Revison_1_to_Atch_2.xls

XLS spreadsheet 60 KB Posted Jun 16, 2016

Attached to: Palo Alto Networks Firewalls for Navy (Brand Name or Equal)
Solicitation number: HC102816R0016
Issued by: Defense Information Systems Agency

About this file

From the source

Revision 1 to Atch 2 Salient Characteristics (Uploaded via Amendment dated 6/16/16)

View the file

Other files

File	Type	Posted
Revision_3_to_Attach_2__Salient_Characteristics.xlsx	XLSX spreadsheet	Jul 5, 2016
Q As_Round_3_30June2016.xlsx	XLSX spreadsheet	Jun 30, 2016
Atch_1_-_30Jun2016.xls	XLS spreadsheet	Jun 30, 2016
Q As_Round_2_24June2016.xlsx	XLSX spreadsheet	Jun 24, 2016
Revison_2_to_Atch_2_24Jun2016.xls	XLS spreadsheet	Jun 24, 2016
Q As_Round_1_16Jun2016.xls	XLS spreadsheet	Jun 16, 2016
Atch_1_-_EPL _MI RR _Price_Workbook.xls	XLS spreadsheet	May 31, 2016
Atch_2_-_Salient_Characteristics.xlsx	XLSX spreadsheet	May 31, 2016
Combined_Synopsis-Solicitation_Ltr_Palo_Alto_Firewalls_25May16.pdf	PDF	May 25, 2016

