ECX Fabric Account Models
ECX Fabric offers two account models that enable resellers to create account hierarchies for ECX Fabric products and assets:
Parent/Child - In this model, the reseller creates and manages connections on behalf of their customers. The reseller is the customer of record – all support and connection setup is handled by the reseller. No specific contract is required, just an ECX Policy document. This model is good for resellers or partners who want to segment invoices or services while maintaining global access across the customer’s users.
Reseller/Subaccount - In this model, resellers can enable some or all their end customers for self-service on ECX. Resellers must follow steps in the Portal User Guide section for sub-account setup, assign ports and set up user access for their customers to be able to manage their own connections on ECX. Subaccounts can self-serve and contact the Equinix NOC on their own. This model is good for resellers or accounts that want to wholly separate their customers and/or lines of business into separate entities in Equinix systems.
Becoming a Reseller
Once your account is designated as a reseller account, you will be able to set up subaccounts. However, current accounts cannot become subaccounts. No Reseller Partner agreement is required to take advantage of the basic ECX Fabric reseller capabilities. Watch the video Equinix Customer Portal Tutorial for Master Administrators of Equinix Resellers for more information.
Resellers must follow steps on subaccount setup in the Equinix Customer Portal (ECP) User Guide to designate their end customers as subaccounts, assign ports and set up user access for subaccounts to be able to manage their own connections with ECX Fabric.
Once an account becomes a reseller, a Reseller Master Administrator will be assigned. The Reseller Master Admin is responsible for creating subaccounts and assigning users and user types in ECP. This must be done in ECP before subaccount users can create/view/delete connections in the ECX Fabric portal.
Eligible subaccount user types are:
- IBX Admin
- Master Admin
IBX Admin is not applicable to ECX functionality
These user types affect which ports and connections a subaccount can view.
If a subaccount is represented by more than one reseller, they must maintain fully separate accounts with each reseller, no overlap in visibility or permissions is permitted.
Creating, Viewing And Deleting ECX Fabric Ports And Connections
ECX Fabric ports are assigned to a subaccount, who can then assign users to create/view/delete connections on the port. Multiple subaccounts can be assigned to a single port or each subaccount can have a dedicated port. Port-level permissions enable all resellers to manage access to port viewing and connection ordering.
Resellers, but not subaccounts, can set port threshold notification preferences that will trigger a notification to the reseller if the sold port capacity reaches a specified percentage (ex. 80%). Similarly, resellers receive outage notification but they are responsible for communicating this information to the subaccount.
Viewing and Creating Connections
What is a Service Profile?
A service profile defines how others may connect to a port or set of ports. Service profiles can be "public" -- available for anyone on the ECX platform to connect to (ex. AWS Direct Connect or Azure Express Route) or "private" -- in this case, the service profile owner must give permissions for other accounts to connect (e.g. Joe's Physician’s Network). For more information, please refer to the ECX Fabric Documentation section on service profiles.
Creating Connections To Public Or Private Service Profiles
Any user type (“User” or “Master Admin”) can be assigned to view some or all the ports assigned to the subaccount. Any user can be assigned to create connections from a port to which they have been granted visibility. The reseller will need to grant permission for the subaccount to create a connection to a private profile, but anyone can create a connection to a public profile.
The ability to create connections within a subaccount can be assigned to subaccount users, however, at the reseller level, only a reseller master admin can create and delete connections inside a subaccount.
Creating A Connection To “Self” As A Subaccount
Customers often use the ECX Fabric to connect their assets together, particularly where these assets reside in different metros. To do this, the Z-Side port of the self-connection needs a service profile created so that port will be visible to the A-Side for connection creation.
Subaccounts cannot create service profiles, only the reseller can create service profiles. Therefore, any subaccount who wishes to create a connection between two of their ports in different metros will need to work with the reseller to create a private service profile for their Z-Side port. The reseller will then need to grant permission for the subaccount to create a connection to a private profile.
