Combined_Synopsis-Solicitation_Ltr_Palo_Alto_Firewalls_25May16.pdf

DEFENSE INFORMATION SYSTEMS AGENCY

DEFENSE INFORMATION TECHNOLOGY CONTRACTING ORGANIZATION

2300 E. Drive; Building 3600 Scott Air Force Base, Illinois 62225

May 25, 2016

1. This is a combined synopsis/solicitation to support the Navy’s requirement for commercial-off-the-shelf (COTS) firewall hardware and incidental services (extended support/maintenance, software subscriptions, etc.) at four different Naval shipyard locations. The specifics are as follows:

Solicitation Number HC1028-16-R-0016 Requirement Title Palo Alto Firewalls for Navy (Brand Name or Equal) Small Business Set-Aside Yes NAICS Code 541519

Contract Type Firm Fixed Price (FFP), Indefinite-delivery / Indefinite Quantity (ID/IQ)

Minimum/Maximum Contract Value

Minimum amount for this single award ID/IQ will be $3,000 for the entire 5-year period; the maximum contract ceiling amount is $9,300,000.

Partial Quotes Not Accepted Method of Evaluation Lowest Price Technically Acceptable (LPTA) Brand Name Requirement

No; this is Palo Alto Networks brand-name or equal. See Salient Characteristics, Attachment 2

SCRM Plan Required No Section 508 Applicable Yes - See Paragraph 4(a) for Specifics Options Included No; the resultant contract will consist of a 5-year base ordering period.

See Paragraph 4(c)(2)(c) for Specifics DD254 Required No Method of Payment Electronic; invoicing via WAWF Questions Due Date / Time June 1, 2016 / 1:00 PM CST

Proposal Due Date /Time June 13, 2016 / 1:00 PM CST Proposal Submittal Via email to the contracting POC Contracting POC Miguel A. Colunga-Huerta, miguel.a.colungahuerta.civ@mail.mil or

618-229-9571 Requested Delivery Date 30 days upon issuance of individual delivery order(s) Delivery Address Delivery is anticipated at the four shipyards outlined in Attachment 1.

The exact delivery locations for supplies/services to be rendered shall be outlined on the delivery orders issued, including delivery instructions and points of contact.

Travel Travel in and around the primary delivery locations may be required throughout the life of the contract. Additional travel within the continental United States may be required to support the requirements of this contract. Travel costs will be reimbursed based on actual costs and in accordance with the FAR 31.205-46 and the Federal Travel Regulations.

2. Vendors are requested to submit a price proposal in response to this solicitation on the attached Electronic Product List (EPL)/Material Inspection and Receiving Report (MI&RR) (EPL/MI&RR), incorporated as Attachment 1, and other applicable terms and conditions as listed in this solicitation and associated Attachments. All pricing must be inserted into Attachment 1 and provided as part of your proposal. Further information on submission of technical and price proposals is provided throughout this document.

3. Supply Chain Risk Management (SCRM) - Required Not Required When required, a determination has been made by the program office that the items to be purchased under this solicitation are subject to SCRM controls as outlined on Attachment. As a result, offerors will be required to submit a detailed SCRM plan as part of their technical proposal. Failure to present a SCRM plan with the proposal will deem the proposal non-responsive and it will be removed from further consideration.

If a SCRM concern arises after contract award, the Government will determine whether a continuation of the contract poses an undue risk to both the common defense and security to this nation. If the Government determines that such a risk exists, the Government reserves the right to accept or reject a proposed mitigation plan by the Offeror (if one or more is presented within a reasonable time) as negotiated by the Contracting Officer or terminate the contract for convenience.

4. Evaluation Factors and Basis for Award Determination:

a. This procurement is being conducted in accordance with Federal Acquisition Regulation (FAR) Subpart 12.6—Streamlined procedures for Evaluation and Solicitation for Commercial Items and Subpart 15.3—Source Selection, as supplemented by the Defense Federal Acquisition Regulation Supplement (DFARS). Award will be made to the offeror whose proposal is determined to represent the overall best value to the Government using an LPTA evaluation process. Proposals will be evaluated with regard to technical compliance and on price submissions. All aspects of Attachment 1 must be sufficiently addressed for a proposal to be considered for award. The proposal should include all information the offeror wants the Government to consider and evaluate regarding its company’s ability to conform to all required terms and conditions. With regard to the best value analysis for the award decision, the below evaluation factors and subfactors will be used in the determination of technical acceptability. If applicable, offerors must specifically address any Section 508 compliance in their proposal submission or their offer will be excluded from further consideration.

