20147188_JEFO_Redacted.pdf

Attachment 6 U.S. Customs and Border Protection

Justification for Exception to Fair Opportunity (JEFO) – FAR 16.505(b)(2)(ii)(B)

Version 2.0 November 2020

Date: September 9, 2025 PR Number: 2014-7069 and 2014-7188

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Customs and Border Protection (CBP), Office of Acquisition (OA), Information Technology Contracting Division, and Enterprise Infrastructure and Operations Directorate (EIOD), Network Architecture & Engineering Division (NAED), prepared this brand name justification for exception to fair opportunity.

2. Nature and/or description of the action being approved.

CBP intends to use a brand name specification pursuant to FAR 16.505(a)(4) for the procurement of various Cisco, Juniper, Meraki, F5, and Palo Alto stock keeping units (SKUs) and annual maintenance, for the procurement of infrastructure network equipment required at the current ICP East/West Cages, as well as CBP Field Sites.

Pursuant to FAR 16.505(a)(4), restricting consideration to an item peculiar to one manufacturer (e.g., a particular brand-name, product, or a feature of a product that is peculiar to one manufacturer) must be justified. CBP requires that brand name delivery orders be awarded for the procurement of Infrastructure Network Equipment and associated licensing. Fair opportunity will be limited to contract awardees under the NASA SEWP indefinite delivery/indefinite quantity (IDIQ), Small Business socio-economic category, who are authorized resellers of Cisco, Juniper, Meraki, F5, and Palo Alto products or who have a business relationship with authorized resellers that permit them to provide the required products. CBP prioritizes authorized resellers due to the formal approvals set forth between the manufacturer and the reseller. This further establishes a trusting and reliable relationship between CBP and the manufacturer, as well as CBP and the authorized reseller, leading to a more dependable process of safe product receipt.

The safe delivery and receipt of equipment and products are crucial to the mission of CBP, as it ensures that port sites and CBP locations across the nation continue to function smoothly and without delay. The authorization from the manufacturer of a vetted reseller will ensure that CBP will face little to no challenges, compared to the risk that the manufacturer will take by using an unauthorized reseller—all of which directly effects CBP and its mission to keep the Unites States protected 24/7.

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

This procurement is for infrastructure network equipment (switches, routers, and associated software) required to implement the network equipment upgrade for multiple CBP sites throughout the United States. This network package is an assortment of equipment required from different manufacturers. This includes the costs associated with the purchase of the hardware equipment along with 12 months of maintenance included in the BOM. The required network infrastructure equipment will ensure that all system equipment connected to the DHS/CBP Network Enterprise have met all security regulations and standards.

firewalls with our existing Core Extranet firewall from a single pane of glass user interface (UI).

Additionally, the Firewall modules specified in the BOM are to provide expanded support and functionality in our existing Cisco Firepower 9300 chassis Extranet Firewalls. Given the critical importance of compatibility and interoperability with the existing CBP networks, only Cisco equipment is acceptable for use on the CBP networks.

Cisco Routers are the only equipment able to interconnect and function with the existing CBP Cisco proprietary Dynamic Multipoint Virtual Private Network (DMVPN) and Cisco Viptela.

CBP estimates replacing all field site routers would cost in excess of $35M, with an estimated 3 years to fully implement a new solution. CBP conducted an architectural review and bakeoff for WAN routing and Cisco was the selection out of the multi-vendor review in November of 2024.

When the current series of routers have an end-of-life announced CBP will conduct a new router refresh multi-vendor review.

Cisco Catalyst switches are the only equipment that can fully integrate with the existing CBP network tools: Cisco Catalyst Center (Formerly DNAC), which is CBP’s network configuration and analytics tool, the Integrated Service Engine (ISE), which is CBP’s Network Access Control (NAC) solution and Terminal Access Controller Access Control System (TACACS ) solution, and Cisco Secure Network Analytics (formerly Stealthwatch) which is a CBP Security Operations Center (SOC) security tool. Given the critical importance of compatibility and interoperability with the existing CBP networks, only Cisco equipment is acceptable for use on the CBP networks.

Cisco Nexus switches are the only equipment that can fully integrate with the existing CBP Application Centric Infrastructure (ACI) Software Defined Local Area Network (SD-LAN) fabric currently employed at Colocation environments to support planned expansion to migration out of our legacy datacenter. Given the critical importance of compatibility and interoperability with the existing CBP networks, only Cisco equipment is acceptable for use.

F5

F5 is the existing Global and Local Application load-balancer for CBP and DHS Applications.

