Section_J_Attachment_11_SDN_Environmental_Document.pdf

For Official Use Only

Joint Service Provider

Enterprise Environment Document

General Overview

3/20/2018 General Overview 1

Table of Contents

1. Introduction

2. Communications facilities

3. Network Ports

4. VRF’s/VLAN’s

5. Capacity

6. End Points

7. Lab Space

7.1 Lab Usage

7.2 Lab Physical Characteristics

8. Devices logging in to SIEM

9. Firewalls within Infrastructure

10. Load Balancers

11. Inspections per Year

12. Applications and Tools

13. Workload Data

11. Customer Organizations

List of Tables Table i - Network Users Table ii - Network Users Table iii - Network Enclaves Table iv - End Points Table v - End Points Table vi - Firewalls within Infrastructure Table vii – Load Balancers Table viii - Inspections per Year Table ix - Applications and Tools Table x - End Point Workload Data Table xi- OSD Customer List Table xii– Transport Customer List Table xiii– Customer Locations Table xiv– Remote Access Table xv– Partners

3/20/2018 General Overview 2

Disclaimer: All information contained in this document is historical information that is being provided by JSP to give Offerors a better understanding of the existing environment and requirements.

1. Introduction Currently, JSP is at a "crossroads"; working to meet the needs of an increasingly mobile, application centric knowledge workforce with a mix of antiquated processes, infrastructure, systems along with the latest technology and tools creates significant operational inefficiencies within the organizational business model. Some of the major challenges.

Continuous service disruption cycles; lack of visibility to view and correlate performance and trends; labor intensive data center management and service provisioning; manual cyber/operations incident response program adding increasing reaction and investigation times;

reliance on obsolescent non-iterative "waterfall" design and project management methodologies.

Difficulty fusing enterprise resource planning activities to support information technology asset lifecycle management for strategic and operational planning; lack of an integrated information technology service management system and the use of email as a workaround; duplicative engineering, operations and cyber security functions, deploying new systems and implementing change within a silo; increasing operating expenses.

A large disparate technical workforce struggling to introduce innovation and best practice to achieve organizational objectives; minimal use of analytic tools capturing customer data and trends creating an over reliance on error prone spreadsheets and presentations to visualize business and operational information; immature collaboration capabilities to promote continuous communication;

To stave off obsolescence, JSP must transform its infrastructure to reflect a service based architecture leveraging cloud computing and information technology as a service framework.

JSP must meet the challenges of providing services to the Pentagon based Components in an increasingly complex, regulated environment.

This document provides an overview of the Joint Service Provider (JSP) environment. JSP operates within a complex and dynamic environment so all information contained in this document reflects JSP’s best estimates and is subject to change.

2. Communications facilities

Table i defines the number of rooms with transport equipment. Future consolidation efforts will consolidate to three (3) 40 Gb capable physical Installation Processing Node locations within the Pentagon Reservation.

3/20/2018 General Overview 3

Table i - Network Users

ID Facility Type Quantity B. Telecommunication Closets 745 C. Consolidated Server Rooms 10

3. Network Ports Table ii defines the approximate number of ports within the JSP environment that is supported within JSP. This figure represents the base level of support and does not include the potential increase due to projects or the addition of new customers.

Table ii - Network Users

ID User Group Users A. Pentagon 140,000 B. Wedge 0 32,371 C. Wedge 1 20,056 D. Wedge 2 21,670 E. Wedge 3 18,997 F. Wedge 4 24,250 G. Wedge 5 20,938 H. User Ports 80,000 I. Data Center Ports 60,000

4. VRF’s/VLAN’s Table iii identifies the approximate number of VRF’s and VLAN’s routed within the Pentagon.

Each VRF routes through a COI firewall instance. As the Joint Regional Security Stack (JRSS) Project progresses; the number of VRF’s and VLAN’s are expected to decrease.

Table iii - Network Enclaves

ID Responsibility Quantity A. VRF’s 326 B. VLAN’s 4250

3/20/2018 General Overview 4

5. Capacity

Table iv identifies average capacity information for the telecommunication closets. The current average bandwidth utilization between various L2/L3 domains is 6-8 Gb. The current average bandwidth utilization to other DoD locations/internet is 1.5 Gb.