Compliance with Section 508 standards will be considered prior to evaluating any of the selection criteria listed below. Any proposal failing to meet the Section 508 Accessibility Standards shall be eliminated from consideration for award. The Section 508 Accessibility Standards applied to this requirement are as follows:

Section 508 Accessibility Standards

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 – Self-Contained, Closed Products

1194.26 – Desktop and Portable Computers

1194.41 – Information, Documentation and Support

Functional Performance Criteria

1194.31 – Functional Performance Criteria

b. The agency intends to award an FFP order using the LPTA methodology. After receipt of proposals, the Government will first evaluate the lowest price proposal. If the lowest price proposal is determined to be technically acceptable and otherwise properly awardable, no further evaluations will be conducted, and award will be made. If, however, the lowest price proposal is determined to be technically unacceptable and/or otherwise ineligible for award, further evaluations will be conducted.

c. The standards for determining technical acceptability are listed below. Proposals must be submitted on the attached EPL/MI&RR document in MS Excel format utilizing Attachment 1. Failure to provide pricing on the DISA-provided template (Attachment

1) may result in removal of your quote from further consideration. All formulas shall remain present in the spreadsheet for verification. The Government reserves the right not to consider for award any proposal that does not adhere to the administrative requirements of this solicitation.

(1) Technical Approach Factor: The Technical Subfactors will be evaluated and rated either Acceptable or Unacceptable IAW the evaluation table below. In order for a proposal to be rated overall Technically Acceptable, the offeror must be able to provide all of the equipment set forth in the Attachment 1, unless the equipment is no longer available. If a requested hardware item is end of life and no longer available from the Original Equipment Manufacturer (OEM), the offeror, at the direction of the OEM, can propose a substitution.

This substitution must be clearly identified in the proposal and documented with information from the OEM. All hardware items provided must be new products and not remanufactured, “gray market,” etc.

Each of the following subfactors must be rated Acceptable.

(a) Technical Subfactor 1 (Proof of OEM Authorized Reseller). Proposals must be from authorized resellers of the OEM quoted.

For the purposes of this procurement only, an authorized reseller is defined as an entity authorized by the OEM to sell their products to the Federal Government and to provide support for the OEM items, including new releases, version upgrades, revisions, corrections of reported errors, enhancements (to include instructions for implementation and operation for all software support levels and product versions), technical support, contractor resolutions to problems or failures, and the most current commercial release or version of the software.

The offeror shall provide a letter from the OEM confirming that the offeror is an authorized reseller, as defined above. The letter from the OEM shall not be older than

30 days from the date proposals are due, shall be submitted on the OEM's letterhead, and shall be signed by an authorized representative of the OEM.

(b) Technical Subfactor 2 (Capability to meet all required salient characteristics). To be considered for award, proposals of “equal” products, including “equal” products of Palo Alto Networks, the identified brand name manufacturer, must—

(1) Meet all of the salient physical, functional, or performance characteristic specified in Attachment 2 and insert a cross-reference in Attachment 2, Column B of where the characteristic(s) can be found in the offeror’s proposal;

(2) Clearly identify the item by—

(i) Brand name, if any; and

(ii) Make or model number;

(3) Include descriptive literature from the Original Equipment Manufacturer (OEM) such as technical data sheets, catalog pages, illustrations, or drawings identified in the Requirement Salient Characteristics document ; and

(4) Clearly describe any modification the offeror plans to make in a product to make it conform to the solicitation requirements. Mark any descriptive material to clearly show the modification.

(c) Technical Subfactor 3 (Completion of required attachments). In order to be deemed responsive, the offeror must provide the completed Attachments (EPL;

Required Salient Characteristics, and Provisions) in response to this solicitation.

