Q As_Round_3_30June2016.xlsx
XLSX spreadsheet 34 KB Posted
- Solicitation number
- HC102816R0016
- Issued by
-
Defense Information Systems Agency
About this file
Q As Round 3_30Jun2016
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Revision_3_to_Attach_2__Salient_Characteristics.xlsx | XLSX spreadsheet | |
| Atch_1_-_30Jun2016.xls | XLS spreadsheet | |
| Q As_Round_2_24June2016.xlsx | XLSX spreadsheet | |
| Revison_2_to_Atch_2_24Jun2016.xls | XLS spreadsheet | |
| Revison_1_to_Atch_2.xls | XLS spreadsheet | |
| Q As_Round_1_16Jun2016.xls | XLS spreadsheet | |
| Atch_1_-_EPL _MI RR _Price_Workbook.xls | XLS spreadsheet | |
| Atch_2_-_Salient_Characteristics.xlsx | XLSX spreadsheet | |
| Combined_Synopsis-Solicitation_Ltr_Palo_Alto_Firewalls_25May16.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q&As Round 1 (Closed)
| Question # | Document | Description | Question/Clarification | Government Response |
| 1 | Atch 2 - Salient Characteristics.xlsx | All Models Tab - Content Inspection Requirements: |
27. All firewalls must perform L7 application identification at 90%+ of firewall rated performance under documented real-world (i.e. not UDP-only) traffic loads. The firewall must deny unknown traffic.
29. Verifiable throughput of mixed traffic type with all Firewall features turned on of a minimum of 60GB in a single chassis.
30. The firewall must perform threat inspection of known signatures at 50% of the firewall's rated throughput, while simultaneously maintaining 90%+ L7 performance
| 31. The firewall must be able to select files for forwarding, with negligible (<1%) performance impact), to a local appliance for unknown malware detection. It must also accept local signature insertion from that appliance into its threat database with turnaround time within 15 minutes. | During the evaluation, will the Navy require responders to validate “performance compliance" claims based on documented, real-world application traffic mix (e.g., not "UDP only" tests)? | Yes | |
| 2 | Atch 2 - Salient Characteristics.xlsx | All Models Tab - Content Inspection Requirements: | |
| 29. Verifiable throughput of mixed traffic type with all Firewall features turned on of a minimum of 60GB in a single chassis. | For evaluation purposes, does the Navy define the statement “all Firewall features turned on,” as simultaneous L7, AV, Spyware, and Vulnerability operation? | Each Model Tab has a throughput requirement defined. | |
| 3 | Atch 2 - Salient Characteristics.xlsx | All Models Tab: Items 26 and 29 are characteristics that are only supported on the 7050 model. These are incorrectly applied to all models. |
26. Must support a minimum of 8 each, 10 GB (line rate) connections in a single chassis
| 29. Verifiable throughput of mixed traffic type with all Firewall features turned on of a minimum of 60GB in a single chassis. | Items 26 and 29 in the All Models Tab should be moved to Model 1 Tab, which pertains to the 7050. | Items updated | |||
| 4 | Atch 2 - Salient Characteristics.xlsx | Model 2 Tab: Item 70 Performance Requirements for PA 5060 are incorrectly copied from Model 1 Salient characteristics for firewall PA 7050. | |||
| Per manufacturer specifications, this item should read as follows: 70. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1 and 10 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files. | |||||
| Model 2 tab updated | |||||
| 5 | Atch 2 - Salient Characteristics.xlsx | Model 3 Tab: Item 83 Performance Requirements for PA 3050 are incorrectly copied from Model 1 Salient characteristics for firewall PA 7050. | |||
| Per manufacturer specifications, this item should read as follows: 83. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 120GB, with options to offload/export system log files. | Model 3 tab updated | ||||
| 6 | Atch 2 - Salient Characteristics.xlsx | Model 3 Tab: Item 95. Redundant power supplies | |||
| Please remove Redundant Power Supplies from the description. This is not a characteristic of Model PA 3050. | Model 3 tab updated | ||||
| 7 | Atch 2 - Salient Characteristics.xlsx | Model 4 Tab: Item 96 Performance Requirements for PA 3020 are incorrectly copied from Model 1 Salient characteristics for firewall PA 7050. | |||
| Per manufacturer specifications, this item should read as follows: 96. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1 and 10 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 120GB, with options to offload/export system log files. | Model 4 tab updated | ||||
| 8 | Atch 2 - Salient Characteristics.xlsx | Model 4 Tab: Item 108. Redundant power supplies | |||
| Please remove Redundant Power Supplies from the description. This is not a characteristic of Model PA 3020. | Model 4 tab updated | ||||
| 9 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0004AA description is incorrect. | Please update to match the correction made to Model 2: Item 70 Performance Requirements for PA 5060 on Atch 2 - Salient Characteristics worksheet | Concur | |
| 10 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0005AA description is incorrect. | Please update to match the correction made to Model 3: Item 83 Performance Requirements for PA 3050 on Atch 2 - Salient Characteristics worksheet | Concur | |
