Attachment A -Data Comm Language for VPN metroEthernet and Secure FTP with SOI.doc

ATTACHMENT A

Data Security Connectivity Specifications

Connectivity The connection to the State of Illinois data center should be through a secure connection via the Internet. A secure connection over the Internet will require a LAN-to-LAN Virtual Private Network (VPN) or the use of SSL/TLS sessions depending upon the communication requirements.

In isolated cases, the Vendor may require a dedicated point-to-point metro-ethernet connection by a reputable vendor. If required, the Vendor is responsible for providing and procuring a dedicated metro-ethernet connection to the State of Illinois’ primary data center. If redundancy is required between the vendor and the State of Illinois, the Vendor is responsible for providing the procuring a second dedicated metro-ethernet connection to the State of Illinois’ alternate data center.

Internet Site-to-Site (LAN-to-LAN) VPN Requirements

The Vendor is responsible for working with State of Illinois Department of Information Technology (DoIT) personnel in a timely manner to establish VPN connectivity over the internet. The Vendor and the State of Illinois are each responsible for installation and support of its own internet service and VPN concentrator to facilitate the VPN tunnel. DoIT currently utilizes a Cisco ASR 1002-X series router to provide VPN connections to the DoIT data center. For VPN authentication, DoIT uses "pre-shared keys". Host addresses are the DoIT preferred method of defining interesting traffic over the VPN tunnel. DoIT staff perform Network Address Translation (NAT) of all internal addresses to make the connection conform to the State of Illinois’ IP addressing structure. Only non-RFC1918 addresses from the Vendor’s network are allowed by the State of Illinois.

The DoIT encryption standards are as follows:

Phase 1 IKE Properties (ISAKMP Protection Suites)

• Encryption Algorithm.

• Advanced Encryption Standard (AES 256)

• Data Integrity.

• Hashing Algorithm: SHA

• Diffie-Hellman Group 14

• Security Association Lifetime: 86400 seconds.

Phase 2 IPSEC Properties:

• Encryption Algorithm.

• Advanced Encryption Standard (AES 256)

• Data Integrity.

• Hashing Algorithm: SHA

• Perfect Forward Secrecy: Disabled.

DoIT staff will coordinate with the Vendor to ensure that any authorization/certificate paperwork required for the establishment of the VPN connection is completed.

Internet SSL/TLS Requirements for File Transfer Protocol If the Vendor’s only communication requirement is to send or receive data files, the connection may be made using secure FTP (FTPS using TLS 1.2) via the Internet. The Vendor will be responsible for the cost of the connection between the Vendor and its Internet Service Provider (ISP), troubleshooting, and any redundancy requirements associated with the Vendor’s connection to the Internet or for Disaster recovery. The Vendor is responsible for any costs associated with obtaining a secure FTP client that supports FTPS using TLS 1.2. The Vendor will be responsible for initiating the secure FTP sessions to the State of Illinois data center and perform any necessary firewall changes to reach the provided IP address and the associated control port and data ports.

Exchanging Configuration Information

DoIT staff will work with the Vendor to determine the configuration and define any connection parameters between the Vendor and the State of Illinois data center. This will include any security requirements DoIT requires for the specific connection type the Vendor is using. The Vendor is required to work with both HFS and DoIT in exchanging configuration information required to make the connection secure and functional for all parties.

Transmission Control Protocol/Internet Protocol (TCP/IP) The Vendor shall cooperate in the coordination of the interface with DoIT staff. TCP/IP (Transmission Control Protocol/Internet Protocol) must be used for all connections from the Vendor to the State of Illinois data center.

Firewall Devices

The Vendor shall be responsible for the installation, configuration, and troubleshooting of any firewall devices required on the Vendor’s side of the data communication link.