Attachment 1 - Cisco ISE SOW REVISED 3 June 24.pdf

STATEMENT OF WORK (SOW)

for

AFSOC SOACS

Installation of Cisco ISE at

Cannon AFB, NM and

Upgrade Cisco ISE servers at Hurlburt Field, FL

3 June 2024

1. Air Force Special Operations Command (AFSOC) Special Operations Advanced Capabilities

Squadron (SOACS) requires a Cisco Identity Service Engine (ISE) server suite (2) be installed and configured at Cannon Air Force Base (AFB), New Mexico (NM) on a Government provided Virtual Machine (VM) server suite. Hurlburt Field, Florida (FL) Cisco ISE servers and Cannon AFB, NM Cisco ISE servers must be able to update each other from either location. Cannon AFB, NM Cisco ISE will be a backup of the Cisco ISE servers at Hurlburt Field, FL in case of natural disaster in Florida. This Statement of Work (SOW) outlines engineering services to install and configure existing government-owned Cisco ISE on the existing government-owned hardware with a level of understanding in accordance with industry best practices and DoD security requirements. Hurlburt Field, FL Cisco ISE servers shall be upgraded to the latest Cisco recommended Internetwork Operating Systems (IOS),

3.3.0 minimum.

2. Requirements/Existing Equipment.

The AFSOC SOACS engineering and operations teams plan to use Cisco-based ISE software for a network solution that will provide security at the network edge. Servers will be based at both Cannon AFB, NM and Hurlburt Field, FL and be able to update each other. There are two existing servers located at Hurlburt Field, FL that will be upgraded. Layer 2/3 routing and switching infrastructure exists at the access and distribution layers. A high-density wireless local area network (LAN) solution is also in place.

Requirements:

• Backup current Cisco ISE nodes, export a copy of internal Certification Authority (CA) Key and certificate chain.

• Upgrade two (2) Cisco ISE servers virtual licenses and Terminal Access Controller Access- Control Systems (TACACS) Node Licenses at Hurlburt Field, FL.

• Deploy two (2) new Cisco ISE VM and TACACS node licenses at Cannon AFB, NM.

• Ensure devices are industry security configuration compliant with the latest updates and industry best practices.

• Test and validate configuration and provide a report.

• Configure backup setting on Cisco ISE.

Existing Network Equipment:

• Approximately 175 Cisco network switches - 9200, 9300, 9500, N9K

• 200 Cisco Wireless Access Points (WAPs) - C9120-AXI, C9130-AXI

• Two Cisco 9800 Wireless Local Area Network Controllers (WLCs)

• 5 Cisco routers - ASR4331, ASR1001-X

• Adaptive Security Appliance (ASA) devices Cisco - ASA1010, FPR2110

• Palo Alto 3260 appliance firewalls – two at Hurlburt Field, FL, two at Cannon AFB, NM.

• Approximately 120 Dell and HP laptops and desktops with another 500 projected.

3. The Government will be responsible for and provide the following:

• Provide VM space for Cisco ISE at Cannon AFB, NM and Hurlburt Field, FL.

• Provide Internet Protocol (IP) addresses and Domain Name System (DNS) information as needed for both sites.

• Provide Network time Protocol (NTP) addresses as needed.

• Provide Simple Mail Transfer Protocol (SMTP) information.

• Provide Lightweight Directory Access Protocol (LDAP)/ Active Directory (AD) information.

• Provide testing support.

• Documentation/network topology as needed.

4. The vendor/contractor engineering team will be responsible for and provide the following:

• Two new Cisco ISE licenses (R-ISE-VMC-K9) for Cannon AFB, NM, upgrade existing licenses at Hurlburt Field, FL.

• Device configuration on up to 5 of each type of hardware (see above) with configuration guides to the remaining devices. Devices should be able to authenticate to either site.

• Coordination of the implementation AFSOC SOACS software installation to limit downtime during transition to the new gear and design.

• Successful testing:

o TACACS configuration.

o 802.1x Transport Layer Security (TLS) Extensible Authentication Protocol over

LAN (EAPoL) on switches (5 switches + 2 WLCs).

o 802.1x User/Password.

o Windows User Authentication (wired) – deployment via Group Policy Objective

(GPO) and Multi-Factor Authentication (MFA).

o Templates for the above.

• Training Guides to include:

o Documentation of new configurations.

o Walk through of configurations.

o Basic troubleshooting information.

• Creation of as-built documentation with updated diagrams and build information to include system design files, IP addressing, device names, and software versions.

• Team needs to have a Cisco Certified Network Professional (CCNP) or technician with extensive Cisco ISE experience at the enterprise level.

5. Project schedule will be provided within ten (10) days of receipt of purchase order or signed contract. This schedule includes client milestones, design, configuration, on-site work, and customer training and is based on the assumptions listed above.