| 11 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0005 Performance Requirements | Please remove Redundant Power Supplies from the description. This is not a characteristic of Model PA 3050. | Concur | |
| 12 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0006AA description is incorrect. | Please update to match the correction made to Model 4: Item 96 Performance Requirements for PA 3020 on Atch 2 - Salient Characteristics worksheet | Concur | |
| 13 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0006 Performance Requirements | Please remove Redundant Power Supplies from the description. This is not a characteristic of Model PA 3020. | Concur | |
| 14 | Atch 2 - Salient Characteristics.xlsx | Model All Models Tab: Item 4. Management and data forwarding planes | |||
| This is a Palo Alto specific requirement. It is not clear what the specific issue is being addressed for example firewall up time or management interface access availability. I think this requirement should be removed. | Having a separate plane (processor, memory, and disk space) for management ensures that an administrator will always have access to the device in the event of a denial of service or other network event. Processing of network traffic will not have a negative impact on system management or logging. | ||||
| 15 | Atch 2 - Salient Characteristics.xlsx | Model All Models Tab: Item 19. Splunk App | This is a Palo Alto specific requirement. It is not clear what the specific issue sense merely having an app is the requirement. Requiring a firewall to integrate with Splunk is a measurable requirement. | Not Palo Alto specific. The firewall must be supported by Splunk via a vendor-specific Splunk App or Splunk Add-On http://www.splunk.com/en_us/products/apps-and-add-ons.html | |
| 16 | Atch 2 - Salient Characteristics.xlsx | Model All Models Tab: Item 54. DISA STIG | This is a Palo Alto specific requirement. Most follow industry best practice and RMF guidelines. | Not Palo Alto specific. Specific STIGs are available for several specific firewall vendors. | |
| 17 | Atch 2 - Salient Characteristics.xlsx | Model All Models Tab: Item 51. Auxiliary Port Lock | This is a Palo Alto specific requirement. This seems more like a optional requirement. Most installation keep this active for out of band management. | Not Palo Alto specific. This is a very common requirement for firewalls and most network devices. | |
| 18 | Atch 2 - Salient Characteristics.xlsx | Model Model 1, Model 2, Model 3, and Model 4 | The requirements as stated are merely copied from Palo Alto. Some of the key requirements are missed. 1. SSL Inspection throughput 2. IPS Throughput 3. Firewall Inspection Throughput 4. VPN throughput | The characteristics are Palo Alto or equivalent. | |
| 19 | Atch 2 - Salient Characteristics.xlsx | Model Model 1, Model 2, Model 3, and Model 4 | The hard drive requirement is a Palo Alto requirement. What do you want the firewall to do? An example would be to retain log files for 5 days in the event log collection server is offline. Some vendors use SSD drives for better performance. I think this requirement should be rewritten. | Hard drive requirement is for any vendor's firewall. | |
| 20 | Atch 2 - Salient Characteristics.xlsx | Model Model 1, Model 2, Model 3, and Model 4 | The AppIication ID throughput requirement is a Palo Alto requirement and represents the performance of turning on one feature. This feature is not representative of all the features that will be enable so it is a misleading statistic. This should be rewriten based on all the features you plan to utilize for example IPS, URL content filtering, spam, and AV. | The App ID (Layer 7) throughput is one of the many requirements for any vendor's firewall. | |
| 21 | Atch 2 - Salient Characteristics.xlsx | Model Model 1, Model 2, Model 3, and Model 4 | The port density requirements seem to based on what Palo Alto supports. The requirements step down the Polo Alto model line. These specs are normally based on usage like Data Center (High Density of ports), Boundary (lower density of high speed ports), Enclave firewall, etc | The port density is needed varies based on the use of the firewall (data center .vs. boundary, etc.) | |
| 22 | Atch 2 - Salient Characteristics.xlsx | Model Firewall MGT: #109 | These requirements are a cut and paste from Palo Alto instead of actual management requirements. The requirement to mange up to 100 devices is what dictates how much storage a vendor needs. The requirement on 4TB should be removed. | The management console must be purpose-built for the management of up to 100 firewalls and have 4TB minimum of RAID storage. | |
| 23 | Atch 2 - Salient Characteristics.xlsx | Model Firewall MGT | Why is a Mobile device requirement placed on the firewall management? This seems totally out of place. | Not Firewall MGT. This is listed under Accessories and Services. | |
| 24 | Atch 2 - Salient Characteristics.xlsx | Model Firewall MGT: #110 | This requirement should be Panorama or equivalent. | Changed to read Panaorma or equivalent. | |