Regarding the offerors’ representations and certifications (“Reps and Certs”), if the required fill-in provisions are available and up-to-date via the System for Award Management (SAM) database, the offeror should provide a statement to that fact. If all of the required information is not in SAM, the offeror shall complete the applicable information in Attachment 3.

Evaluation Table - Technical Ratings Rating Description

Acceptable Proposal meets the minimum requirements of the solicitation.

Unacceptable Proposal does not meet the minimum requirements of the solicitation.

(2) Price Factor:

(a) Price proposal will be evaluated and the Government reserves the right, but is not obligated, to perform a price realism analysis. The total evaluated price will consist of the offeror’s proposed price for all items listed on Attachment 1.

(b) Optional CLINs - Required Not Required When Optional CLINs are required, the total price evaluated will be the sum of all CLINs for the basic and all options. The inclusion of an option, however, does not obligate the Government to exercise the option.

5. DD254 - Required Not Required – When required, offerors must complete and submit with proposal Blocks 6, 7, and 8 of the DD Form 254 with the appropriate information for their companies and any subcontractors (when applicable).

6. IUID Tagging - Required Not Required The DoD has been directed to establish more stringent capital asset/equipment tracking procedures which necessitate collection of additional information throughout the acquisition cycle IAW DARS Clause 52.211-9000. In addition to gathering OEM product/part numbers and serial and lot numbers, certain items require Item Unique Identification (IUID) tags IAW DFARS clause 252.211-7003. To assist contractors in identification of which items are required to be shipped with IUID tags, the Government is now providing up front notification of the items on Attachment 1 (EPL/MI&RR).

7. Please provide your business size, taxpayer identification (TIN), CAGE code, DUNS, discount terms, and estimated delivery date with your proposal. At a minimum, the offeror must provide the same warranty terms offered to the general public for products purchased. Information regarding the standard OEM hardware warranty (terms, effective date and duration) for all items must be included with the proposal.

8. Partial proposals of the listed items will be accepted. not be accepted.

9. Completeness of Pricing Proposals. The Federal Government is exempt from sales tax. If requested, the Contracting Officer can provide a tax exempt certificate after award. However, if there are any valid applicable taxes such as the Arizona Half Tax or Hawaii GET for services, offerors must include the costs in their quote as a separate line item. Such taxes will not be considered or paid unless they are included in the quote at the time of submission. Price proposals must be complete at the time of submission.

10. Delivery Address. Quoted prices shall include all costs associated with delivering the required items to the delivery address listed in Attachment 1.

11. Requested Delivery Date: All items are to be delivered no later than the date identified in paragraph 1 above. Offerors are required to obtain delivery quotes from the OEM for all equipment listed on Attachment 1 in order to provide anticipated delivery information in their proposal.

Failure to provide on time delivery may result in actions taken against the contractor by the Government. Late deliveries may result in negative ratings on the Contractors Performance Assessment Report.

12. The Government intends to evaluate proposals and award a contract without exchanges with offerors. However, the Government reserves the right to conduct exchanges or seek clarifications if the Contracting Officer determines they are necessary. The Government further reserves the right to reduce the number of proposals being competitively considered to the greatest number that will permit efficient competition among the most highly rated proposals. If an offeror’s proposal is removed from further consideration for award, written notice of the removal will be provided to the offeror.

13. Attachment 3 contains provisions that apply to this solicitation and clauses that will be applicable to the resulting award. Some of the provisions require a response from the contractor and must be submitted along with your proposal.

14. In response to this solicitation, no terms, conditions, or assumptions will be entertained. If terms, conditions, or assumptions are included in a proposal, the proposal may be excluded because it failed to comply with the solicitation instructions.

15. All proposals received in response to this solicitation shall remain valid for 60 calendar days from the proposal due date below. Further, should you be awarded this contract, the contractor will furnish the items and/or services identified in its proposal at the price quoted to the designated point(s) within the time specified in the contract.

