40 66 16 - Firewall Hardware.pdf
PDF 542 KB Posted
- Attached to
- West Pump Station Replacement Project
- Solicitation number
- Not on record
- Issued by
- Chester County, Pennsylvania
About this file
This is a Scope of Work specification document for Section 40 66 16 – Firewall Hardware, prepared by Herbert, Rowland & Grubic, Inc., for the West Pump Station Replacement Project managed by the Northwestern Chester County Municipal Authority in Pennsylvania. The contractor is required to furnish and install industrially rated network security and firewall devices as part of a fully functional control system network based on an Ethernet platform. The primary product specified is the Phoenix Contact mGuard 2105 network security device, which includes a 4-port integrated switch, VPN functionality supporting up to 250 licenses with AES-256 encryption, stateful inspection firewall capabilities, and Deep Packet Inspection for Modbus TCP and OPC Classic protocols. Additional requirements include the Phoenix Contact FL mGUARD DM Software for centralized device management and configuration, as well as spare parts consisting of ten percent (rounded up) of each type of network security device provided, with a minimum of one spare of each type. The work must comply with NFPA 79, NEC, NEMA, ISA-99, UL, IEC, IEEE standards, and all applicable state and local code requirements.
The specification requires no substitutions for the Phoenix Contact equipment due to compatibility requirements with existing SCADA network equipment, though the device manager software allows for approved equals. All installations must account for the environmental conditions typical of water and wastewater treatment facilities, including high energy AC fields, DC control pulses, and varying ground potentials. The contractor must ensure proper protection against electromagnetic interference from these operational conditions. No pricing information, set-asides, or contract award dates are specified within this scope of work document, as these details would be contained in the associated bidding documents and contract terms available through the PennBid platform.
View the file
Other files
Show 40 more
Latest 50 of 171 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SECTION 40 66 16 – FIREWALL HARDWARE
Herbert, Rowland & Grubic, Inc. 40 66 16 - 1 000483.0450
PART 1 - GENERAL
1.01 SCOPE OF WORK
A. Scope:
1. CONTRACTOR shall provide all labor, materials, equipment and incidentals as shown to furnish and install industrially rated network security and firewall devices as part of a fully functional control system network based on an Ethernet platform.
B. Related Sections:
1. Section 40 95 33 – Process Control Network Overview.
1.02 QUALITY ASSURANCE
A. Standards, Codes and Regulations:
1. Construction of control system network and the installation and interconnection of all equipment and devices mounted within shall comply with applicable provisions of the following standards, codes and regulations:
a. National Fire Protection Association 79, Annex “D” Standards, (NFPA).
b. National Electrical Code, (NEC).
c. National Electrical Manufacturer's Association Standards, (NEMA).
d. International Society of Automation (ISA), ISA-99 standards.
e. Underwriters’ Laboratory, Inc., (UL).
f. International Electrotechnical Commission (IEC).
g. Institute of Electrical and Electronics Engineers (IEEE).
h. State and Local code requirements.
i. Where any conflict arises between codes or standards, the more stringent requirement shall apply.
PART 2 - PRODUCTS
2.01 NETWORK SECURITY DEVICE
A. General: Provide network security devices as shown on the drawings to segregate networks, provide secure remote connectivity through VPNs and protect critical automation systems from cyber security intrusions or failure due to unintentional traffic storm.
B. Features:
1. Copper ports shall be 10/100 base-T(X), auto-negotiation and auto-crossing. Ports shall be configurable to be enabled/disabled via the management interface.
2. Supply voltage range of 9 VDC to 30 VDC, nominal 24 VDC. Capable of accepting redundant power inputs. Power connections shall be pluggable.
3. Device shall have a transparent or stealth mode for drop in protection of end devices regardless of network configuration.
4. Device shall support stateful inspection as a firewall.
5. Device shall support Deep Packet Inspection for Modbus TCP and OPC Classic protocols.
Herbert, Rowland & Grubic, Inc. 40 66 16 - 2 000483.0450
6. Firewall rules shall be configurable by the user and include inspection on Source/Destination IP address, MAC address, protocols and/or Source/Destination TCP/UDP port.
7. Provide 4-port unmanaged or managed 10/100 Mbps integrated switch with DMZ port for further network segregation.
8. Support protection against IP Spoofing, Denial of Service and Syn Flood Protection.
9. Support Virtual Private Network (VPN) functionality up to 250 licenses with ability to act as client or server of VPN requests. IPSec shall be the supported VPN protocol with encryption meeting the military standard of AES-256. Provide hard-wired contact to initiate VPN tunnel.
10. Support static routing between two or more networks.
11. Support One (1) to One (1) Network Address Translation (NAT) routing.
12. Support dynamic device addressing via BootP.
13. Supports multiple VLANs.
14. Supports the use of SNMP management, up to v3 for maximum security.
15. Supports Common Internet File System (CIFS) monitoring to monitor the modification of selected files and sending alerts when files have been modified. Provide license for CIFs monitoring.
16. Two LEDs for indicating port status.
17. DIN Rail mountable.
18. Alarm contact to indicate malfunction with power supply unit or loss of port communication.
19. Capable of being configured either through a web interface using standard browsers, command line interface or through a centralized device management software solution.
Configuration of device requires username and password authentication.
20. Capable of accepting a SD card for securely storing configuration file of device.
21. Operating temperature of -20 C to 60 degrees C.
22. Provide antennae and cable for antennae if necessary for secure VPN.
C. Product and manufacturer:
1. Phoenix Contact, mGuard 2105.
2. Substitution is not permitted due to compatibility with existing SCADA network equipment.
2.02 DEVICE MANAGER SOFTWARE
A. General: Provide centralized device manager software and software licensing as required to perform remote and centralized management of network security devices.
B. Features:
1. Capable of configuring desired firewall rules, NAT settings, VPN and X.509 certificates and other network parameters with the ability to upload the generated configurations to the network security devices remotely.
2. Client-server application with support for the following operating systems:
a. Windows Server 2016
b. Windows Server 2012 R2
c. Windows 10 (client only)
d. Windows 7 (client only)
e. Ubuntu 18.04 LTS
3. Software can trigger firmware upgrades and deploy device licenses.
Herbert, Rowland & Grubic, Inc. 40 66 16 - 3 000483.0450
C. Product and manufacturer:
1. Phoenix Contact, FL mGUARD DM Software.
2. Or approved equal.
2.03 SPARE PARTS
A. Provide the following control system network component spare parts:
1. Ten percent (rounded up) of each type of network security device provided for project with a minimum of one spare each.
PART 3 - EXECUTION
3.01 ENVIRONMENTAL CONDITIONS
A. The control system network will be used in a water or wastewater treatment facility environment where there will be high energy AC fields, DC control pulses, and varying ground potentials between the transducers or input contact locations and the system components. The system design shall be adequate to provide proper protection against interferences from all such possible situations.
END OF SECTION 40 66 16
File details come from the government source that posted it. Updated .