| 25 | Atch 1 - EPL MI RR, Price Workbook.xls | CLIN 0016, PAN-GP-100 | This CLIN/part number is end-of-life with Palo Alto. Can we leave the SKU off the response? | Yes. | |
| End of Q&As Round 1. For *NEW* quesitons, due on 6/20/2016, please use the workbook's tab bewow titled "Q&A Round 2" |
Q&As Round 2 (Closed)
| Question # | Document | Description | Question/Clarification | Government Response |
| 1 | Revision 1 to Attach 2, Salient Characteristics | Requirement 29. Verifiable throughput of mixed traffic type with all Firewall features turned on of a minimum of 60GB in a single chassis | The requirement for “a single chassis” is vendor specific and appears to arbitrarily limit compliance. Will the government restate the requirement in terms of Space/Weight/Power or other functional need vice vendor specific packaging? | The single chassis requirement is specified in order to eliminate the architectural and mangement complexities that multiple smaller firewalls create. |
| 2 | Revision 1 to Attach 2, Salient Characteristics | Requirement 65. Interface type and speed: 48 each 10/100/1000Mbps, 32 each 1Gbps SFP, 16 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management | The stated performance requirements appear vendor specific. Are the stated requirements minimum or maxim? Can the performance requirements be stated against each of the models? | The stated performance requirements are minimums. The performance requirements are stated for each model, as indicated. |
| 3 | Revision 1 to Attach 2, Salient Characteristics | Requirement 80. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management | The stated performance requirements appear vendor specific. Are the stated requirements minimum or maxim? Can the performance requirements be stated against each of the models? | The stated performance requirements are minimums. The performance requirements are stated for each model, as indicated. |
| 4 | Revision 1 to Attach 2, Salient Characteristics | Requirement 120. Mobile device security manager, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems | a) The government deleted the device associated with this requirement - CLIN 0016, PAN-GP-100, as a result of the Q&A. Will the government delete this requirement as well? |
b) The US Navy has selected the Good Technology's HP mobile management solution leveraging good for enterprise (GFE) to secure official government data on multiple mobile device platforms. Please confirm that this requirement is to interoperate with the Good Technology platform selected and provide appropriate detail on the GFE solution
| Requirement 120, on tab "Firewall Mgt, Acc and Svcs" is to be deleted. There is no Good Technology interoperability requirement. | |||||
| 5 | Amendment Q&As Round 1 | Response to Question 1, regarding Requirements 27, 30, 31. | The question posed was, "During the evaluation, will the Navy require responders to validate “performance compliance" claims based on documented, real-world application traffic mix (e.g., not "UDP only" tests)? The response to the question was, "Yes." Please clarify if this response means that the Navy intends to conduct a benchmark during the evaluation of proposals. If it does not, intend to conduct a benchmark, what is the exact traffic mix/load that DISA is asking vendors to use when documenting claims since the term "real-world traffic loads is not defined in these requirements and is therefore subject to each vendor's interpretation. | The government will review throughput test conducted by independent test labs. In the event that no independent throughput test are available, the government will consider the vendor's advertised performance and may perform a test using multiple tools and applications. These include but are not limited to SolarWinds, FTP, SSH, and Viavi GigaStor. | |
| 6 | Revision 1 to Attach 2, Salient Characteristics | Requirements 62, 63, 64, 65 for a PA-7050-brand firewall or equivalent | These performance requirements are associated witth a fully populated PA-7050 firewall. Since BOM issued with the RFI that preceded this RFP was for a PA-7050 that was not fully populated, can DISA please confirm that any offer for a PA-7050 or for an equivalent firewall must include all components necessary to meet these requirement? | The vendor's firewall must meet or exceed the requirements spelled out in 62, 63, 64, 65, indendent of the brand. The offer must be able to meet those requirements. | |
| 7 | Revision 1 to Attach 2, Salient Characteristics | Requirements 62, 63, 64, 65 for a PA-7050-brand firewall or equivalent | As noted in Question 2, these performance requirements are associated with a fully popullated PA-7050 firewall. Thus, the RFP, as structured, does not include CLINs that would allow the Navy to purchase a Mobel 1 firewall that is not fully populated. Does the Navy intend to purchase only fully populated Model 1 firewalls under this procurement? | The Model 1 firewall needs to be able to support the specified requirements, but the Navy will often purchase only the capability needed for a specific site at the specific time, and expand functionality as needed in the future by adding additional cards to the chassis. | |
