Cisco ISE SOW.docx

STATEMENT OF WORK (SOW)

for

AFSOC SOACS

Installation of Cisco ISE at

Cannon AFB, NM and Upgrade ISE servers at Hurlburt Field, FL

21 May 2024

1. AFSOC SOACS requires an ISE server suite (2) be installed and configured at Cannon AFB, New Mexico on a Government provided VM server suite. Hurlburt Field ISE servers and Cannon ISE servers must be able to update each other from either location. Cannon ISE will be a backup of the ISE servers at Hurlburt in case of natural disaster in Florida. This Statement of Work (SOW) outlines engineering services to install and configure existing government-owned Cisco ISE on the existing government-owned hardware with a level of understanding in accordance with industry best practices and DoD security requirements. Hurlburt Field ISE servers shall be upgraded to the latest Cisco recommended IOS, 3.2.0 minimum.

2. Requirements/Existing Equipment.

The AFSOC SOACS engineering and operations teams plan to use Cisco-based ISE software for a network solution that will provide security at the network edge. Servers will be based at both Cannon AFB NM and Hurlburt Field Florida and be able to update each other. There are two existing servers located at Hurlburt Field that will be upgraded. Layer 2/3 routing and switching infrastructure exists at the access and distribution layers. A high-density wireless LAN solution is also in place.

Requirements:

· Backup current ISE nodes, export a copy of internal CA Key and certificate chain.

· Upgrade two (2) ISE servers Virtual licenses and TACACS Node Licenses at Hurlburt Field

· Deploy two (2) new ISE VM and TACACS node licenses at Cannon AFB.

· Ensure devices are DoD security configuration compliant, DISA Security Technical Implementation (STIG)

· Test and validate configuration and provide a report.

· Configure backup setting on ISE.

Existing Network Equipment:

· Approximately 175 Cisco network switches - 9200, 9300, 9500, N9K

· 200 Cisco WAPs - C9120-AXI, C9130-AXI, AIR-3800

· Two Cisco 9800 WLCs

· 5 Cisco routers - ASR4331, ASR1001-X

· ASA devices Cisco - ASA1010, FPR2110,

· Palo Alto 3260 appliance firewalls – two at Hurlburt, two at Cannon

· Approximately 120 Dell and HP laptops and desktops with another 500 projected

3. The Government will be responsible for and provide the following:

· Provide VM space for ISE at Cannon AFB and Hurlburt Field.

· Provide IP addresses and DNS information as needed for both sites.

· Provide NTP addresses as needed.

· Provide SMTP information.

· Provide LDAP/AD information.

· Provide testing support

· Documentation/network topology as needed.

4. The vendor/contractor engineering team will be responsible for and provide the following:

· Two new ISE licenses (R-ISE-VMC-K9) for Cannon, upgrade existing licenses at Hurlburt

· Device configuration on up to 5 of each type of hardware (see above) with configuration guides to the remaining devices. Devices should be able to authenticate to either site.

· Coordination of the implementation AFSOC SOACS software installation to limit downtime during transition to the new gear and design.

· Successful testing:

· TACACS configuration

· 802.1x TLS EAPoL on switches (5 switches + 2 WLCs)

· 802.1x User/Password

· Windows User Authentication (wired) – deployment via Group Policy Objective (GPO) and MFA

· Templates for the above

· Training Guides to include:

· Documentation of new configurations

· Walk through of configurations

· Basic troubleshooting information

· Creation of as-built documentation with updated diagrams and build information to include system design files, IP addressing, device names, and software versions.

· Team needs to have a CCNP or technician with extensive ISE experience at the enterprise level.

5. Project schedule will be provided within ten (10) days of receipt of purchase order or signed contract. This schedule includes client milestones, design, configuration, on-site work, and customer training and is based on the assumptions listed above.