Table iv - End Points

ID Capability Quantity

A. 10/100/1000Mbps RJ-45 Copper customer Ports 100

B. Pluggable optical customer ports 10

C. Workstations supported through VOIP phones 64

D. Printers 22

6. End Points Table v identifies the approximate number of end points currently within the JSP environment by asset type. These figures represent the user base identified in Section 2.0, Network Users.

Table v - End Points

ID End Point Quantity A. Workstations 40,000 B. Stand-alone workstations 100 C. Network devices 6,000 D. Servers 4,000 E. Telephones 50,000 F. VTC NIPR end points 366 G. VTC NIPR MOVi accounts 131 H. VTC SIPR end points 532 I. VTC JWICS end point 1 J. HP printers 263 K. Xerox printers 619 L. Local printers 687 M. Plotters 51

N. IPTV 300

O. Wireless APs 300

3/20/2018 General Overview 5

7. Lab Space

The JSP test lab provides a controlled environment for the full range of testing required throughout the project life cycle — from experimenting with the technology through fine-tuning the rollout process.

7.1 Lab Usage

The Offeror will be authorized to utilize the JSP lab to test the solution in a JSP like environment. The Offeror shall document their requirements for the lab, (ie. Racks space, connectivity, power, etc.), and upon JSP approval will be granted access to utilize the JSP Lab Environment during the period of performance of the contract. Once the concept is proven in the lab, JSP expects the lab equipment to become part of the final provided solution so JSP has a way to test changes beyond the scope of the period of performance.

7.2 Lab Physical Characteristics

Pentagon – 1B466 The physical dimensions of the facility is 40’x22' /880 sq ft of Communications Room complete with Computer Room A/C 15 ton unit and SIPR rated containership. Mainly dominated by 2 rack rows of networking equipment and 8 stations available for work.

Taylor Bldg – 3508 3 rooms (Room 1/80' X 34'); (Room 2/22' X 12'); (Room 3/36' X 27')

8. Devices logging in to SIEM Historically, JSP has not had SIEM visibility on all devices on NIPR/SIPR. The offeror shall plan on the solution sending SYSLOG data into ArcSight and/or Splunk. The SYSLOG data shall provide all relevant data for security log event correlation. The solution shall provide the capability to send SYSLOG data from all devices and JSP will have the ability to turn on/off as needed.

9. Firewalls within Infrastructure The firewall infrastructure in JSP is a tier infrastructure where the one below feeds the one above. Table vi identifies the type and number of firewalls within the environment. Each VRF routes though a COI firewall instance.

Table vii - Firewalls within Infrastructure

3/20/2018 General Overview 6

ID Firewall Type Quantity

A. Boundary 1

B. Service Agency 7

C. Community of Interest 25 different firewall contexts

10. Load Balancers Table vii defines the number of F5 Cisco Load Balancers within the network.

Table vii – Load Balancers

ID Inspection Quantity

A. Load Balancers within the Unclassified Network 52

11. Inspections per Year JSP is subject to inspections from higher headquarters. Most of these inspections are planned in advance. However, JSP is subject to no notice compliance inspections. Table viii defines the number of inspections per year that affect the enterprise. However, that number of inspections is variable, with the expectation that the contractor is required to provide support for all inspections. This capability must be kept inspection ready in accordance with the Risk Management Framework (RMF).

Table viii - Inspections per Year

ID Inspection Quantity A. Inspections per year that affect the enterprise 4

12. Applications and Tools Table ix identifies the list of applications and tools that are currently in use within the NETMOD space. These tools are available as Government Furnished Property (GFP), with the maintenance of the tools addressed under the DCO IDM contract under the cost reimbursable ODC CLIN.