Regards, DEBRA L. POWELL-SCHAFFER

Contracting Officer

Attachments:

1 EPL/MI&RR

2 Required Salient Characteristics (Palo Alto Networks brand name or equal) 3 FAR, DFARS, and DARS Provisions & Clauses

POWELL-

SCHAFFER.DEBRA.L.13

67377000

Digitally signed by POWELL-

SCHAFFER.DEBRA.L.1367377000

DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=DISA, cn=POWELL-

SCHAFFER.DEBRA.L.1367377000

Date: 2016.05.25 14:57:32 -05'00'

Sheet1

Columns under this green row form the basis for Contractor's Price Proposal

When completed, the columns under this goldenrod row fulfill the requirements to submit an Electronic Products List (EPL) IAW DARS 52.211-900 (Completed by Awarded Contractor)

0001 or Equal Palo Alto PA 7050 Consists of:

0001AA or Equal Palo Alto PAN-PA-7050-AC High performance NGFW (Next Generation Firewall) that supports the demands of an Enterprise Data Center. The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 2TB RAID 1 configuration, with options to offload/export system log files. 12 EA $ - 0 $ - 0

0001AB or Equal Palo Alto PAN-PWR-C19- US Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long. 48 EA $ - 0 $ - 0

0001AC or Equal Palo Alto PAN-SVCPREMUSG-7050 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware. 12 EA $ - 0 $ - 0

0001AD or Equal Palo Alto PAN-PA-7050-TP-HA2 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall. 12 EA $ - 0 $ - 0

0001AE or Equal Palo Alto PAN-PA-7050-GP-HA2 1 year mobile device security management subscription for a high availability firewall, fully integated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems. 4 EA $ - 0 $ - 0

0001AF or Equal Palo Alto PAN-PA-7050-WF-HA2 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed. 12 EA $ - 0 $ - 0

0001AG or Equal Palo Alto PAN-PA-7050-URL4-HA2 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption. 12 EA $ - 0 $ - 0

Performance Requirements:

Minimum 115Gbps Application ID throughput

Over 700,000 connections per second

Over 20,000,000 maximum sessions

Interface type and speed: 48 each 10/100/1000Mbps, 32 each 1Gbps SFP, 16 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management

Minimum 2TB with option to 4TB (4x1) storage

Redundant power supplies

0002 or Equal Palo Alto Expansion Card for PA 7050 or Equal Palo Alto PAN-PA-7000-20G-NPC Network Processing Card to expand the port capacity and interface options for a high performance, high availabilty datacenter firewall. ** Expansion Card Performance Requirements: Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+ Firewall throughput : 20 Gbps Maximum number of sessions : 4,000,000 34 EA $ - 0 $ - 0

0003 or Equal Palo Alto Blank Card Cover for PA 7050 or Equal Palo Alto PAN-PA-7000-BLNK-OSF Blank card, if needed, for installation in an empty slot of a high performance, high availabilty datacenter firewall. 58 EA $ - 0 $ - 0

0004 or Equal Palo Alto Palo Alto PA 5060 Consists of:

0004AA or Equal Palo Alto PAN-PA-5060-SSD2 High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files. 10 EA $ - 0 $ - 0

0004AB or Equal Palo Alto PAN-PWR-C19- US Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long. 20 EA $ - 0 $ - 0

0004AC or Equal Palo Alto PAN-SVCPREMUSG-5060 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware. 10 EA $ - 0 $ - 0

0004AD or Equal Palo Alto PAN-PA-5060-TP-HA2 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall. 10 EA $ - 0 $ - 0

0004AE or Equal Palo Alto 15 PAN-PA-5060-GP-HA2 1 year mobile device security management subscription for a high availability firewall, fully integated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems. 2 EA $ - 0 $ - 0

0004AF or Equal Palo Alto PAN-PA-5060-WF-HA2 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed. 6 EA $ - 0 $ - 0

0004AG or Equal Palo Alto PAN-PA-5060-URL4-HA2 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption. 6 EA $ - 0 $ - 0

Performance Requirements

Minimum 18Gbps Application ID throughput

Over 110,000 connections per second

Over 3,800,000 maximum sessions

Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management

Minimum 120GB with option to 240GB

Redundant power supplies

0005 or Equal Palo Alto Palo Alto 3050 Consists of:

0005AA or Equal Palo Alto PAN-PA-3050 High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files. 16 EA $ - 0 $ - 0

0005AB or Equal Palo Alto PAN-PWR-C19- US Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long. 32 EA $ - 0 $ - 0

0005AC or Equal Palo Alto PAN-SVCPREMUSG‐3050 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware. 16 EA $ - 0 $ - 0

0005AD or Equal Palo Alto PAN-PA-3050-TP-HA2 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall. 16 EA $ - 0 $ - 0

0005AE or Equal Palo Alto PAN-PA-3050-GP-HA2 1 year mobile device security management subscription for a high availability firewall, fully integated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems. 3 EA $ - 0 $ - 0

0005AF or Equal Palo Alto PAN-PA-3050-WF-HA2 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed. 14 EA $ - 0 $ - 0

0005AG or Equal Palo Alto PAN-PA-3050-URL4-HA2 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption. 16 EA $ - 0 $ - 0

Performance Requirements

Minimum 2.5 Gbps Application ID throughput

Over 48,000 connections per second

Over 480,000 maximum sessions

Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management

Minimum 120GB

Redundant power supplies

0006 or Equal Palo Alto Palo Alto 3020 Consists of:

0006AA or Equal Palo Alto PAN-‐PA-‐3020 High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files. 22 EA $ - 0 $ - 0

0006AB or Equal Palo Alto PAN-PWR-C19- US Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long. 44 EA $ - 0 $ - 0

0006AC or Equal Palo Alto PAN-SVCPREMUSG‐3020 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware. 22 EA $ - 0 $ - 0

0006AD or Equal Palo Alto PAN-PA-3020-TP-HA2 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall. 22 EA $ - 0 $ - 0

0006AE or Equal Palo Alto PAN-PA-3020-GP-HA2 1 year mobile device security management subscription for a high availability firewall, fully integated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems. 2 EA $ - 0 $ - 0

0006AF or Equal Palo Alto PAN-PA-3020-WF-HA2 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed. 8 EA $ - 0 $ - 0

0006AG or Equal Palo Alto PAN-PA-3020-URL4-HA2 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption. 10 EA $ - 0 $ - 0

Performance Requirements

Minimum 1.5 Gbps Application ID throughput

Over 48,000 connections per second

Over 245,000 maximum sessions

Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management

Minimum 120 GB

Redundant power supplies

0007 or Equal Palo Alto Palo Alto Management Console

0007AA or Equal Palo Alto PAN-M-100-4TB NGFW Management Console appliance. The Management Console is a purpose built appliance and software combination to support the configuration and log file storage for the NGFW. The Management Console has a RAID storage with a minimum of a usable 4TB of storage. Up to 100 NGFW devices can be managed. 14 EA $ - 0 $ - 0

0007AB or Equal Palo Alto PAN-M-P-100 Panaorama centralized software mgmt. license. Up to 100 devices supported 14 EA $ - 0 $ - 0

0007AC or Equal Palo Alto PAN-SVC-PREM-M-100-P-100 Premium support year 1, M-100 14 EA $ - 0 $ - 0

Palo Alto Accessories

0008 or Equal Palo Alto PAN-SFP-PLUS-SR SFP+ SR 10GigE transceiver 310 EA $ - 0 $ - 0

0009 or Equal Palo Alto PAN-SFP-SX SFP SX transceiver 310 EA $ - 0 $ - 0

0010 or Equal Palo Alto PAN-CONSULT SME for firewall consulting services for user ingest strategies, rules and policy creation, transition strategy, code updates, and installation tasks leading up to the and including live cutover.(per day) 108 DAYS $ - 0 $ - 0

0011 or Equal Palo Alto PAN-CONSULTCUTOVER-1HR SME for firewall consulting services for the cutover of high performance, high availabilty firewalls. (Hourly) 96 HOURS $ - 0 $ - 0

0012 or Equal Palo Alto PAN-CONSULT-TE Travel expenses for consulting services for high performance, high availabilty firewalls. All travel arrangements will first be coordinated and approved by the Government. Costs for approved travel will be reimbursed based on actual costs and in accordance with the FAR 31.205-46 and the Federal Travel Regulations 1 LOT NTE $432,000.00 NTE $432,000.00

