Vendor QA from INL 8-29-24.xlsx
XLSX spreadsheet 19 KB Posted
- Attached to
- INL Colombia Firewalls & Switches
- Solicitation number
- 191NLE24Q0125
About this file
This document appears to be a Question and Answer (Q&A) related to a federal contract opportunity for the purchase of firewalls and switches for Colombia's Attorney General's Office (FGN) Department of Communication Interception (DIC)- Esperanza.
The key details are:
- The procurement is being conducted by the Department of State Office of Acquisition Management on behalf of the Drug Enforcement Administration (DEA) in Bogota.
- The equipment will support the Colombian Judicial Wire Intercept Program (JWIP) and is funded by Andean Reimbursable Funds.
- The Q&A covers topics such as delivery, implementation, support, configuration, and integration requirements for the Cisco and Palo Alto firewalls and switches.
- The solicitation has a submission deadline of 9/5/2024 for proposals.
- The procurement is set aside for small businesses, with NAICS codes ranging from 150-750 employees.
- The government is seeking quotes on specific hardware and services, but the pricing is intended as a baseline and vendors can provide their own proposed pricing.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SOW Firewalls and Switches for FGN Esperanza _ PR12659668.docx | DOCX document | |
| IGCE Firewalls and Switches_PR12659668 Pricing Template for Vendors.xlsx | XLSX spreadsheet | |
| SOW Firewalls and Switches for FGN Esperanza _ PR12659668.pdf | ||
| JOFOC APPROVED_Redacted.pdf | ||
| 191NLE24Q0125_Redacted.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| INL Colombia Firewalls & Switches - Questions and Answers | |
| Vendors Questions | Government's Answers |
| Regarding the equipment delivery, does the shipment need to be consolidated to a location specified by the DEA, or can we ship to our offices and from there distribute the equipment to the respective sites in Colombia? | The delivery destination for this equipment will be one site within Colombia. Either INL or DEA can distribute to the final user. |
| What type of implementation needs to be carried out? | Assistance with the implementation of the firewalls will be required at locations within Bogota, Barranquilla, Cali, and Bucaramanga |
| What kind of tool should be used or provided for 24/7 support? Or does the DEA already have a tool that we need to integrate with (Cisco and Palo Alto)? | All devices on this order will be monitored via SNMP alerting. Should support be needed, the standard for support must comply with that of the manufacturer. Platinum support (PAN-SVC-PLAT-1410 and PAN-SVC-LAT-1420 for all palo alto products and services. SNTC-8X5XNBD C9300 48p and SNTC-8X5XNBD Catalyst 24P Technical support for Cisco products |
| Is there any integration required beyond setting up the equipment, or is it just a simple configuration? | Yes. Integrations beyond the setting up of equipment will be required. |
| Is there any priority in terms of implementation? | Yes. Implementation at 6 different locations will be coordinated after all materials have been received. |
| Are we going to have remote access to the equipment once it is implemented to perform the configurations? Is there a priority for the locations regarding the implementation, or can we suggest a flexible implementation timeline for each office? | Temporary remote access to the equipment will be provided by end user after a technical support ticket has been opened. The temporary access will be controlled by the end user and will be enabled for the support team for the duration of the support mission. Once the support mission is successfully completed the access will be terminated. Should the end user feel that remote support is taking too long, they have the right to terminate access until the support team has a solution that needs to be implemented. In NO WAY, will permanent remote access be given. The priority for implementation will be established by the end-user after the materials have been received. |
| You mentioned needing a spare; where should we keep that spare equipment, and does it need to be sorted as RMA? | It will be stored at the end user facility. This will not be stored at INL or DEA facilities. |
| Additionally, you mentioned that you currently have Cisco and Palo Alto equipment. Is this a hardware refresh? If so, do you want us to replicate the same configuration? | This is a hardware refresh. The configurations may use the existing configurations from Cisco firewalls as a basis for the configurations for the palo altos firewalls. This will not be replicated exactly due to the different types of original and replacement equipment that will be used. The end user has network engineers that configure the Cisco devices. The |
| You also mentioned a location for the entire delivery. Does this mean that DEA will handle the delivery of the appropriate equipment to each location listed in the document? Or do we need to consolidate everything there and then assist with logistics and transportation to each facility? | The delivery destination for this equipment will be one site within Colombia. Either INL or DEA can distribute to the final user. After which, once the equipment is configured appropriately and tested and the end user facility, the delivery to the end point will be part of the implementation mission. DEA will be part of the implementation team. |
| Is there an existing network topology for each of the sites? Can it be shared? | Yes. There is an existing network topology for each of the site. No it cannot be shared. |
| Can the installation and startup of both CISCO and PALO ALTO equipment be done in parallel? This would help optimize time and resources in each implementation. | Yes. The installation of Cisco and Palo Alto will be done in parallel. However, the parallel implementation of both technologies will be done at each individual location at different dates to be coordinated by DEA and end user once all materials have been delivered. |
| Is it possible for the client to have remote access to the equipment after the installation at each site for all configuration and commissioning activities? | Temporary remote access to the equipment will be provided by end user after a technical support ticket has been opened. The temporary access will be controlled by the end user and will be enabled for the support team for the duration of the support mission. Once the support mission is successfully completed the access will be terminated. Should the end user feel that remote support is taking too long, they have the right to terminate access until the support team has a solution that needs to be implemented. In NO WAY, will permanent remote access be given. |
| On what day and time can the physical installation of the equipment be carried out at each site? | This is dependent on when the materials are received by the end user. A schedule will be provided to the implementation team after the materials have been provided. The implementation team personnel, from the vendor selected, will have to provide details of the personnel working on the project and must sign non-disclosure agreements. |
| Is there a need for any special work permits, SST accompaniment, height course, safety study, or any other requirements at each of the sites? | The vendor selected, if they are providing the implementation team and the support team, must provide certifications that comply with the high standards of Palo Alto Platinum support and the SNTC support type from Cisco. Additionally, the vendor selected must provide government identification (I.E. Cedula number), and proof of insurance for health and work for the workdays they are being assigned to work. Injury and personal liability is the responsibility of the vendor and their employees. |
| Are the rack units, power outlets, and all other necessary resources available for the installation of the equipment at each site? | yes. |
| Is there any logical design for the solution to be implemented, such as integrations, specific configurations, addressing, among others? | Yes |
| Will there be remote access to the equipment at each site after the implementation for support and updates? | Temporary remote access to the equipment will be provided by end user after a technical support ticket has been opened. The temporary access will be controlled by the end user and will be enabled for the support team for the duration of the support mission. Once the support mission is successfully completed the access will be terminated. Should the end user feel that remote support is taking too long, they have the right to terminate access until the support team has a solution that needs to be implemented. In NO WAY, will permanent remote access be given. |
| Are semi-annual or annual physical and logical maintenance required for the equipment that will be installed? | Yes |
| Do the devices have a direct support contract with the manufacturer? | No. Any updates to software and firmware will be downloaded and implemented by the end user and may need additional support which will be initiated with a support ticket. |
| Please specify what configurations should be made on the switches. | The configuration of the switches will be implemented by the end user, who in turn, may ask for help from the vendor for technical support. The maintenance and control of these configurations will be the responsibility of the end user NOT THE VENDOR. |
| Please specify what additional services are required for the installation of the switches, such as combing, labeling, rack organization, additional patch cords that should be included in the proposal. | Combing, labeling, rack organization will be part of the implementation teams tasks. Patch cords are not included as a separate line item in the proposal Should the vendor provide patch cords as part of the implementation of the procured systems at no additional cost to the government that is a decision left up to the vendor. |
| What is the timeline for the implementation services of the CISCO devices in their entirety for all sites? | This is dependent on when the materials are received by the end user. A schedule will be provided to the implementation team after the materials have been provided. The implementation team personnel, from the vendor selected, will have to provide details of the personnel working on the project and must sign non-disclosure agreements. |
| Can the Government please clarify the NAICS code for this Total Small Business Set-Aside? The SF1449 mentions 250 employees (which we assume is 423430). In FAR 52.212-1 on page 33, it mentions 150 employees under the VAR Exception (footnote 18) under 541519. Yet again in SAM.Gov, the NAICS mentioned is 314419 which is 750 employees. | XXXXXX This is not a technical question and should be answered by someone in INL XXXXX |
| Can the Government please explain the pricing provided in Statement of Work, Section 2 – Technical Specifications, Line Items 3-7 on p.2? | This is pricing that is used as a baseline from quotations that were provided. The vendor is free to change the pricing in their proposal. However, please note that price is a key evaluation factor in a competitive bid. |
| Can the Government please clarify Section 3 – Delivery with regards to U.S. purchase on p.6? If items are purchased in the U.S. and shipped to Goldbelt in Miami, Florida, the Government would qualify for a Government or ‘Gov’ exemption under ITAR only if the Government takes responsibility for the remaining leg of the transport. Does the Government expect these provisions mentioned under ‘foreign procurement’ below to apply to U.S. purchases as well?: | XXXXXX This is not a technical question and should be answered by someone in INL XXXXX |
| If the Government intends U.S. purchases to be routed through Goldbelt and the vendor retains responsibility for delivery to a foreign Government entity, the Government or ‘Gov’ exemption would not apply under ITAR unless there is a bi-lateral Memorandum of Agreement or treaty. Has advanced coordination been made with State-DDTC to assure that export approvals will be assured for the 30-day delivery window required (mentioned on p.5)? | XXXXXX This is not a technical question and should be answered by someone in INL XXXXX |
| Where will the equipment physically reside: U.S. Diplomatic Mission, Colombian Ministry or third-party location? | The equipment will reside in server racks under the Colombian government's control. |
| What operational mode does the Government plan to use the M-300 in; Panorama mode, Management mode or log mode? | This will be determined once the vendor is selected and the implementation team has been identified. The end user will make the determination during the implementation plan meetings. |
| If the M-300 will be operating in Panorama mode or log mode and will be receiving the logs from the attached firewalls, is the default storage sufficient for the load or is additional storage required? | Default storage is sufficient. |
