25260036N-AZ_Addendum_1.pdf

INVITATION TO NEGOTIATION (ITN) – ADDENDUM No. 1

ADDENDUM POSTING DATE: PURCHASING CONTACT:

November 21, 2025 Amanda Zarko, Senior Procurement Agent Email: zarkoaz@scps.k12.fl.us; Phone: 407-320-0237

SOLICITATION TITLE & NUMBER: 25260036N-AZ

District Firewall Solution

SOLICITATION OPENING DATE & TIME:

January 5, 2026 at 1:00 PM EST

NOTE: SOLICITATIONS RECEIVED AFTER THE DUE DATE AND TIME WILL NOT BE ACCEPTED.

The following items are updated to reflect the revisions and are hereby incorporated into the bid documents, ITN NO.

25260036N-AZ, District Firewall Solution.

A. DUE DATE EXTENSION

The Due Date has been extended to January 5, 2026, at 1:00 PM EST.

B. The new 470 number is 260006411. 470 number 260004091 is cancelled.

C. THE FOLLOWING FORMS HAVE BEEN REVISED AND REISSUED IN THEIR ENTIRETY:

☐ EXHIBIT B, PRICE SCHEDULE

☐ ATTACHMENT A, TENTATIVE SCHEDULE

D. SCOPE OF WORK OR SERVICES

Section III of the RFP document, Scope of Work or Services has been revised and reissued in its entirety.

E. REQUEST FOR INFORMATION

Q1. Can you confirm whether the district prefers a specific firewall OEM vendor (e.g., Palo Alto, Fortinet, Cisco) or if equivalent solutions are acceptable?

A1. There is no specific OEM vendor required. Equivalent solutions that meet or exceed the listed specifications are acceptable.

Q2. Is this procurement intended to be E-Rate Category 2 eligible, and should pricing be structured accordingly?

A2. Yes. This procurement is intended to be E-Rate Category 2 eligible, and pricing must be structured to clearly delineate eligible and ineligible costs.

Q3. Will the awarded vendor be responsible for decommissioning and disposal of the legacy firewall equipment?

A3. No, this is not a mandatory requirement. Vendors may include this as an optional, separately priced service.

THE SCHOOL BOARD OF SEMINOLE COUNTY FLORIDA

PURCHASING AND DISTRIBUTION SERVICES DEPARTMENT

400 East Lake Mary Boulevard Sanford, Florida 32773-7127

Q4. Should the vendor include network design documentation (topology diagrams, configuration baselines, etc.) as a deliverable?

A4. Yes, network design documentation (topology diagrams, configuration baselines, etc.) is required as a final project deliverable upon successful deployment. Vendors should include preliminary diagrams to support their proposal's technical approach.

Q5. Are there any integration dependencies with existing systems (e.g., SIEM, Active Directory, MDM, or web filtering solutions)?

A5. Yes. The NGFW must integrate with our hybrid Active Directory (on-prem and MS Azure) for user identity awareness and policy enforcement. Refer to pages 5 and 6 of the ITN for detailed minimum requirements.

Q6. Can you provide the make, model, and current configuration of the existing firewall appliances to assess migration complexity?

A6. Existing appliances are Fortinet FortiGate 4400F. We have four appliances total: two at the ESC datacenter and two at the OHS datacenter.

Q7. What are the current WAN bandwidth capacities and uplink redundancy configurations at the ESC and OHS sites?

A7. Each firewall has a single physical 40Gbps connection to an SBSC-managed router that sits in inline between the firewalls and the ISP-managed equipment. At the start of service, the internet bandwidth will be 20Gbps at each data center.

Q8. Should the NGFW solution support SSL/TLS inspection, sandboxing, and DNS security capabilities as part of advanced malware protection?

A8. SSL/TLS inspection and sandboxing are listed on page 3 of the ITN. DNS inspection is not a specific requirement of advanced malware protection but may be included as part of a unified threat protection solution.

Q9. Are there any specific VPN types or remote access solutions currently in place (e.g., IPsec, SSL, GlobalProtect, AnyConnect) that must be migrated or integrated?

