APPENDIX A - BORDER FIREWALL BID SPECS.docx

General Requirements The University of Southern Mississippi is seeking to purchase two (2) enterprise-class Next-Generation Firewalls (NGFWs) for deployment as a High Availability (HA) perimeter security solution. The proposed solution shall include all hardware, software licensing, subscriptions, technical support, and hardware maintenance required for a period of five (5) years.

The proposed solution shall consist of two identical appliances configured in an Active/Standby or Active/Active High Availability (HA) configuration.

Hardware Requirements The proposed solution shall:

· Include two (2) identical enterprise-class firewall appliances.

· Support deployment in a redundant High Availability (HA) configuration.

· Include redundant hot-swappable power supplies.

· Support rack mounting in a standard 19-inch equipment rack.

· Include all required rack mounting hardware and cables.

· Support field-replaceable components where applicable.

Performance Requirements The proposed solution shall provide, at a minimum:

· Stateful firewall throughput of 80 Gbps or greater.

· Threat prevention throughput of 80 Gbps or greater with all security services enabled.

· IPS throughput of 80 Gbps or greater.

· IPsec VPN throughput of 80 Gbps or greater.

· SSL/TLS decryption and inspection capability.

· Encrypted Traffic Visibility: The solution shall support the ability to identify threats within encrypted traffic (TLS 1.3) using advanced traffic analysis techniques, including the ability to detect malware patterns without requiring full decryption for every flow.

· Support for a minimum of:

· 30 million concurrent sessions.

· 600 thousand new sessions per second.

The Vendor shall provide manufacturer-published performance specifications demonstrating compliance with the minimum performance requirements identified herein.

Performance values submitted by the Vendor shall be based on manufacturer-published specifications and shall reflect the throughput achievable with all licensed security services enabled. Performance figures based solely on basic firewall forwarding or laboratory conditions without security inspection shall not be considered equivalent.

Interface Requirements Each appliance shall provide, at minimum:

· Eight (8) or more 1/10/25 Gbps SFP28 ports.

· Two (2) or more 1/10 Gbps SFP+ or SFP28 ports.

· Four (4) or more 40 Gbps QSFP+ ports.

· Console interface.

· USB interface for maintenance.

Equivalent or greater interface configurations are acceptable.

Connectivity to the University Switch Infrastructure The proposed solution shall connect to the University's existing Cisco Nexus and Cisco Catalyst switching infrastructure. All optical transceivers and cables provided by the Vendor shall be manufacturer-supported and fully compatible with the proposed solution. The University will provide the optical transceivers required for the Cisco switching infrastructure.

The Vendor shall identify the recommended interface types, quantities, and connectivity required for the proposed solution. At a minimum, the proposed solution shall support the following connections:

Enterprise Firewalls (Each Firewall):

· A minimum of two (2) 40 Gbps optical interfaces for production network traffic (inside and outside connectivity).

· High Availability (HA) synchronization interfaces consisting of a minimum of one (1) 10 Gbps optical connection (or as required by the proposed solution).

· One (1) dedicated management interface supporting a minimum of 1 Gbps copper Ethernet.

Physical Management and/or Logging Appliances (if proposed):

· A minimum of one (1) 10 Gbps optical network connection.

· One (1) dedicated management interface supporting a minimum of 1 Gbps copper Ethernet.

The Vendor shall specify:

· The recommended number of network, High Availability (HA), management, and logging interfaces required for the proposed deployment.

· The required optical transceiver type(s) (e.g., 10GBASE-SR, 40GBASE-SR4, 100GBASE-SR4, etc.).

· The supported fiber optic patch cable type(s) (e.g., OM4 multimode fiber, MPO-to-LC breakout, LC-LC duplex, etc.).

· Any additional connectivity requirements necessary to support full functionality, redundancy, performance, or future scalability.

Firewall Features The firewall shall support:

· Stateful packet inspection.

· Application-aware firewall policies.

· User identity-based policies.

· Unified Policy Management: The firewalls shall support a “single-pane-of-glass” policy configuration that allows for the simultaneous management of access control, application control, and threat prevention policies.

· Network Address Translation (NAT).

· IPv4 and IPv6.

· Dynamic routing protocols including:

· BGP

· OSPF

· RIP

· Static routing.

· Policy-based routing.

· VLAN trunking (802.1Q).

· Link aggregation (LACP).

· Virtual routing and forwarding (VRF) or equivalent.

· Quality of Service (QoS).

· High Availability (HA) failover.

· Integrated SD-WAN Capabilities: The solution shall include integrated SD-WAN features to optimize traffic path selection based on application performance, latency, and jitter.

· The Vendor shall describe how the proposed solution handles SSL Decryption and Encrypted Traffic Visibility.

· QUIC Protocol Inspection and Control: The proposed solution shall provide comprehensive visibility and security enforcement for the QUIC (Quick UDP Internet Connections) protocol and the Vendor shall outline and describe how the proposed solution handles QUIC traffic. Include in the description the following details:

· Native Inspection of QUIC traffic.

· Policy controls for administrators to define granular security policies for QUIC traffic, including the ability to selectively allow, block, or apply deep packet inspection based on user, application, or destination.

· Outline how the proposed solution can ensure consistent security posture, to enforce a transition from QUIC to standard TCP/TLS protocols where necessary, allowing for inspection by established security engines if full native QUIC decryption is not utilized.

· Outline the performance consistency of how the security inspection of QUIC traffic is performed without introducing unacceptable latency or significant degradation to overall firewall throughput.

Security Services The solution shall include licensing for the following security services for five (5) years:

· Cloud-Native Threat Intelligence: The solution shall be backed by a global, real-time threat intelligence network that provides automated updates for security signatures, reputation data, and indicators of compromise (IoCs).

· Advanced Malware Protection (AMP) Integration: The solution shall support continuous analysis of files, including retrospective alerting if a file is later determined to be malicious after initial inspection.

· Intrusion Prevention System (IPS).

· URL Filtering.

· DNS security or equivalent threat intelligence service.

· The Vendor shall describe the granularity of application control, including at a minimum:

· Sub-function control: The ability to restrict specific features within a single application.

· Operational Efficiency: Automated, frequent signature updates that do not require system downtime.

· Performance: Ability to maintain throughput requirements while all application control features are active.

· Identity Awareness: native integration with directory services (AD/LDAP/SAML) to apply application policies based on user identity rather than IP address alone.

· Reputation-based filtering.

· Command-and-control (C2) detection.

· Botnet detection.

All security subscriptions shall remain active for the full five-year term.

VPN Requirements The solution shall support:

· Site-to-site IPsec VPN.

· Remote Access VPN.

· IKEv2.

· AES-256 encryption.

· Certificate-based authentication.

· Multi-factor authentication integration.

· Dynamic VPN routing.

High Availability The proposed solution shall support:

· Stateful High Availability (HA).

· Automatic failover.

· Configuration synchronization.

· Session synchronization.

· Link monitoring.

· Device health monitoring.

· The Vendor shall explain how the proposed solution operates in an Active/Standby High Availability (HA) deployment.

Logging, Monitoring and Management The solution shall:

· Generate detailed security logs.

· Export logs via Syslog.

· Support SNMP monitoring.

· Support NetFlow/IPFIX or equivalent flow export.

· Support role-based administration.

· Provide audit logging.

The Vendor shall describe the proposed management and logging architecture for the solution. If the proposed solution requires a separate management and/or logging platform beyond the two (2) Enterprise Firewalls, the Vendor shall include it as a separate line item in the proposal with a clearly identified subtotal, independent of the pricing for the two (2) Enterprise Firewalls.

An on-premises management solution is preferred. If the proposed management and/or logging solution is deployed as a virtual machine (VM), the Vendor shall provide comprehensive deployment requirements and resource specifications necessary to support the proposed firewall environment, including, at a minimum:

· Supported hypervisor platforms and versions (e.g., VMware ESXi, Microsoft Hyper-V, KVM).

· Minimum and recommended virtual CPU (vCPU) allocations.

· Minimum and recommended memory (RAM) requirements.

· Storage requirements, including minimum and recommended disk capacity, storage type, and any high-performance storage recommendations (e.g., SSD or IOPS requirements) necessary for configuration management and log retention.

· Virtual network interface (vNIC) requirements and any required network ports, protocols, or connectivity between the management platform, firewalls, and external services.

· Any operating system prerequisites or software dependencies, if applicable.

· Recommended sizing guidance based on the proposed firewall solution, including expected log volume, event rates, retention periods, and the number of managed devices.

· Any additional hardware, software, licensing, or infrastructure requirements necessary to support the proposed management and logging solution.

Directory Integration The firewall shall support integration with:

· Microsoft Active Directory.

· LDAP.

· RADIUS.

· TACACS+.

· SAML-based authentication.

Licensing Vendor shall provide all licensing necessary for:

· Firewall operation.

· Threat prevention.

· Malware protection.

· URL filtering.

· Application identification.

· Security updates.

· Signature updates.

· Firmware updates.

· Technical support.

Licensing shall be valid for five (5) years from acceptance.

The Vendor shall describe the proposed solution's threat intelligence services, including the sources of threat intelligence feeds.

Warranty and Support Vendor shall provide five (5) years of manufacturer support including:

· 24x7 technical support.

· Hardware replacement.

· Advance hardware replacement with next business day delivery.

· Software upgrades.

· Firmware updates.

· Security signature updates.

· Access to manufacturer technical support resources.

Compatibility The proposed solution shall support:

· Existing enterprise network environments.

· IPv4 and IPv6.

· Virtualized environments.

· Industry-standard routing and switching protocols.

· Standards-based networking technologies.

· Log transfer from Firewall or Manager to Microsoft Sentinel.

Required Deliverables Vendor shall provide:

· Two (2) firewall appliances.

· All required transceivers, licenses, and subscriptions.

· Five (5) years of support and maintenance.

· Documentation.

· Manufacturer warranty information.

· License documentation.

· Documentation regarding the proposed threat intelligence sources.

· Documentation describing all required and optional management and logging components, including deployment requirements and licensing.