3/20/2018 General Overview 7

Table ix - Applications and Tools

ID Application A. ArcSight B. ArcSight Loggers

C. Assured Compliance Assessment System

(ACAS)

D. Axway OCSP E. Bivio F. BlueCoat Proxy G. BMC Atrium Discovery and Dependency

Mapping (ADDM) H. BMC Bladelogic Network Automation (BBNA)

I. BMC ITSM

J. BMC ITSM Midtier K. BMC Knowledge Management L. Cisco ACS M. Cisco CSM N. Data Orchestrator O. Dell one identity management suite P. F5 Enterprise Manager Q. Fidelis CommandPost R. Fidelis SSL (Bluecoat) S. Gigamon GigaVUE Fabric Manager T. Host Based Security System (HBSS)

U. HP SMS

V. IBM Endpoint Manager (BigFix)

W. IBM Netcool Operations Insight Network Management (ITNM)

X. IBM Netcool Operations Insight Operations Management (Omnibus)

Y. IBM SmartCloud Application Performance Management (ITM)

Z. IBM SmartCloud Control Desk (CM Integration)

AA. IBM Tivoli Application Dependency Discovery Manager (TADM)

BA. IBM Tivoli Business Service Manager (TBSM) CA. InfoVista Cockpit DA. InfoVista IV Server

3/20/2018 General Overview 8

ID Application EA. InfoVista VistaDiscovery FA. InfoVista VistaMart GA. InfoVista VistaPortal 360 HA. Inquest IA. Inquest Manager JA. Intrust enterprise edition

KA. IP SLA

LA. ITPIE

MA. JUNOS Space

NA. KVM

OA. Lancope PA. Lancope SMC QA. Microsoft Active Directory RA. Microsoft DNS SA. Microsoft File Share TA. Microsoft RDWeb UA. Microsoft Remote Desktop System (RDS)

VA. SCCM

WA. Microsoft SQL Server XA. Oracle RDBMS YA. Palo Alto Panorama ZA. PlanetIT AB. Quest one privileged access suite for unix BB. Quest one privileged password manager CB. Redseal DB. RHEL Satellite EB. SourceFire FB. Sourcefire Defense Center GB. Standard appliance hardware HB. SteelCentral AppResponse Appliance IB. SteelCentral AppResponse Director JB. SteelCentral AppResponse VMON KB. SteelCentral Flow Gateway LB. SteelCentral NetProfiler MB. SteelCentral NetShark (virtual) NB. SteelCentral NetShark Appliance OB. SteelCentral Packet Analyzer PB. SteelCentral Transaction Analyzer

3/20/2018 General Overview 9

ID Application

QB. SteelCentral Transaction Analyzer Packet Trace Warehouse

RB. Storage Area Network SB. VDI Client (SecureView) TB. Veeam UB. VMware Vcenter VB. VMware Virtual SAN WB. Windows Server Update Services (WSUS) XB. OPSWAT Metascan YB. Splunk ZB. WireShark AC. NetCool BC. Guidance Software - Encase

13. Workload Data The Workload data provided below is intended to provide context as to the activities and recurrence of those activities by functional area. This information is provided on a historical basis and is intended to be used as reference for Offerors in developing their staffing mix by functional area.

Table x - End Point Workload Data

ID Category Historical Value

Measurement Interval

A. Ports Provisioned varies weekly B. VRF’s Created 15 weekly C. VLAN Changes 50 weekly D. Moves/Add’s/Changes (MAC’s) 350 weekly

E. Firewall Changes

Request, comprising of an average of 500 lines weekly

F. ASI’s per week 25 Weekly

3/20/2018 General Overview 10

11. Customer Organizations JSP supports a wide range of customers, including OSD components, HQDA, JS, OAA, WHS Directorates, National Guard Bureau, the Fourth Estate, and the PFPA.

11.1 Office of the Secretary of Defense

The Secretary of Defense exercises authority, direction, and control over the DoD, in part, through the Heads of the OSD Components, who also serve as Principal Staff Assistants (PSAs), per DoD Directive (DoDD) 5100.01, “Functions of the Department of Defense and Its Major Components.”

OSD is comprised of several components that are responsible for (1) providing unclassified and classified mission application development and support and (2) primary user initial contact and general client-side support. These components require common IT support for their mission applications. A list of OSD customers is included in Table xii.

Table xi- OSD Customer List

ID. Organization Description

A.

Under Secretary of Defense for Acquisition, Technology, and Logistics

PSA and advisor to the SecDef and Deputy Secretary of Defense (DSecDef) for all matters relating to the DoD Acquisition System; research and development; modeling and simulation; systems engineering; advanced technology;

developmental test and evaluation; production; systems integration; logistics; installation management; military construction; procurement; environment, safety, and occupational health management; utilities and energy management; document services; and nuclear, chemical, and biological defense programs.