A9. Yes. The new solution must support the migration/re-establishment of three existing active Site-to-Site IPsec tunnels. It must also provide a client-based remote access solution to replace the current FortiClient SSLVPN, supporting the same user base and access requirements.

Q10. Do you require multi-tenant management or centralized policy orchestration between the ESC and OHS sites?

A10. No. Centralized policy orchestration between the ESC and OHS sites is not required. Each datacenter operates its firewalls primarily independently, though centralized reporting is required (refer to page 5 of the

ITN.

Q11. What level of logging and retention is required (e.g., 30 days local, 1 year offsite, SIEM integration)?

A11. The NGFW solution must support the generation of monthly reports as detailed on page 5 of the ITN, therefore, minimum log retention is 30 days.

Q12. What is the target go-live date or implementation window for this project?

A12. The target go-live date is no later than July 1, 2026.

Q13. Will there be designated maintenance windows during non-instructional hours for system cutover?

A13. Yes. All system cutover activities must be scheduled to occur during designated, non-instructional maintenance windows.

Q14. Does the district require a phased rollout (site by site) or a single coordinated deployment?

A14. Yes, the project requires a phased rollout. The OHS data center will be cut over followed by the ESC data center.

Q15. Are there any change management or approval processes (e.g., CAB review) that could impact the implementation schedule?

A15. All necessary approvals will be managed directly by the SBSC IT leadership team.

Q16. Should the vendor include temporary parallel operations between old and new firewalls during testing?

A16. Direct parallel operation is not a requirement. During cutover to the new firewalls, the existing firewalls will remain in place and available for immediate operation until full acceptance testing of the new solution is complete and successful.

The original Invitation to Negotiate (ITN) documents shall remain in full force and effect, except as modified herein, which shall take precedence over any contrary provisions in the prior documents. If you should have any questions regarding this addendum, please do not hesitate to contact Amanda Zarko, Senior Procurement Agent at zarkoaz@scps.k12.fl.us or by phone at 407.320.0237.

Sincerely, Jason Wysong, Ed.D.

Coordinator of Purchasing and Distribution Services

Attachment

Acknowledgment of Addendum 1 by Vendor:

This addendum shall be completed by the Vendor and returned with the submittal. If submittal has already been submitted, this addendum must be added to the submission in Vendorlink.

This is to acknowledge receipt of this addendum, which will become part of the ITN document.

NAME (TYPED OR PRINTED) TITLE

SIGNATURE VENDOR NAME

DATE PHONE NUMBER

25260036N-AZ District Firewall

ATTACHMENT “A”

ITN TENTATIVE SCHEDULE OF EVENTS - REVISED

Date Description Tuesday, October 28, 2025 RFP Posted Wednesday, October 29, 2025 Legal Advertisement Wednesday, November 5, 2025 Legal Advertisement

Thursday, November 6, 2025 Voluntary Pre-Solicitation Meeting Location: WebEx Online Meeting Time: 10:00 AM EST Meeting number (access code): 2318 750 7135 Meeting password: TJxwcH2mN84 WebEx Dial In: 415-655-0003

Friday, November 7, 2025 Question Deadline - due before 3:00 PM EST Submit via email to zarkoaz@scps.k12.fl.us

Friday, November 21, 2025 Addenda released

Friday, December 5, 2025 2nd Question Deadline (due to updated scope and price schedule) Due before 3:00 PM EST Submit via email to zarkoaz@scps.k12.fl.us

Monday, January 5, 2026 Submittals Due before 2:00 PM EST **Uploaded to Vendorlink Location: WebEx Online Meeting Meeting number (access code): 2308 184 2367 Meeting password: KZvPubHs982 WebEx Dial In: 415-655-0003

Tuesday, January 6, 2026 Committee to receive submittals

Monday, January 19, 2026 Evaluation Committee Short List Meeting (Public Meeting) Location: School Board of Seminole County, Florida Educational Support Center 400 East Lake Mary Boulevard, Conference Room 308 Sanford, Florida 32773 Time: Beginning at 1:00 P.M. EST WebEx Information:

Meeting number (access code): 2315 266 9419 Meeting password: JXhwaDMv733 Dial In: 415-655-0003

Tuesday, January 20, 2026 Short Listed Firms Notified

Thursday, January 29, 2026 Short Listed Firms Oral Presentations/Interviews

Oral Presentations before the Evaluation Committee Location: School Board of Seminole County, Florida Educational Support Center 400 East Lake Mary Boulevard, Conference Room 306 Sanford, Florida 32773 Time: Tentatively 9:00 A.M – 12:30 P.M. (TBD at Short List Meeting)

Tuesday, March 10, 2026 Board Approval of Contract

III. SCOPE OF WORK OR SERVICES.

Seminole County Public Schools (SBSC) seeks proposals for a comprehensive Next Generation Firewall solution, including the purchase, installation, testing, commissioning, and maintenance of three (3) firewall appliances with advanced malware protection. The deployment requires one Active/Active High Availability (HA) pair at the Education Support Center (ESC) data center and one standalone appliance at the Oviedo High School (OHS) data center. This turn-key solution must meet the District's evolving network security needs.

The solution must support approximately 60,000 students, 8,000 staff, and 80,000-100,000 concurrent devices (including district-owned and BYOD). SBSC operates two data centers (ESC and OHS), each serving as an internet gateway. Current internet bandwidth is 14 Gbps per site, expected to grow to 20 Gbps per site over the next five (5) years. Each data center features physical 40 Gbps Wide Area Network (WAN) connections.

The proposed firewalls must provide edge/perimeter security and remote VPN access, integrating high-speed interfaces (10/25/40/50/100/400 Gbps capable) for current and future needs across inside, outside, WAN, and DMZ zones. The contract includes hardware, three (3) years (with optional five (5) years) of maintenance, warranty, and support services (training, technical support, software updates, advanced malware protection) managed via a GUI/web portal.

EXISTING FIREWALL INFRASTRUCTURE:

The current hardware appliances are deployed across two data centers as follows:

• Four (4) FortiGate 4400F appliances; two deployed at each data center.

• One (1) FortiAnalyzer 3000G reporting appliance.

Any component of the existing equipment listed above may be considered for reuse provided it meets the following criteria:

• The component is compatible with the proposed firewall solution.

• Provides a lower Total Cost of Ownership (TCO) compared to purchasing new equipment.

Reuse may include the relicensing of existing hardware or use as a credit through equipment trade-in value. Any residual value or trade-in credit derived from the existing hardware is not E-Rate eligible, therefore, any such value or credits must be listed separately and will be excluded from the E-Rate eligible cost evaluation for the proposed solution.

PRICING OPTION STRUCTURE

The price schedule includes two distinct options (Option A and Option B) to allow SBSC to evaluate and balance the upfront cost against the 5-year Total Cost of Ownership (TCO) of the proposed solution. Bidders may submit pricing for either, or both, options.

For Option B, the bidder has flexibility in presenting the renewal costs for years 4 and 5:

• Annual Renewal: List the cost of a one-year extension in the column for Year 4 and a separate one-year extension in the column for Year 5.

• Single Renewal: List the total cost of a two-year renewal paid in Year 4, leaving Year 5 cost as zero ($0).

SOLUTION OVERVIEW:

A. Deployment: Propose three (3) Next Generation Firewall appliances: one Active/Active HA pair for the ESC data center and one standalone appliance for the OHS data center. The solution must be routed and in-line; Layer 2 load-balanced solutions are not acceptable.

B. Security Services: Appliances must include comprehensive security services: Gateway Antivirus/Malware, Intrusion Prevention, Application Control, Domain Reputation/Botnet Filtering, Database Security, Sandboxing, and SSL Deep Packet Inspection.

C. Professional Services: Include services for turn-key implementation, configuration, testing, and migration of relevant firewall policies/objects from the current platform.

SPECIFICATIONS:

A. Quality: Only the best commercial practices and highest quality materials/workmanship are acceptable. Omissions in detail imply adherence to these standards.

B. Turn-Key: Provide all necessary hardware, software, and services for a complete, operational solution connecting the District's infrastructure to the internet.

C. Managed Services: Include any managed services needed for initial deployment and production cutover.

D. Training: Provide training for up to (3) designated district administrators.

E. HA Configuration: The ESC deployment requires an Active/Active HA pair; OHS requires a standalone appliance.

F. Environment: SBSC provides adequate power (standard 110V) and rack space.

G. Support: A 24/7/365 technical support center is mandatory.

H. Term: Include all licensing, technical support, and warranty for a three (3) year term and optional five (5) year term.

FUNCTIONAL REQUIREMENTS:

A. Capacity: Support current and future throughput needs for ~68,000 users and up to 100,000 devices securely.

B. Performance: Maintain high traffic volumes with low latency.

C. Hardware Optimization: Appliances must utilize optimized hardware (ASICs or specialized processors) for networking, security, and content scanning tasks concurrently without performance degradation, using a single-pass architecture.

D. Firewall Throughput: Minimum processing capability of 175 Million packets per second (Mpps) (64-byte UDP).

E. Interfaces: Each appliance requires, at minimum:

* Four (4) ports capable of 40/100 Gbps (e.g., QSFP+/QSFP28).

* Ten (10) ports capable of 10/25/50 Gbps (e.g., SFP56/SFP28/SFP+).

* Four (4) ports capable of 10/25 Gbps (e.g., SFP28/SFP+).

F. Transceivers: Include sufficient transceivers for initial deployment across all appliances, minimum Eight (8) 40-GbE QSFP+ and Twelve (12) 10-GbE SFP+.

G. VPN Throughput: Minimum 100 Gbps IPsec VPN throughput per appliance.

H. SSL VPN Users: Support at least 30,000 concurrent SSL VPN users per appliance/HA pair.

I. Concurrent Sessions: Support at least 70 Million concurrent TCP sessions per appliance/HA pair.

J. SSL Inspection Sessions: Support at least 7 Million concurrent SSL inspection sessions per appliance/HA pair.

K. Threat Protection Throughput: Minimum 40 Gbps throughput with key security services enabled (e.g., NGFW Threat Protection).

L. Segmentation: Support at least 500 security zone segments.

M. Operating System: Must run a hardened OS on a dedicated hardware appliance (not virtualized) using stream-based inspection.

N. Certification: Must possess ICSA Labs certification or equivalent.

O. Verification: Provide 3rd party test reports (e.g., NSS Labs) substantiating minimum performance claims.

OPERATION MODE:

A. Control: Support zone-based ACLs, policy-based NAT/PAT, and operate in routing/NAT mode.

B. Protection: Include Flood/DoS mitigation, TCP reassembly, SYN cookie, IP spoofing, and malformed packet protection.

C. Flexibility: Support transparent, tap, Layer 2, and Layer 3 modes; support 802.1Q VLAN tagging in all applicable modes.

D. Bandwidth: Support standard link aggregation (IEEE 802.3ad) and logical tagged/untagged Ethernet interfaces.

E. Routing: Support static, RIPv2, OSPF, and BGPv4 (with MD5 authentication) routing protocols.

F. Forwarding: Support policy-based forwarding (based on zone, source/destination port, application, user/group via AD/LDAP/RADIUS).

G. Management: Support SNMPv3.

H. Updates: Signature updates must be automatic. Firmware/software updates must be non-disruptive (via HA for ESC).

HIGH AVAILABILITY (HA) - ESC Pair Only:

A. Mode: Support Active/Active HA.

B. Security: Encrypt HA heartbeat and control traffic.

C. Synchronization: Synchronize sessions, certificates, VPN SAs, signatures, configurations, and FIB tables between HA members.

REPORTING:

A. Appliance: Include a separate, robust centralized reporting appliance (physical or virtual) providing end-to-end traffic visibility.

B. Reports: Offer diverse canned and customizable reports/logs with near real-time data visibility.

C. Detail: Generate reports based on applications, URLs, IPs, devices, users, threats, or combinations thereof, including detailed user web history.