| Can the Government please confirm whether the HA pairs will be active/passive or active/active? | active/passive |
| Does the Government require that the Firewalls and Panorama operate in FIPS mode? If so, do corresponding FIPS kits (PAN-FIPS-KIT-1RU) need to be provided with this procurement? | No and No. |
| Palo Alto Networks offers a US Government support tier, Premium U.S. Government support (https://www.paloaltonetworks.com/resources/datasheets/us-government-support-services), used for most U.S. Government hardware purchases. The Platinum support described in the BOM does not meet all requirements that the U.S. Government has. Can the Government confirm that U.S.-Government-aligned support is not needed and that the requested Platinum Support tiers are required? | The support tier selected is sufficient for this procurement. Platinum support (PAN-SVC-PLAT-1410 and PAN-SVC-LAT-1420 for all palo alto products and services. |
| 2) Line item #17, "Configuration, Migration and Local Support Service for Firewalls" is listed as "(1) Base Year plus (2) Option Years" versus a more defined initial deployment POP or SOW. Can the Government clarify the support needed with a more detailed SOW as opposed to the current wording which implies dedicated support of these tasks for the full term listed? Can the Government clarify what support is expected after the configuration and migration is completed to scope the level of effort expected? | Platinum support (PAN-SVC-PLAT-1410 and PAN-SVC-LAT-1420 for all palo alto products and services. Is the support tier that is required for the initial base year. Additional years of support will be part of a separate procurement. Option years is so the government can continue the support and maintenance with the vendor selected for 2 additional years without re-competing. |
| There is a reference to migration. Can the Government clarify what Hardware we are expected to migrate from? | Cisco ASA firewalls to Palo Alto firewalls. |
| Can the Government clarify, is this a greenfield deployment or is this a migration from legacy equipment? | Migration from legacy equipment. |
| If this is a migration from legacy equipment, can the Government please provide the following details about the legacy solution: |
| • | Number and devices by Vendor | |
| • | Any VSYS sources on legacy devices to be migrated | |
| • | Total number of security policies, NAT policies, and IPSec VPNs | |
| • | Total number of address/address group objects | |
| • | Total number of service/service group objects | This will be provided to the implementation team upon vendor selection and contract award and once non-disclosure agreements have been signed. |
| With the requested virtual system upgrade on the PA-1420 systems, is support for the configuration of these virtual systems needed as a part of the "Configuration, Migration and Local Support Service for Firewalls"? | Yes | |
| Can the Government clarify whether all "Configuration, Migration and Local Support Service for Firewalls" support must be provided on-site, at each location or if some functions may be made via telephone or remote? For instance, does configuration and migration need to be on-site while cutover support can be remote? | Some functions may be provided via telephone or remote. However, if the end user determines that this support does not resolve the issue than on-site support must be provided. Configuration, migration, and cutover will be conducted by the implementation team and is expected to be on-site. | |
| Regarding "Configuration, Migration and Local Support Service for Firewalls", can the Government please further define "incident support" requirements? | The resolution to any incident identified that impacts the expected mission critical functionality of the equipment. To include, but not limited to, replacement parts, replacement part installation, problem identification, troubleshooting, configuration, routing conflicts, nat conflicts, rule conflicts, high availability assurance, and any other issues caused by faulty hardware provided by manufacturer, misconfiguration by the implementation team, or erroneous support. | |
| Do Professional Services have to be exclusively on-site or can it be remote? NOTE (Don't Submit): Covered in question 7 in this section | It does not have to be exclusively on-site. The type of support will be determined by the end user when the support ticket is established and the task is determined. | |
| Do Professional Services need to be provided with any specific language requirement, whether by an English-speaker, a Spanish-speaker or any other language requirement? | Spanish speaker is preferred by the end user US government assigned engineers assisting prefer English. Implementation planning and execution is expected to be conducted in Spanish. | |
| What is the site address (for example, if using US Federal consultants, there may need to be a risk/threat brief and leadership approval depending on the exact location in Colombia)? | No site address will be provided until the vendor is selected. All sites have multiple layers of security and the Colombian government and US government personnel will escort the vendor to the facilities at each location. | |
| Is there a security clearance (US Government or other) requirement to support the deployment? | A list of personnel working on the project, once the vendor is selected, will need to be provided with a corresponding government identification. For any Colombian employee assigned to the project their cedula number will need to be provided. | |
| Is Citizenship a requirement to provide support? US Citizenship, Colombia citizenship or other? | Local support provided in Colombia must reside and be a citizen of Colombia. | |
| Is support needed for configuring the components of the Core Security Subscription Bundle, including advanced threat prevention, URL filtering, DNS, GlobalProtect, etc., or other firewall features, such as SSL Decryption, identity provider integration, etc.? | Yes | |
| Do you want dual power supplies? | Yes | |
| Do you want stack cables or stack modules? | No | |
| On the C9300s ( the last 2) do you need uplink modules (1G, 10G, 25G, 40G are the options)? | For the Cisco C9300 an 8 port Module with 8 (eight) 10 Gigabit Ethernet modules will be needed. |
File details come from the government source that posted it. Updated .