Attachment 5 - Q and A - Cisco ISE.pdf

July 8, 2024

P a g e 1 | 4

Solicitation: FA485524Q0041, Dated 26 June 2024 CANNON AFB - Cisco ISE Server Installation

Question & Answer

Can you confirm the deadline for questions and the proposal deadline?

• Amendment-0001: for dates posted on SAM.gov 27 June 2024.

• Updated questions due date to 3 July 2024 / 5:00 PM (MDT)

• Update answers to industry 8 July 2024 / 5:00 PM (MDT)

• Updated solicitation deadline to 10 July 2024 / 5:00 PM (MDT)

We would like to know if this is a brand-new contract OR if there is (was) an incumbent performing these services?

• This is a brand-new contract.

Is the licensing term for 1, 3 or 5 years?

Can you please clarify whether or not you the licensing term for 1year, 3years, or 5years please?

• 3 years

Do you require US Citizenship or security clearances for the engineering on this project?

Does the engineer need a clearance?

Is any clearance required to perform this work?

Are Any clearances required?

• Yes, the engineers need US citizenship & security clearances.

Can this be Remote or is onsite Required?

Is it required onsite at Hurlburt and Cannon?

Can the services be done remotely or does this need to be onsite?

Can you kindly confirm that this is for all on site only work or it can be hybrid – meaning, can our -SMEs do some work remote after initial design/discovery session over a VPN connection?

Does AFSOC allow for remote access to do a remote software upgrade for FL? Or will this upgrade need to be in person?

Does AFSOC support remote access for upgrade work at Hurlburt, or will onsite/travel to Hurlburt be required to complete work?

• All work needs to be done on sight at Cannon AFB only.

P a g e 2 | 4

Is all travel cost included in below estimated cost or it is separate?

If onsite, do we need to account for T&E in the SOW or will it be billed after the fact per diem on actual?

• Please include Travel and Expenses in Quote.

Is any training, documentation post-implementation support included as well in below estimated price?

• There should NOT be any post support required.

• Please see # 4. in the SOW: Training Guides to Include & Creation of as- built documentation…

Are you going to give one week extension after the Q&A?

Requesting a 5 day extension from the date Q&A response is received.

• No, we will not. Solicitation Closes 10 July 2024 at 5:00pm (MDT).

What ISE Personas are running on each of the nodes currently at Hurlburt?

• Running on VMware 7.0.3 build-23788036

• 2 Virtual machines running RHEL 7(would like to upgrade/replace with RHEL 9)

• Both VMs running ISE version 3.0.0.458 , patch 4

What is the current ISE version running at Hurlburt?

• Cisco ISE

What is the OEM for VM host to be provided? If VMware, please provide software level?

• VMWare 7.0.3 build-23788036

Can you confirm the following Bill of Materials is needed?

Part# Product Description Qty ISE-SEC-SUB Cisco Identity Service Engine Subscription 1 ISE-P-LIC Cisco Identity Service Engine Premier 150 SVS-ISSE-SUP-B Basic Support for Identity Service Engine Subscription 1 R-ISE-VMC-K9= Cisco ISE Virtual Machine Common PI 2 CON-ECMUS-RISE9KVM SOLN SUPP SWSS Cisco ISE Virtual Machine Common PID 2 FFP INSTALL SERVICES Design/Install/Configure/Test/Document/Train – Includes Travel 1

• Correct

P a g e 3 | 4

Do you also need TACACS licenses for Cannon AFB site or will you be using ones already procured for Hurlburt?

• Not necessary for this requirement.

You list approximately 620 devices on the network, but only requesting licenses for 150 concurrent connections? Are there existing licenses on Hurlburt Field site?

• 150 licenses are more than our Smart Account records display being used. If we start to see noncompliance, we will increase that amount.

What version is the current ISE deployment at Hurlbert?

• 3.0.0.458

Is the intent to extend the existing ISE deployment at Hurlburt?

• ISE is currently at Hurlburt extending to Cannon.

Do new policies need to be configured or will existing policies be used for Cannon AFB?

• Existing policies but a few modified.

Are all endpoints at these two sites (Hurlburt and Cannon) or are there remote?

• Only Servers at Hurlburt and Cannon however we have users and switches at other sites all connected via DISA circuits to Hurlburt and/or Cannon.

Who do you currently use for MFA?

• None currently but under review.

What are expectations for using MFA for endpoint authentication onto network or just via

TACACS?

• TACACS for access to network devices. MFA under review for clients.

With Palo FW integration or ASA integration, are you just wanting TACACS+ integration, or remote access VPN authentication as well?

• VPN access is through Palo Alto Global Connect.

P a g e 4 | 4

How detailed of training guides do you require? (i.e. to what length of troubleshooting guide is required?)

• Enough for configurations and maintenance.

Are there any other devices that will be allowed/authenticated onto the network (both wired and wireless) besides the 120 Dell/HP laptops and desktops plus 500 additional Dell laptops and desktops in the future? (i.e. printers, door access, etc.)

• Printers are using MAB as allowed per STIG guides. Wireless authentication to the network is planned but not implemented at this time. It would be an added benefit to include that in this project.

(End of Question & Answer)