Attachment 1 - Statement of Work.pdf

STATEMENT OF WORK (SOW)

for

AFSOC SOACS

Installation of Wireless Intrusion Protection Service and Wireless Intrusion Detection Service

(WIPS/WIDS)

at

Hurlburt Field, FL

24 June 2022

1. Objective.

The AFSOC SOACS requires support to design, install, configure, and train for a network Cisco Wireless Intrusion Protection service and Wireless Intrusion Detection Service (WIPS/WIDS) for Hurlburt Field, Florida. The existing routers, switches, firewalls, wireless networks, Wireless LAN Controller and Identity Service Engine (ISE) shall be used as part of this solution. This Statement of Work (SOW) outlines engineering services to install and configure existing government-owned Cisco ISE on the existing government-owned hardware with a level of understanding in accordance with industry best practices and DoD security requirements.

2. Requirements/Existing Equipment.

The AFSOC SOACS engineering and operations teams plan to use Cisco-based Wireless LAN Controller and leverage ISE software for a network solution that will provide security at the network edge. Layer 2/3 routing and switching infrastructure exists at the access and distribution layers. A high-density wireless LAN solution is also in place.

Requirements:

• Install/Enable WIPS/WIDS on Wireless LAN Controller

• Enable Monitoring on Wireless Access Points as needed

• Set up monitoring tools and alerts

• Enable blocking of rouge access points

• Leverage ISE as much as possible in configuration and security source. Including

(knowing who’s on the network, authentication, authorization, and accounting)

• Explore ways to connect Apple i-Pads and MAC Books to the network

• Enable WIDS/WIPS for STIG compliance

• Assist in device type classification

Existing Network Equipment:

• Approximately 60 Cisco network switches - 3560, 3850, 9200, 9300, 9500, N9K

• 148 Cisco WAPs - 9120-AXI, AIR-3702, AIR-3800

• Two Cisco 9800 WLCs

• 5 Cisco routers - ASR4331, ASR1001-X

• ASA devices Cisco - ASA1010, FPR2110,

• Forcepoint SideWinder firewall (VMware)

• Approximately 5,000 Apple iPads (aka Electronic Flight Books [EFB]) controlled by a mobile device manager (MDM)

• Approximately 100 Dell and HP laptops and desktops

3. The Government will be responsible for and provide the following:

• Documentation/network topology as needed.

• Device configuration as needed.

• Access to equipment, server(s), located in a secure area

• Proper power feeds to all equipment from UPS or separate electrical outlet within the required range of the equipment.

• Necessary path cables.

• Internet circuits are terminated and functioning properly.

4. The vendor/contractor engineering team will be responsible for and provide the following:

• Device configuration on 5 of each type of hardware (see above) with configuration guides to the remaining devices.

• Coordination with MSCC for the implementation of the AFSOC SOACS software installation to limit downtime during transition to the new gear and design.

• Successful testing:

o TACACS configuration o “Evil twin attack” o Identification of rouge access points o Templates for the above

• 16 hours of training to include:

o Management Console o Administrative functions o Best practices o Reporting o Documentation of new configurations o Walk through of configurations o Basic troubleshooting information

• Creation of as-built documentation with updated diagrams and build information to include system design files, IP addressing, device names, and software versions.

5. Project schedule will be provided within ten (10) days of receipt of purchase order or signed contract. This schedule includes client milestones, design, configuration, on-site work, and customer training and is based on the assumptions listed above.