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

All Models

Offeror Name:
Salient characteristics for all Firewall models (must meet or exceed)	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
1. The next generation firewall must support application identification and options for intrusion detection scanning (IDS), intrusion prevention scanning (IPS), and URL filtering all on a single platform with a single browser based GUI for configuration management.
2. The firewall must be manageable via a central management console. The firewall and management console must support a local configuration (for on-site operators) and central configuration (for operators at a centralized headquarters) simultaneously.
3. The next generation firewall management interface must also support multiple roles for different types of operators. As an example a role for network operations, a role for security policy, and a role for IA auditing.
4. Hardware based firewalls must separate the management plane from the data forwarding plane. Management plane must have its own dedicated CPU, memory, and storage for managing the device and generating reports. The dataplane must have its own dedicated CPUs and memory for inspecting traffic and forwarding packets.
5. The firewall must classify all applications on all ports all the time. All traffic must be classified regardless of IP port, encryption (SSL or SSH), or evasive techniques employed. Unidentified applications – typically a small percentage of traffic, yet high in potential risk – must be automatically categorized for systematic management. The firewall must use applications and users as the basis of security policy – all access control decisions will be based on that information.
6. The Firewall OS must have a protection profile by the NIAP Evaluation and Validation Program. Protection Profiles must be listed at the NIAP website or documentation provided to verify there is a protection profile in place for the firewall being used on the network that has been evaluated at one of the accredited NIAP locations.
7. Must support SNMP ver. 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
8. The network device must drop half-open TCP connections through filtering thresholds or timeout periods.
9. Device must support the use of authentication, authorization and accounting servers for access to the device for management i.e. RADIUS/TACACS+
10. Must support administrative access using SSH version 2
11. Alerts automatically generated to notify administrator when log storage reaches seventy-five percent or more of its maximum capacity.
12. Device will be able to disable or uninstall unused services.
13. Granular IPv6 control.
14. Administration through non graphical means i.e. Command Line Interface (CLI) is a requirement.
15. Call home service or feature disable ability.
16. Traffic prioritization and bandwidth reservation.
17. Granular ICMP control.
18. Full support of VMWare NSX. To support interoperability and reduce operational cost, vendor product line should also have a virtual server software platform meeting the same requirements, with the exception of throughput and physical connections. Supported platforms must include ESXi. The firewall and management console must support integration with software defined network (SDN) orchestrations systems. - Vmware NSX and OpenStack must be supported at a minimum.
19. The selected firewall must have predefined applications written to work with the corporate log review solution SPLUNK.
20. The device hardware and software must not have a projected End-of-Support date closer than 60 months from delivery date.
21. Must be configurable as a High Availability pair in an “Active-Standby” configuration.
User ID/Authorization Requirements
22. The firewall must have the ability to map IP addresses to users and support security policy definition based upon users and groups.
23. The firewall must be able to map users to IP addresses with both a software agent or directly from the firewall.
24. The firewall must be able to map users to IP addresses by Captive Portal and Active Directory/LDAP information stores.
25. Firewall must be able to support DoD CAC authentication for account access for each role.
26. ---Removed----
Content Inspection Requirements
27. All firewalls must perform L7 application identification at 90%+ of firewall rated performance under documented real-world (i.e. not UDP-only) traffic loads. The firewall must deny unknown traffic.
28. Firewall documentation must detail how the operator can create custom application signatures without having to load new software or databases
29. Verifiable throughput of mixed traffic type with Firewall features turned on in a single chassis are identified under each Model Tab
30. The firewall must perform threat inspection of known signatures at 50% of the firewall's rated throughput, while simultaneously maintaining 90%+ L7 performance
31. The firewall must be able to select files for forwarding, with negligible (<1%) performance impact), to a local appliance for unknown malware detection. It must also accept local signature insertion from that appliance into its threat database with turnaround time within 15 minutes.
32. The firewall must support URL filtering capability which adds a categorical URL database functionality to the device for use as a URL and Web Content filter. URL categories must be able to be used to define security policy, complementing the application level control as well as to define SSL decryption exceptions, to determine quality-of-service policy and more.
33. The Firewall should be able to identify the following applications by default.
Adobe-connect
Adobe-meeting
Adobe-meeting-file-transfer
Adobe-meeting-remote-control
Youtube
Youtube-posting
Youtube-uploading
Citrix
HTTP-Audio
HTTP-Proxy
HTTP-Tunnel
HTTP-Video
Applications/Services needed for Microsoft servers and workstations
Active Directory
Active Directory Management Gateway Services
Global Catalog
LDAP
IPsecISAKMP
NAT-T
RPC (including on randomly allocated high tcp ports)
SMB
DataBase
Mssql
Oracle
Microsoft SharePoint
Sharepoint-admin
Sharepoint-posting
Sharepoint-calendar
Sharepoint-documents
Management Requirements
34. The firewall must have on-box reporting and logging; additionally both global and local rules should be enabled for central and remote operators from the same UI with role-based privileges. Last, the firewall must continue to log all events during configuration, operational, and service maintenance windows
35. The management system must be able to set bandwidth-shaping policies based on user, time-of-day, and application--or a combination of any of these variables.
36. Firewall must be configurable via a REST API or equivalent.
37. Reports on the firewall must be available via REST API or equivalent.
38. The firewall must be able to identify unused rules.
39. Operators must have the ability to intermix port/protocol rules with app-based rules.
40. Dashboard traffic reports. System must have both standardized and customizable reports.
41. Must be able to display DoD approved warning banner prior to system administrator logging in.
42. Device must log administrator logons, changes to administrator group and account lockouts.
43. The device console port must be able to time out after 10 minutes or less.
44. Management connections to the device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
45. Management connections for administrative access must be configurable to time out after 10 minutes or less of inactivity.
46. Device must be configurable to timeout after 60 seconds or less for incomplete or broken SSH sessions.
47. Device must be configurable to reset interface after 3 unsuccessful SSH login attempts.
48. Must not allow SSH ver. 1 for administrative access.
49. Must support 802.1Q tags.
50. Must be configurable for NTP authentication.
51. Auxiliary port must be able to be disabled.
52. Admin configurable End-User notification for policy violations or filtering events.
53. To allow for a smooth transition to the new firewalls, the vendor will have an application that would allow exporting the current McAfee Firewalls configuration to the Next Generation Firewall with little to no additional configuration changes.
54. To allow for a Secure and Policy enforced deployment, the device will have a published or in-draft DISA STIG that supports requirements in NIST 800-53.
**NOTE: Please see below Tabs for individual Model specifications.

Model 1

Offeror Name:
Salient characteristics for firewall PA 7050 or equal (must meet or exceed)	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
55. High performance NGFW (Next Generation Firewall) that supports the demands of an Enterprise Data Center. The configuration is flexible and able to handle multiple network connection types and speeds to include 1, 10 and 40 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 2TB RAID 1 configuration, with options to offload/export system log files.
56. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.
57. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.
58. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.
59. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.
60. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.
61. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.
62. Minimum 115Gbps Application ID throughput.
63. Over 700,000 connections per second.
64. Over 20,000,000 maximum sessions.
65. Interface type and speed: 48 each 10/100/1000Mbps, 32 each 1Gbps SFP, 16 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management
66. Minimum 2TB with option to 4TB (4x1) storage.
67. Redundant power supplies.
68. Expansion Card: Network Processing Card to expand the port capacity and interface options for a high performance, high availability datacenter firewall. ** Expansion Card Performance Requirements: Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+
69. Blank Card Cover. Blank card, if needed, for installation in an empty slot of a high performance, high availability datacenter firewall.