D. Scheduling: Support manual ad-hoc and scheduled (daily, weekly, monthly) report generation.

E. Export: Reports must be exportable (CSV, PDF) and emailable on a schedule.

POLICY BASED CONTROLS:

Support policy control based on: Port/Protocol, Application/Category, User/Group, IP Address, Country Code; support SSL decryption and IPv4/IPv6/Multicast rules.

LAYER 7 APPLICATION CONTROL/SECURITY POLICY:

A. Identification: Classify Layer 7 applications across all ports, regardless of evasion tactics.

B. Database: Provide a searchable, up-to-date application list with details. Dynamic updates must not require reboot/restart.

C. Blocking: Provide customizable block pages for end-users.

D. User Integration: Support user/group identification (AD, LDAP, RADIUS) for application policy enforcement.

ANTIVIRUS / ANTI-SPYWARE / VULNERABILITY THREAT PROTECTION:

A. Inspection: Use single-pass, stream-based inspection for AV/AS threats.

B. Exploit Prevention: Block known network and application-layer vulnerability exploits. Database updates must be dynamic without requiring reboot/restart.

VPN:

A. Site-to-Site: Support up to 40,000 IPsec site-to-site tunnels.

B. SSL VPN: Support up to 30,000 concurrent SSL VPN user sessions.

C. Client Support: SSL VPN client required must support Windows 10, macOS, iOS, and Android minimum.

D. Deployment: Include a reliable method/platform for deploying SSL VPN clients and policies.

E. Traffic Routing: SSL VPN clients must route ALL internet traffic through the firewall for inspection.

F. Authentication: Authorize, identify, and authenticate SSL VPN users/devices, integrating with Microsoft Active Directory (MS AD) groups.

DATA FILTERING:

Support file identification by signature (not extension) and unpack zipped files for inspection.

USER IDENTITY AWARENESS:

A. Policy: Create security policies based on AD Users/Groups in addition to IP addresses.

B. Identification Methods: Support agentless user identification. Must include multiple methods like AD integration (plugin/SSO agent), RADIUS accounting integration, and a web-based captive portal.

Correlate logs with user identity in real-time. Separate solutions for user ID support are acceptable.

C. Authentication Services: Support AD, LDAP, RADIUS, Kerberos, and client certificates.

SSL/SSH DECRYPTION:

A. Performance: Identify, decrypt, and inspect SSL/SSH Layer 7 traffic with minimal user impact.

B. Exemptions: Allow exemptions from decryption based on categories, users, and specific sites.

C. Modes: Support decryption in tap, transparent, Layer 2, and Layer 3 modes.

D. Certificate Authority: Utilize certificates issued by the District's Microsoft CA.

IDS/IPS:

Configure integrated IDS/IPS capabilities using multiple application classification mechanisms based on deep packet inspection.

MODERN MALWARE PREVENTION:

A. Automation: Support automated signature generation for newly discovered malware.

B. Control: Provide in-line blocking of malware infection and command/control traffic (inbound and outbound).

C. Sandboxing: Utilize a cloud-based virtualized sandbox environment to execute and analyze unknown files across multiple OS/application versions.

D. File Types: Support analysis of major file types (PE, MS Office, PDF, Java, APK).

BANDWIDTH MANAGEMENT/TRAFFIC SHAPING:

Prioritize, guarantee minimum, set maximum, or restrict bandwidth based on categories, URLs, IP addresses, MS AD groups, and users.

INTERNET PROTOCOL VERSION 6 (IPv6) REQUIREMENTS:

A. Co-existence: Support simultaneous IPv4 and IPv6 operation.

B. Information: Detail any additional requirements (patches, licenses, hardware, services) needed for full IPv4/IPv6 co-existence.

C. Vendor Qualification: Vendor must demonstrate qualifications and experience in designing and implementing IPv4/IPv6 firewall configurations and projects, utilizing certified personnel for the proposed solution.

All equipment must be new Original Equipment Manufacturer (OEM); used or refurbished equipment is unacceptable.