetes Cluster:  The VNS Application Edge clusters are deployed by Verizon during the standard VNS service delivery process, ready to be used as soon as you are given access to the Portal. 

Note: Therefore, there is no manual set-up required, helping to eliminate the tedious and time-consuming effort required to deploy clusters at any scale beyond a handful. 

VNS Application Edge allows you to manage automated Kubernetes upgrades and software patches across multiple locations through the easy-to-use portal.

• Multi-cluster/Multi-cloud management via a Single Pane of Glass: You are able to manage hundreds or thousands of Kubernetes clusters from one central management portal, for tighter control of the environments wherever they are located on your network edge and/or in multiple public or private clouds.
• Note: You can make uniform changes and updates to applications and the cluster itself can be made across all or selected sites simultaneously regardless of location – at the edge or in the cloud.
  • Single pane of glass: The VNS Application Edge Portal, which is accessed by a link on your Verizon Enterprise Center Dynamic Network Management (DNM) portal, allows you to manage not only all of your VNS Application Edge Kubernetes clusters located on your remote sites, but also your Kubernetes clusters from third parties located in public and private clouds.  
    Note: This enables  you to deploy and upgrade your apps from a central place, helping to reduce management overhead and the potential for errors
    Note: You also receive monitoring support and proactive notification through the Portal.
  • Software development Life Cycle: The Portal allows you to manage the full application lifecycle from one central portal.
  • Comprehensive Kubernetes Management Platform: The VNS Application Edge portal includes tools to manage the Kubernetes platform itself, which helps to simplify updates and Software Development Life Cycle processes across all the Kubernetes clusters under management.
• Security: You have access to the VNS Application Edge Portal environment through the Verizon Enterprise Center Dynamic Network Manager (DNM) portal, which allows you to use the Verizon Enterprise Center Role Based Access Control (RBAC) features, plus additional more fine-grained access controls on the VNS Application Edge Portal.  You can therefore control exactly who has access and what they can do with that access. 

Note: Verizon does not have access to either your VNS Application Edge Portal or any applications that are deployed within the VNS Application Edge cluster itself.

• Optimized App performance:  Bringing applications that demand low latency, near real-time processing, or both closer to the end-user, help enable new immersive experiences like virtual reality and 4K content delivery networks and can add opportunities for real-time data analysis and decision-making using artificial intelligence and machine learning.
• More efficient use of bandwidth: Depending on the application, there is the potential for more efficient use of the bandwidth at the remote site, since the applications might take advantage of the ability to pre-process the data and only transmit the important information in a more compact form into public or private cloud locations.
  That also means that on-premises data sent to a data center or the cloud can be aggregated. 
  

The service is available with a choice of 3 capacity sizes based on a standard amount of compute, storage and memory resources allocated.

 These resources are pinned, that is reserved your use only to help assure that the cluster will perform as expected.  These resources are logically and securely separated from the other components on the uCPE.

 That means the applications have fixed resources available, as contracted for, and do not compete for resources from oversubscription or noisy neighbors from any other services deployed on the same hardware.

The 3 options with details of the resources available for each are listed below:

• Small: A ready built Kubernetes managed container environment that includes 8 cores, 16GB Random Access Memory (RAM) memory, and 400GB persistent storage.
• Medium: A ready built Kubernetes managed container environment that includes 16 cores, 64 RAM memory, and 2 Terabytes (TB) persistent storage.
• Large: A ready built Kubernetes managed container environment that includes 24 cores, 128GB RAM memory, and 3.5TB persistent storage.

Once VNS Application Edge has been deployed at the location by the Verizon Service Delivery team, you will have access to the VNS Application Edge portal from the Verizon Enterprise Center and will be able to deploy and manage your applications.  As with any of the VNS services, Verizon manages the underlying environment, the virtual machine image itself and any other support of the service. 

The service is sold with the Co Management service level. Application and cluster management is your sole responsibility.  Verizon does not manage or deploy your applications or maintain or upgrade the Kubernetes cluster.

Figure 1-9: VNS Application Edge Architecture Overview

The Network Operations Center performs automatic alarm detection, fault isolation, trouble-ticket generation, event and maintenance correlation, customer notification and regular updates, in many cases without the manual intervention of network support staff. The Network Operations Center also provides deep visibility into the circuits and equipment that make up your network to help more effectively manage your services. The following are services available to you within the Network Operations Center (depending on your contract with Verizon):

For all Managed VNS levels, Verizon will proactively monitor your network, isolate faults, and notify you in the event of an alarm. Rapid Fault Isolation enables Verizon to automatically test network elements in parallel, in many cases without human intervention.

The Network Operations Center monitors your networks through a combination of Simple Network Management Protocol (SNMP) polling/traps, Internet Control Message Protocol (ICMP) pings, and System Logging Protocol (SYSLOG) messages from devices.

Verizon will dispatch support in the event of hardware trouble for customers subscribing to the Full Management and Co Management service levels. Support for the Full Management and Co Management service levels includes all physical and logical router configuration management support.

As networks evolve, configuration changes become necessary. As soon as a device comes under Network Operations Center management, Verizon engineers save configurations to servers so a back-up copy is available. In addition, a regular back-up process collects and saves all configurations. Verizon’s process is intended to help Customers safeguard the design of their networks.

When changes become necessary, Verizon engineers work closely with you to review, assess, schedule, and execute required changes. In scope changes to networks are categorized into the following:

• Emergency. Related to imminent failure(s) or current outage. The customer would initiate an emergency change by opening a ticket through the customer service center.
• Express. Minor change to a single site that does not require scheduling.
• Standard. Changes that require technical assessment and scheduling are covered under the standard option. Standard change requests require advance notice of three business days (72 hours).
• Optional requests—generally defined as requirements that alter the existing network design—are routed to engineering through a project initiated by the account team.

Verizon WAN Analysis Service is a reporting tool, based on industry-standard performance and trend analysis software, thus permitting you to evaluate the end-to-end performance of your data network. The reporting tool provides baselines, trending-health indexing, and exception reporting through graphical reports, ranging from executive summaries to PVC utilization for the network administrator. These reports are available via the web using a standard web browser. The Verizon Account Team can make arrangement for user accounts and familiarization sessions with the Performance Reporting Help Desk.

Security Management broadly defines those functions and activities performed by Verizon to help keep your solution (network and CPE) secure. In addition to the security and survivability features of our Network Operations Center facilities, the functions and activities include, but are not limited to, the following:

• Security Privileges. Establish security privileges for the managed router(s):
  • Maintain router password
  • Enable passwords
  • Enable secret passwords
• Access Control. Access to the network and the device under management.
• Terminal Access Controller Access Control System (TACACS) Administration. TACACS is an authentication protocol developed to provide remote access authentication and event logging. Verizon’s preferred and recommended installation is that Cisco devices have TACACS set up.
• Add/Modify/Delete Filter and Access Lists. Access list and filters are used to define conditions for how packets are handled by the router or switch. Packets are dropped, permitted, or routed based on these filters/access lists.
• CERT-Related IOS Upgrade. Initiate the process to upgrade a router or switch’s operating system to mitigate known security vulnerabilities with the current code.

Customer action

Verizon will not upgrade any security associated code within your managed network without your prior notification and/or approval from you. In the event any security code needs to be upgraded by Verizon, be sure to check how that upgrade may affect any other security protocols your organization may have in place already.

• OS Upgrades. Initiate the process of upgrading a router or switch’s operating system to eliminate known bugs with the current code – usually performed as an “emergency” upgrade.
• Back-Up and Maintain Router Configuration: Regular back-ups are accomplished through the use of a custom Verizon proprietary script.

Note: Only the Network Operations Center engineers will have access to the configuration servers. Each Network Operations Center engineer is assigned a secure logon ID and password to access the configuration back-ups. Having the backed-up CPE configurations fully accessible to Network Operations Center engineers helps provide rapid restoration of services and accurate documentation about your network.

Verizon’s objective is to restore your services to their normal operating conditions quickly and efficiently. To accomplish this objective, NOCs and the Customer Service Centers use escalation guidelines set up to push or drive issues to resolution.

Instead of escalating on the basis of time, escalations are value-based. The objective is to add value to the escalation process across the board for all customers and all circumstances, as well as to add standardization to the processes.

Note: You can request escalations at any time during an outage by calling into the Customer Service Center or directly contacting NOC management (as provided in your “handoff” email).

Value-based escalation may be understood as follows:

• During outages, Customer Service representatives review tickets hourly to update you.
• They assess whether escalations are needed. If there is no progress since the previous review, an escalation is made to the next level of management.
• However, if the appropriate focus and resources are being applied, escalations may be deferred. Technical escalations by the NOC to local-exchange or third-party carriers follow the same value-add process.

Verizon strives to perform network maintenance activities with little or no disruption to our customers. However, regular and sometimes emergency maintenances are unavoidable. Every attempt is made to schedule your maintenance windows during weekends, late night, or early morning hours to reduce negative impact.

Note: For global wide type of changes the Verizon backbone team sends out a notification. The Verizon backbone team would not wait for your approval to perform the global wide changes.

A formal change control system is used through Verizon Enterprise Center portal to request, approve, schedule, notify, and implement changes.

Customer action

Contact your Verizon Account Team about setting up Verizon network maintenance activities notifications.

Customers are required to notify Verizon when equipment or site-maintenance activities that may cause outages or generate alarms on Verizon systems become necessary.

A customer maintenance change request, specifying the beginning and end date and time, should be created through the Verizon Enterprise Center portal.