Model 2

Offeror Name:
Performance Requirements for PA 5060 or equal (must meet or exceed)	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
70. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1 and 10Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 240GB, with options to offload/export system log files.
71. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.
72. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.
73. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.
74. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.
75. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.
76. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.
77. Minimum 18Gbps Application ID throughput
78. Over 110,000 connections per second
79. Over 3,800,000 maximum sessions
80. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, 4 each 10Gbps SFP+, plus 2 each 10/100/1000Mbps Management
81. Loging disk space Minimum 120GB with option to 240GB
82. Redundant power supplies

Model 3

Offeror Name:
Performance Requirements for PA 3050 or equal (must meet or exceed)	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
83. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1, Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 120GB, with options to offload/export system log files.
84. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.
85. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.
86. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.
87. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.
88. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.
89. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.
90. Minimum 2.5 Gbps Application ID throughput
91. Over 48,000 connections per second
92. Over 480,000 maximum sessions
93. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management
94. Loging disk space Minimum 120GB
95. -- Removed --

Model 4

Offeror Name:
Performance Requirements for PA 3020 or equal (must meet or exceed)	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
96. High performance NGFW (Next Generation Firewall). The configuration is flexible and able to handle multiple network connection types and speeds to include 1 Gig fiber, as well as 10/100/1000 Base-T in the same chassis. The NGFW is application aware with full stack visibility and full packet inspection. The NGFW supports Statefull High Availability. The chassis supports dual power supplies that are hot swappable. To ensure management access is always available, a separate control plane is used. The NGFW supports onboard logging with a minimum of 120GB, with options to offload/export system log files.
97. Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters long.
98. 24x7 hardware, software and technical support. Next Business Day (NBD) shipment of parts and hardware.
99. 1 year threat prevention subscription for a high availability firewall, for intrusion detection and malware analysis of the cleartext and encrypted datastream for all ports and protocols, and any file attachments that are sent through the high availability firewall.
100. 1 year mobile device security management subscription for a high availability firewall, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.
101. 1 year malware analysis subscription for a high availability firewall, integrated with firewall and a malware analysis solution, for analysis of a file's behavior when opened or executed.
102. 1 year URL filtering subscription for a high availability firewall, integrated with the firewall solution, for controlling web access, quality of service for web traffic and SSL decryption.
103. Minimum 1.5 Gbps Application ID throughput
104. Over 48,000 connections per second
105. Over 245,000 maximum sessions
105. Interface type and speed: 12 each 10/100/1000Mbps, 8 each 1Gbps SFP, plus 2 each 10/100/1000Mbps Management
107. Minimum 120 GB
108. -- Revmoved --

Firewall Mgt, Acc & Svcs

Offeror Name:
Firewall Management	Cross-Reference to Offer's Techincal Capability Proposal (e.g., Product Literature packet, pg 2, para 3)
109. NGFW Management Console appliance. The Management Console is a purpose built appliance and software combination to support the configuration and log file storage for the NGFW. The Management Console has a RAID storage with a minimum of a usable 4TB of storage. Up to 100 NGFW devices can be managed.
110. Panaorama or equivalent centralized software mgmt. license. Up to 100 devices supported
111. Premium support year 1 for management console.
Accessories and Services
112. SFP+ SR 10GigE transceiver
113. SFP SX transceiver
114. SME for firewall consulting services for user ingest strategies, rules and policy creation, transition strategy, code updates, and installation tasks leading up to the and including live cutover.(per day)
115. SME for firewall consulting services for the cutover of high performance, high availability firewalls. (Hourly - 4 hour minimum)
116. Travel expenses for consulting services for high performance, high availability firewalls.
117. On-Site training course for high performance, high availability firewalls for 5 days for up to 16 students.
118. On-Site training course for high performance, high availability firewalls for 2 days for up to 16 students.
119. Malware analysis capability, fully integrated with the firewall solution, to offload files for analysis of their behavior when opened or executed.
120. Mobile device security manager, fully integrated with the firewall solution, to manage the device configuration, network access, and security monitoring of Apple, Android, Linux, and Windows operating systems.

File details come from the government source that posted it. Updated Nov 14, 2017.