B. Under Secretary of Defense for Policy

PSA and advisor to the SecDef and DSecDef for all matters on the formulation of national security and defense policy, and the integration and oversight of DoD policy and plans to achieve national security objectives.

C.

Under Secretary of Defense (Comptroller) /Chief Financial Officer (CFO)

PSA and advisor to the SecDef and DSecDef for budgetary and fiscal matters, including financial management, accounting policy and systems; budget formulation and execution; contract audit administration and organization;

the Managers' Internal Control Program; and general management improvement programs; also the chief financial management advisor to SecDef.

3/20/2018 General Overview 11

D.

Under Secretary of Defense for Personnel and Readiness

PSA and advisor to the SecDef and DSecDef for Total Force management; National Guard and Reserve Component affairs; health affairs; readiness and training; military and civilian personnel needs; language; education of dependents;

equal opportunity; morale, welfare, and recreation; and quality-of-life matters.

E.

Under Secretary of Defense for Intelligence

PSA and advisor to the SecDef and DSecDef on intelligence, counterintelligence, security, sensitive activities, and other intelligence- related matters.

F.

DoD Chief Management Officer

(DCMO)

PSA and advisor to SecDef and DSecDef on matters relating to the management and improvement of DoD business operations.

G.

Assistant Secretary of Defense for Legislative Affairs

PSA and advisor to SecDef and DSecDef relations with members of the U.S. Congress and has the principal duty of overall supervision of DoD legislative affairs.

H.

Assistant Secretary of Defense for Public Affairs

PSA and advisor to SecDef and DSecDef for DoD news media relations, public liaison, internal communications, community relations, public affairs and visual information training, and audiovisual matters.

I. DoD Chief Information Officer

PSA and advisor to the Secretary of Defense for information technology (IT), including national security systems and defense business systems, and information resources management (IRM) matters. The DoD CIO is responsible for all matters relating to the DoD information enterprise, including communications, spectrum management, network operations, information systems, cybersecurity, positioning, navigation, and timing (PNT) policy, and the DoD information enterprise that supports DoD command and control (C2).

J. The General Counsel DoD

PSA and advisor to the SecDef and DSecDef for defense-related legal issues; chief legal officer for DoD.

K.

Director of Operational Test and Evaluation

PSA and advisor to SecDef and DSecDef for operational test and evaluation and live-fire test and evaluation matters.

L. Inspector General DoD

PSA and advisor to SecDef and DSecDef on all audit and criminal investigative matters and for matters relating to the prevention and detection of fraud, waste, and abuse in the programs and operations of the DoD.

M.

Assistant to the SecDef for Intelligence Oversight

PSA and advisor to SecDef and DSecDef for Intelligence Oversight; independent oversight of all intelligence, counterintelligence, and intelligence-related activities in DoD; inspects to ensure that all intelligence activities

3/20/2018 General Overview 12 conducted by any of the DoD Components comply with Federal Law, Executive Orders (EO), Presidential Directives, Intelligence Community Directives, and DoD Issuances.

N.

Director of Cost Assessment and Program Evaluation

PSA and advisor to SecDef and DSecDef and other senior DoD officials for providing independent analysis and advice;

DoD cost estimation and cost analysis processes; providing accurate information and realistic estimates of cost for DoD acquisition programs.

O. Director of Administration

PSA and advisor to SecDef and DSecDef on DoD-wide administration, organization, and management; executes responsibilities supporting SecDef and DSecDef; DoD;

OSD; Defense Agencies; DoD Field Activities; and the Pentagon.

P. Director of Net Assessment

PSA and advisor to SecDef and DSecDef on net assessment matters.

Q.

DoD Consolidated Adjudications Facility

(CAF)

Consolidates Army Facility Management Office, WHS, Joint Chiefs of Staff, Army Central Clearance Facility, Navy CAF, US Air Force CAF, Defense Industrial Security Clearance Office and Defense Office of Hearings and Appeals info one DoD CAF Facility and IT infrastructure located at Ft. Meade, MD.

11.2 Headquarters, Department of the Army

Headquarters, Department of the Army (HQDA) is the executive part of the Department of the Army at the seat of Government. It is the highest level headquarters in the Department and exercises directive and supervisory control over it. HQDA is composed of the Office of the Secretary of the Army; Office of the Chief of Staff, Army; the Army Staff; and specifically designated staff support agencies.

11.3 Joint Staff

The Joint Chiefs of Staff consist of the Chairman, the Vice Chairman, the Chief of Staff of the Army, the Chief of Naval Operations, the Chief of Staff of the Air Force, the Commandant of the Marine Corps and the Chief of the National Guard Bureau.

11.4 Office of the Administrative Assistant

The Office of the Administrative Assistant (OAA) manages Headquarters, Department of the Army resources, provides information technology services to the greater Pentagon community, and manages the Army’s historical and heraldry programs. OAA also provides Army publishing

3/20/2018 General Overview 13 and visual information services, records management, security and safety, and religious services for a diverse customer base.

11.5 Washington Headquarters Services

WHS is aligned under the Director of Administration (DA) and provides a wide range of administrative services to OSD, DoD agencies, and offices in the NCR. JSP supports all IT needs for WHS, which is organized into several directorates and specialty offices, and are included in Table xiii.

11.6 Pentagon Force Protection Agency (PFPA)

PFPA is a civilian Defense Agency within the DoD charged with protecting and safeguarding the occupants, visitors, and infrastructure of the Pentagon and other designated Pentagon facilities.

11.7 Customers using JSP Transport Services

The following customers use JSP Transport services only:

Table xii– Transport Customer List

ID. Organization Description

A. Department of the Air Force

Headquarters Air Force to include Secretary of the Air Force Office

B. Department of the Navy

Department of the Navy to include Secretary of the Navy office, DON CIO. and Headquarters United States Marine Corps

C. HQMC To include the Commandant of the Marine Corps and Headquarters offices.

D. Combatant Commands All Combatant Commands are supported.

E. DISA Defense Information Systems Agency F. DIA Defense Intelligence Agency

12.0 Customer Locations

Customers are primarily located throughout office suites in the National Capitol Region (NCR), but support is provided worldwide. Many of these locations include security levels from Unclassified to Open Storage Secret and Top Secret Sensitive Compartmented Information Facility (SCIF). Customer locations are included in Table xiv.

3/20/2018 General Overview 14

Table xiiiii– Customer Locations

Location Assets Buildings Suites

Alexandria, VA 28742 10 38

Arlington, VA 10297 38 345

Beltsville, MD 87 1 1

Chantilly, VA 6 1 1

Delaware 14 1 1

Elkridge, MD 15 1 1

Fairfax, VA 62 2 4

Falls Church, VA 1003 5 18

Fort Meade, MD 313 3 2

Frederick, MD 117 2 3

Ft Belvoir, VA 317 1 3

Lorton, VA 21 1 1

McLean, VA 373 2 7

Silver Spring, MD 7 1 1

Springfield, VA 138 1 2

Undisclosed 1526 N/A N/A

Washington, D.C. 30522 14 626

Woodland Hills, VA 2 1 1

13.0 Other Important information

13.1 Required Technology Support

JSP implements and supports DoD directed technologies, to include vulnerability assessment products, security boundary devices, and more. Some of these products require a specific operating system such as Microsoft, Red Hat Enterprise Linux (RHEL), and UNIX to properly function. These common operating systems are needed in order to support the implementation and maintenance of technologies (e.g., Assured Compliance Assessment Solution (ACAS)).

3/20/2018 General Overview 15

13.2 Change Management

JSP’s has an SOP for change management. The offeror should be aware of some basic requirements for the process:

• Changes require at least one weeks’ notice to implement. This that have customer impact may require up to three weeks’ notice to allow for customer concurrence.

• Changes normally occur between 2000 – 0400. Changes that exceed an ASI window change to unscheduled outages.

• Periods of Non-disruption can occur 2-4 times per month to support critical missions. The POND can impact one or more parts of the network.

• Changes are not authorized until approved by operations.

13.3 VPN/Citrix Access

End users remotely access JSP’s network for regularly and unscheduled telework. The table below depicts the average number of remote access connections into JSP’s network.

Table xiv– Remote Access

ID. Description Average Number A. Average daily remote access connections 2500

B. Average remote access connections on days the government is closed 8800

C. Expected growth for remote access connections 5000

13.4 Cable Plant Changes

All cable plant changes must be approved and completed by JSP’s Inside Cable Plant Team. If cable plant changes/additions are required, please plan on 90 day minimum lead team for these changes.

13.5 SOPs

JSP has SOPs for many of their processes and relevant SOPs will be provided as part of the bidder’s library. However, the offeror should note that JSP is constantly maturing its processes and these documents are constantly changing to reflect the latest processes and procedures.

13.6 Installation Processing Node

The Pentagon serves as an Installation Processing Node (IPN) to provide local compute and storage services for Pentagon tenants. Compute and Server resources are supported out of multiple Consolidated Server Rooms (CSRs) within the Pentagon Reservation and MAN

3/20/2018 General Overview 16 connected locations. There are two current configurations for CSR connectivity within the Pentagon Reservation. For legacy un-renovated CSRs there are dedicated physical switch hardware that uplinks through a physical interface in the Wedge router to the CSR. For upgraded IPN locations connectivity is uplinked directly through the Network Access Points (NAPs), and utilizes EVPN for extending connectivity and allowing virtual servers to move across IPN locations. Within the Pentagon reservation, CSRs currently exist in Wedges 0, 1, 2, 4, and 5. In addition, the Mark Center, Target Site 1, and Target Site 2 host CSRs that are accessible over the Metropolitan Area Network (MAN). Of note, both Target Site 1 and Site 2 are supporting synchronous replication of data between the Pentagon Reservation assets.

13.7 Metropolitan Area Network

The MAN currently extends Pentagon services to the following strategic locations: Mark Center, Joint Base Anacostia Bolling (JBAB), Ft Belvoir, Ft. Myer, Crystal City, and Rosslyn and others in accordance with environmental documents. The Pentagon’s MAN connectivity overlaps DISA optical connectivity in two locations outside of the Pentagon – JBAB and Ft Belvoir.

This overlapping connectivity is intended to provide uninterrupted network connectivity to all MAN locations in the event that both Pentagon Network Access Points (NAPs) are unreachable.

13.8 Joint Regional Security Stacks

The Pentagon has three (3) Network Access Points (NAPs) which are geographically dispersed between the Pentagon Reservation and an external location. A project is currently underway to transition services from the NAPs to the DISA provide Joint Regional Security Stack (JRSS).

The three NAPs are geographically dispersed between the Pentagon Reservation and an external location. A project is currently underway to transition services from the NAPs to the DISA provide Joint Regional Security Stack (JRSS). More details about this migration can be found in the Pentagon JRSS Implementation Plans.

13.9 Cabling Considerations

The current cable plant is primarily a mix of ISO-11801 OM1 (62.5/125 μm) and OM2 (conventional 50/125 μm) cables. An export from our current configuration management system will be provided that details the existing cable plant. The OOB for software defined or centrally configured solutions will require an active OOB network that is redundant and survivable.

Within current OOB infrastructure today, configuration is accomplished via in-band and/or out of band channels.

13.10 Supply Chain Risk Management

Supply Chain Risk Management is a vital consideration in all DoD procurement actions. JSP procures all hardware and software in accordance with NIST Special Publication 800-161.

3/20/2018 General Overview 17

14.0 Partners

JSP must coordinate with several partners to ensure customer IT needs are properly supported. A summarization of those key relationships is included in table xvi.

Table xv– Partners

Organization Summary Description Defense Information Systems Agency (DISA)

Provides complementary IT services and capabilities in support of JSP consumer demand.

Security Agencies Provides physical and cyber threat indicators and warnings information. JSP must interact with various security agencies, including the Defense Intelligence Agency (DIA) and the National Security Agency (NSA).

PFPA Service delivery and sustainment (e.g. security for SCIFs, security for equipment).

WHS/AD Service delivery provider for both IT equipment purchases and contract labor purchases.

WHS/FSD Provides of service fulfillment when physical space needs to be modified (e.g. SCIF set up, Office Moves).

WHS/FMD Provides financial purchase request support of JSP assets.

Current contractors interact with all of JSP’s partners and those entities from which JSP receives services.