In either case, connections will not be provisioned unless they have been approved by the service profile owner(s).
Remote (Inter-Metro Or Inter-Region) Connections
ECX resellers and subaccounts can create local connections in a metro and remote connections to any public or private service profile that has remote connections enabled. Remote connections span metros (ex. Seattle to Ashburn) and even regions (ex. Los Angeles to London). Remote connections always incur an additional charge, even if the subaccount has unlimited connections ports. Pricing for inter-region connections varies by region but is static within the same region.
Layer 3 Reseller Capabilities
At Layer 3, we do not have persona capability (for each component), but all the L3 capabilities are possible by Reseller as well as the subaccount users. So, in this case the following will happen:
- Reseller will be able to see all their ports and their subaccounts will be able to see only the ports that they have been given access to.
- Reseller cannot see their subaccount’s L3 components and their subaccount cannot see the reseller’s L3 components on the same port or any other port.
- Both the reseller and the subaccount can utilize all the L3 capabilities using the same ports.
- Some validation will affect each account (same VLAN, same component name is not allowed on the same port by different accounts).
Pricing and Billing for Resellers and Subaccounts
The capability to see associated pricing during connection creation has been added to the ECX portal. However, subaccounts of resellers cannot see pricing in the portal to since the reseller is responsible for billing the subaccount and may alter the price points presented to their customers. Subaccount status is determined by ECP at the time of ECX login.
Note: A subaccount will be a “non-billable” customer. Therefore, all the connections created by a sub-account will be billed to the reseller.
Using the Subaccount Persona
In the ECX Fabric portal, the Reseller Master Admin can view the connections created by the reseller using the persona switch. In addition, a reseller can view, order and manage the connections using the subaccount persona. Admin and reseller users can view the Inventory and My Company pages of users under their preview. This feature is called Impersonation: Sub account and Organization.
When a reseller views as a subaccount, he or she sees only those ports assigned to the subaccount. However, viewing as self will result in viewing all ports, but not the connections belonging to other sub-account users.
How Personas Work in the ECX FABRIC Portal
Located just below the main navigation, you can use the View As field to select the customer or organization you want to impersonate. This field lets you view ECX FABRIC from the same lens and perspective as the user or organization who you are impersonating. It is even possible to create a connection “as” the user being impersonated.
You can find the impersonation feature option on these pages:
- Inventory page
- My Company page
- Create Connection
- Subaccount impersonation is only possible for the user’s own organization. When selecting an external organization, the subaccount drop-down is deselected, and that organization’s subaccounts are not visible.
- When a user or organization is being impersonated, their view is maintained as the reseller navigates through the different pages. To remove the current impersonation view, click the x on the View As search field.
User Types with Impersonation Features
There are three types of users who have access to these impersonation features:
- Reseller and Reseller Master Admin -- Resellers who are not specifically Equinix users, but instead offer Equinix services to their own customers.
- Standard Reseller accounts can view and create, but only for the ports assigned to them. Other ports that have not been assigned cannot be viewed.
- Reseller Master Admin accounts can view, edit, approve, delete, and create for users assigned to their reseller account.
- Reseller and Reseller Master Admin users can use the Subaccount Impersonation feature. In the View As field, click on Search for Customer to display a list of sub accounts. You can also type the first letters of the name to narrow the search results. Sub accounts with no ports assigned appear in the list but cannot be selected.
Tip: While impersonating a sub account, when you create a connection, the connection is made for the account you are impersonating.
- Equinix Admin and Reseller -- These users have Equinix accounts and are also resellers.
- Equinix admin and Reseller accounts have permission to view, edit, approve, delete, and create for users that are under their reseller account.
- This user type combines the functionality of the previous two. Equinix Admin & Reseller users can use both the Sub account and Organization Impersonation features. This feature lets you view as different organizations or accounts of their own organization.
- Equinix Admin: These users are not resellers, but Equinix employees who have accounts.