0013 or Equal Palo Alto PAN-EDUONSITE-5DAY-16 On-Site training 5-Day course for high performance, high availabilty firewalls for up to 16 students. 4 EA $ - 0 $ - 0

0014 or Equal Palo Alto PAN-EDUONSITE-2DAY-16 On-Site training 2-Day course for high performance, high availabilty firewalls for up to 16 students. 4 EA $ - 0 $ - 0

0015 or Equal Palo Alto WF-500 Malware analysis capabilty, fully integrated with the firewall solution, to offload files for analysis of their behavior when opened or executed. 4 EA $ - 0 $ - 0

0016 or Equal Palo Alto GP-100 Mobile device security manager, fully integated with the firewall solution. to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems. 4 EA $ - 0 $ - 0

GRAND TOTAL (IDIQ CEILING) $ 432,000.00

DELIVER ITEMS TO: PORTSMOUTH NAVAL SHIPYARD

Office Name/Symbol

Address Bldg. 170, 6th Floor

City, State and Zip+4 Kittery, ME 03904

POC Name, Phone, Fax and Email

DELIVER ITEMS TO: Norfolk Naval Shipyard

Office Name/Symbol

Address Bldg 74

City, State and Zip+4 Portsmouth, VA 23709

POC Name, Phone, Fax and Email

DELIVER ITEMS TO: Puget Sound Naval Shipyard

Office Name/Symbol

Address Bldg 850-A, 5th floor, 1400 Faragut Ave.

City, State and Zip+4 Bremerton, WA 98314

POC Name, Phone, Fax and Email

DELIVER ITEMS TO: Pearl Harbor Naval Shipyard

Office Name/Symbol

Address Bldg 167-5

City, State and Zip+4 JBPHH, HI 96860

POC Name, Phone, Fax and Email

Note: IF IUID Tag is not required for a CLIN, row should be blacked out in Column M. If field is blank, Contractor will be required to register and provide IUID tags.

&F

All Models

Offeror Name:

Salient characteristics for all Firewall models (must meet or exceed) Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

1. The next generation firewall must support application identification and options for intrusion detection scanning (IDS), intrusion prevention scanning (IPS), and URL filtering all on a single platform with a single browser based GUI for configuration management.

2. The firewall must be manageable via a central management console. The firewall and management console must support a local configuration (for on-site operators) and central configuration (for operators at a centralized headquarters) simultaneously.

3. The next generation firewall management interface must also support multiple roles for different types of operators. As an example a role for network operations, a role for security policy, and a role for IA auditing.

4. Hardware based firewalls must separate the management plane from the data forwarding plane. Management plane must have its own dedicated CPU, memory, and storage for managing the device and generating reports. The dataplane must have its own dedicated CPUs and memory for inspecting traffic and forwarding packets.

5. The firewall must classify all applications on all ports all the time. All traffic must be classified regardless of IP port, encryption (SSL or SSH), or evasive techniques employed. Unidentified applications – typically a small percentage of traffic, yet high in potential risk – must be automatically categorized for systematic management. The firewall must use applications and users as the basis of security policy – all access control decisions will be based on that information.

6. The Firewall OS must have a protection profile by the NIAP Evaluation and Validation Program. Protection Profiles must be listed at the NIAP website or documentation provided to verify there is a protection profile in place for the firewall being used on the network that has been evaluated at one of the accredited NIAP locations.

7. Must support SNMP ver. 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.

8. The network device must drop half-open TCP connections through filtering thresholds or timeout periods.

9. Device must support the use of authentication, authorization and accounting servers for access to the device for management i.e. RADIUS/TACACS+

10. Must support administrative access using SSH version 2

11. Alerts automatically generated to notify administrator when log storage reaches seventy-five percent or more of its maximum capacity.

12. Device will be able to disable or uninstall unused services.

13. Granular IPv6 control.

14. Administration through non graphical means i.e. Command Line Interface (CLI) is a requirement.

15. Call home service or feature disable ability.

16. Traffic prioritization and bandwidth reservation.

17. Granular ICMP control.

18. Full support of VMWare NSX. To support interoperability and reduce operational cost, vendor product line should also have a virtual server software platform meeting the same requirements, with the exception of throughput and physical connections. Supported platforms must include ESXi. The firewall and management console must support integration with software defined network (SDN) orchestrations systems. - Vmware NSX and OpenStack must be supported at a minimum.

19. The selected firewall must have predefined applications written to work with the corporate log review solution SPLUNK.

20. The device hardware and software must not have a projected End-of-Support date closer than 60 months from delivery date.

21. Must be configurable as a High Availability pair in an “Active-Standby” configuration.

User ID/Authorization Requirements

22. The firewall must have the ability to map IP addresses to users and support security policy definition based upon users and groups.

23. The firewall must be able to map users to IP addresses with both a software agent or directly from the firewall.

24. The firewall must be able to map users to IP addresses by Captive Portal and Active Directory/LDAP information stores.

25. Firewall must be able to support DoD CAC authentication for account access for each role.

26. Must support a minimum of 8 each, 10 GB (line rate) connections in a single chassis.

Content Inspection Requirements

27. All firewalls must perform L7 application identification at 90%+ of firewall rated performance under documented real-world (i.e. not UDP-only) traffic loads. The firewall must deny unknown traffic.

28. Firewall documentation must detail how the operator can create custom application signatures without having to load new software or databases

29. Verifiable throughput of mixed traffic type with all Firewall features turned on of a minimum of 60GB in a single chassis.

30. The firewall must perform threat inspection of known signatures at 50% of the firewall's rated throughput, while simultaneously maintaining 90%+ L7 performance

31. The firewall must be able to select files for forwarding, with negligible (<1%) performance impact), to a local appliance for unknown malware detection. It must also accept local signature insertion from that appliance into its threat database with turnaround time within 15 minutes.

32. The firewall must support URL filtering capability which adds a categorical URL database functionality to the device for use as a URL and Web Content filter. URL categories must be able to be used to define security policy, complementing the application level control as well as to define SSL decryption exceptions, to determine quality-of-service policy and more.

33. The Firewall should be able to identify the following applications by default.

Adobe-connect

Adobe-meeting

Adobe-meeting-file-transfer

Adobe-meeting-remote-control

Youtube

Youtube-posting

Youtube-uploading

Citrix

HTTP-Audio

HTTP-Proxy

HTTP-Tunnel

HTTP-Video

Applications/Services needed for Microsoft servers and workstations

Active Directory

Active Directory Management Gateway Services

Global Catalog

LDAP

IPsecISAKMP

NAT-T

RPC (including on randomly allocated high tcp ports)

SMB

DataBase

Mssql

Oracle

Microsoft SharePoint

Sharepoint-admin

Sharepoint-posting

Sharepoint-calendar

Sharepoint-documents

Management Requirements

34. The firewall must have on-box reporting and logging; additionally both global and local rules should be enabled for central and remote operators from the same UI with role-based privileges. Last, the firewall must continue to log all events during configuration, operational, and service maintenance windows

35. The management system must be able to set bandwidth-shaping policies based on user, time-of-day, and application--or a combination of any of these variables.

36. Firewall must be configurable via a REST API or equivalent.

37. Reports on the firewall must be available via REST API or equivalent.

38. The firewall must be able to identify unused rules.

39. Operators must have the ability to intermix port/protocol rules with app-based rules.

40. Dashboard traffic reports. System must have both standardized and customizable reports.

41. Must be able to display DoD approved warning banner prior to system administrator logging in.

42. Device must log administrator logons, changes to administrator group and account lockouts.

43. The device console port must be able to time out after 10 minutes or less.

44. Management connections to the device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.

45. Management connections for administrative access must be configurable to time out after 10 minutes or less of inactivity.

46. Device must be configurable to timeout after 60 seconds or less for incomplete or broken SSH sessions.

47. Device must be configurable to reset interface after 3 unsuccessful SSH login attempts.

48. Must not allow SSH ver. 1 for administrative access.

49. Must support 802.1Q tags.

50. Must be configurable for NTP authentication.

51. Auxiliary port must be able to be disabled.

52. Admin configurable End-User notification for policy violations or filtering events.

53. To allow for a smooth transition to the new firewalls, the vendor will have an application that would allow exporting the current McAfee Firewalls configuration to the Next Generation Firewall with little to no additional configuration changes.

54. To allow for a Secure and Policy enforced deployment, the device will have a published or in-draft DISA STIG that supports requirements in NIST 800-53.

**NOTE: Please see below Tabs for individual Model specifications.

Model 1

Offeror Name:

Salient characteristics for firewall PA 7050 or equal (must meet or exceed) Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

55. High performance NGFW (Next Generation Firewall) that supports the demands of an Enterprise Data Center. The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 2TB RAID 1 configuration, with options to offload/export system log files.

56. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.

57. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.

58. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.

59. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

60. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.

61. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.

62. Minimum 115Gbps Application ID throughput.

63. Over 700,000 connections per second.

64. Over 20,000,000 maximum sessions.

65. Interface type and speed: 48 each 10/100/1000Mbps, 32 each 1Gbps SFP, 16 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management

66. Minimum 2TB with option to 4TB (4x1) storage.

67. Redundant power supplies.

68. Expansion Card: Network Processing Card to expand the port capacity and interface options for a high performance, high availability datacenter firewall. ** Expansion Card Performance Requirements: Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+

Firewall throughput : 20 Gbps

Maximum number of sessions : 4,000,000

69. Blank Card Cover. Blank card, if needed, for installation in an empty slot of a high performance, high availability datacenter firewall.

Model 2

Offeror Name:

Performance Requirements for PA 5060 or equal (must meet or exceed) Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

70. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files.

71. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.

72. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.

73. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.

74. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

75. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.

76. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.

77. Minimum 18Gbps Application ID throughput

78. Over 110,000 connections per second

79. Over 3,800,000 maximum sessions

80. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management

81. Minimum 120GB with option to 240GB

82. Redundant power supplies

Model 3

Offeror Name:

Performance Requirements for PA 3050 or equal (must meet or exceed) Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

83. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files.

84. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.

85. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.

86. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.

87. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

88. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.

89. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.

90. Minimum 2.5 Gbps Application ID throughput

91. Over 48,000 connections per second

92. Over 480,000 maximum sessions

93. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management

94. Minimum 120GB

95. Redundant power supplies

Model 4

Offeror Name:

Performance Requirements for PA 3020 or equal (must meet or exceed) Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

96. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files.

97. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.

98. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.

99. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.

100. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

101. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.

102. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.

103. Minimum 1.5 Gbps Application ID throughput

104. Over 48,000 connections per second

105. Over 245,000 maximum sessions

105. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management

107. Minimum 120 GB

108. Redundant power supplies

Firewall Mgt, Acc & Svcs

Offeror Name:

Firewall Management Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)

109. NGFW Management Console appliance. The Management Console is a purpose built appliance and software combination to support the configuration and log file storage for the NGFW. The Management Console has a RAID storage with a minimum of a usable 4TB of storage. Up to 100 NGFW devices can be managed.

110. Panaorama centralized software mgmt. license. Up to 100 devices supported

111. Premium support year 1 for management console.

Accessories and Services

112. SFP+ SR 10GigE transceiver

113. SFP SX transceiver

114. SME for firewall consulting services for user ingest strategies, rules and policy creation, transition strategy, code updates, and installation tasks leading up to the and including live cutover.(per day)

115. SME for firewall consulting services for the cutover of high performance, high availability firewalls. (Hourly - 4 hour minimum)

116. Travel expenses for consulting services for high performance, high availability firewalls.

117. On-Site training course for high performance, high availability firewalls for 5 days for up to 16 students.

118. On-Site training course for high performance, high availability firewalls for 2 days for up to 16 students.

119. Malware analysis capability, fully integrated with the firewall solution, to offload files for analysis of their behavior when opened or executed.

120. Mobile device security manager, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

HC1013-16-R-0016

Attachment 3

PROVISIONS/CLAUSES

CLAUSES INCORPORATED BY REFERENCE

52.203-3

Gratuities

APR 1984

52.203-6 Alt I

Restrictions On Subcontractor Sales To The…