| 8 | Revision 1 to Attach 2, Salient Characteristics | Requirement 68 for an expansion card | The expansion card description is specific to the PA-7050. It is not reasonable to assume that another manufacturer's expansion card will be identical to the PA-7050 expansion card. The specification for Model 1 should be for the total solution. It should not matter how the expansion card in each manufacturer's solution contributes to the total solution. We request that DISA reword this requirement to include only performance specifications or eliminate the requirement | The requirement is to be able to have expansion cards that permit the chassis to expand to a full chassis of 48 each 10/100/1000Mbps, 32 each 1Gbps SFP, 16 each 10Gbps SFP+. | |
| 9 | Revision 1 to Attach 2, Salient Characteristics | Requirement 80. | If equivalent to the PA-5060 is required, this requirement needs to be modified because it suggest that the PA-5060 has (2) 10/100/1000 Mbps Management Interfaces, when, accurding to the manufacturer's data sheet, its has (1) 10/100/1000 Mbps Management Interface. https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/pa-3000-series-specsheet | Concur. The requirement is for one 10/100/1000 Mbps Management Interface. | |
| 10 | Revision 1 to Attach 2, Salient Characteristics | Requirement 83 and 96 | Requirements specify dual, hot-swappable power supplies, but the PA-equivalent model has only 1. | Concur. Hot swapppable power supplies are not required for Models 3 and 4. | |
| 11 | Revision 1 to Attach 2, Salient Characteristics | Requirement 93 | Claims that the PA-3050 has (2) 10/100/1000 Mbps Management Interfaces, but the PA-3050 only has (1) 10/100/1000 Mbps Management Interface according to Palo Alto datasheet: | ||
| https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/pa-3000-series-specsheet | Concur. The requirement is for one 10/100/1000 Mbps Management Interface. | ||||
| 12 | Revision 1 to Attach 2, Salient Characteristics | Requirement 105 | Claims that the PA-3020 has (2) 10/100/1000 Mbps Management Interfaces, but the PA-3020 only has (1) 10/100/1000 Mbps Management Interface according to Palo Alto datasheet: | ||
| https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/pa-3000-series-specsheet | Concur. The requirement is for one 10/100/1000 Mbps Management Interface. |
Q&As Round 3 (Closed)
| Question # | Document | Description | Question/Clarification | Government Response |
| 1 | N/A - not document specific | Delivery | Can you provide a more detailed location delivery plan? You provide the 4 locations but no information which firewalls go where. | At this time, we do not know the quantities that will be delivered to each location, main reason why the contract will be an Indefinite Delivery / Indefinite Quantity (ID/IQ) type. |
2 N/A - not document specific Design Diagram/Implementation Plan Do you have any type of design diagram and implementation plan? You are requesting 14 management consoles which would make sense if the deployment is spread over different networks like NIPR, SIPR, etc. The norm is redundant pairs on an enterprise network. You are requesting consulting support with specific hours. This is normally left up to the responding vendor to propose.
vendor to propose.
The deployment is spread over different networks and the number of hours is estimated as a ceiling for the ID/IQ.
| 3 | N/A - not document specific | Training Locations | Can you provide the locations for training? | The training locations are anticipated to be on or near the four shipyard as listed |
| 4 | N/A - not document specific | Consulting Services | Is this support remote since it is less than 8 hours? SME for firewall consulting services for the cutover of high performance, high availability firewalls. (Hourly - 4 hour minimum) | |
| The cutover support will be purchased on an hourly basis, and costs will accrue at the hourly rate until the cutover is complete, with a suggested 4-hour minimum charge. It will not be remote support, but will be on-site support in nearly every case. | ||||
| 5 | Atch 1 - EPL MI RR, Price Workbook | CLIN Revisions | Is there a plan to update the pricing workbook? Are we allowed to make the necessary revisions to reflect the deleted sku per the Q&A and to reflect the non Palo Alto SKUs/Descriptions as long as the formulas are for QTY, Unit Price, and Extended Amount are maintained? | Yes, the CLIN SKU/Part Numbers/Descriptions can be revised, particularly if proposing "or equal" products which will obviously be different than what we originally listed. |
Please note, the only exception is CLIN 0012 for Travel -- it should not be modified. The "plug in" dollar value for this cost CLIN is just an estimate for budgetary purposes, and government-approved travel will be reimbursed based on actual costs only. The CLIN is not firm-fixed-price. For price evaluation purposes, the current dollar value should not be modified in order for the government to evaluate offers fairly and consistently.
File details come from the government source that posted it. Updated .