The F5 Load-balancer is the only product that is compatible with the current F5 software products and hardware installed on CBP’s networks. The use of other products could result in interoperability, compatibility, and/or interface issues with existing DHS systems. F5 Systems is the only vendor which enables multi-factor authentication such as PIV or CAC for CBP network devices, which natively doesn’t support PIV authentication. In addition, the F5 removable hard drive feature allows CBP to keep hard drives versus returning to the vendor if a device fails. F5 i-Rules are special scripts that execute commands based on network traffic passing through the F5 device and is unique only to F5 systems.

Palo Alto

Palo Alto XSOAR platform was identified as the only solution to provide the Security Orchestration, Automation, and Response tool to improve incident response times and efficiencies without having to devote dedicated resources. It is the only platform with vendor agnostic, therefore, was selected by CBP for the integration between another Palo Alto product, Global Protect VPN, and Infoblox DNS to resolve hostname of the Global Protect VPN clients and provide DNS resolution for users to access CBP Mainframe applications. Without this unique capability from XSOAR, VPN users with Global Protect client will not be able to access mainframe applications. In addition, Market research has determined that the other similar software and hardware would not be compatible with existing Palo Alto/ XSOAR software and hardware installed on CBP’s networks and cannot be modified to be compatible with existing software and hardware. Many of the Program offices Application Firewall access policies are formulated into Palo Alto proprietary language. The use of any other product would require the purchase of new equipment and software which won’t be integrated into the existing CBP enterprise network.

While all SOAR platforms provide ease of integration into existing environment, customization, and deployment, only Palo Alto XSOAR Platform has integrations for many different vendor products such as Infoblox DNS which reduces the onboarding issues, and the playbooks are very dynamic that can be used to significantly reduce overall work. Other vendors may claim their SOAR Platform can integrate with other products, but it requires developers to develop unique Application Programming Interface (API) between their SOAR platform and other products/tools.

Currently in production, CBP utilizes two XSOAR servers with geographic diversity in order to update the Infoblox domain names (DNS) with the hostnames and IPs of Global Protect VPN clients in order to allow access to mainframe applications and provide translations between host names and IP addresses to the enterprise for safer network usage. The particular brand name products are essential to the government’s requirements and market research indicates that other companies’ similar products did not meet and cannot be modified to meet the Agency’s needs.

The Government does not own the Palo Alto technical data package, which is proprietary to Palo Alto operations. The Government does not have the ability to modify Palo Alto products or solicit the maintenance requirement among manufacturers other than Palo Alto authorized resellers. No other vendor has the technical ability to provide maintenance support for Palo Alto products. The harm to the government from not acquiring maintenance from Palo Alto or an authorized reseller would be loss of Palo Alto functionality, disruption of CBP networks, and loss of mission-critical resources and data.

Juniper

Juniper EX4400 Switches are listed for designated field sites that have existing Juniper equipment today or the new field sites with the option to procure Juniper EX4400 switches to provide an alternative option for a CBP tested and approved network access. This includes the Juniper EX4400 Series Aggregation and Access switch that has been proven compatible with our CBP network monitoring and management tools, while continuing to meet our security standards. Due to CBP’s Mission Critical operations, we adhere to best practices to design networks to be high availability whenever possible to reduce impact to operations. One such practice is keeping the field site LAN network homogenous with one switching vendor, either

Cisco or Juniper. This practice has helped to reduce our Mean-Time-To-Repair (MTTR) for the CBP NOC to troubleshoot software bugs and configuration issues as they occur.

Meraki

After multi-vendor testing and evaluating different Wireless Access Point providers on the last refresh cycle, CBP has become standardized on Meraki Wireless Access Points. In the evaluation, Meraki repeatedly proved to be the only solution to seamlessly integrate with CBP existing network monitoring tools and network and security standards, which meet our current and future requirement needs. CBP is mid-way through our wireless refresh and only Meraki Wireless Access Points will integrate with our FedRamp Meraki cloud controller, which is used to monitor and configure our new, and existing, refreshed wireless network. These Wireless and cloud managed Access Points contribute to CBP’s mission to protect and secure network reliability, as the wireless aspect ensures safe, low-risk connectivity, and the cloud managed access points bridge the gap between CBP sites, allowing controlled information within CBP to be explicitly accessible.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer anticipates adequate price competition is available amongst the NASA SEWP V small business vendors to determine pricing as fair and reasonable. NASA SEWP V is a Best in Class, category management approved vehicle to acquire commercially available IT commodities to support DHS business units in accomplishing their assigned missions. The Contracting Officer will use various price analysis techniques to determine a fair and reasonable price, including a comparison of proposed prices received and a comparison to the Independent Government Cost Estimate.

6. Any other facts supporting the justification.

None.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CBP will continue to conduct market research to determine if the market has changed and if a better solution becomes available.

8. CBP intends to post this requirement on the NASA SEWP V contract vendor portal pursuant to FAR 16.505(b)(2)(ii)(D)(5).

9. Technical/Requirements Personnel Certification: