SOW_HSTS03-15-R-CIO007_DRAFT.pdf

NETWORK EQUIPMENT AND SUPPORT AND MAINTENANCE SERVICES

DRAFT SOW

2115205CIO007

C.1 Introduction TSA Office of Information Technology (OIT) Operations and Engineering Division (OED) requires network equipment and support and maintenance services to replace End of Life (EOL), End of Service Life (EOSL), and underpowered switches at multiple field locations.

C.2 Background The Transportation Security Administration (TSA) Field site network infrastructure contains a diverse combination of core and access class switches. These switches are critical components of the network and provide connectivity for all TSA operational computer systems and devices.

The current switches in use are nearing or have exceeded End of Life (EOL) and End of Service Life (EOSL) lifecycles and must be replaced due to the fact that the vendor no longer provides service or support for these models. Over time, the field offices have expanded and additional bandwidth was required to meet the demand of additional network traffic overhead. The current router and switch technology cannot reliably manage the additional bandwidth and crashes on occasion causing outages in the field offices.

TSA is now required to procure new switch hardware to replace the aging network devices currently deployed and in use. TSA also requires support and maintenance services to help ensure the TSA enterprise network infrastructure runs optimally and receives service and support in the event of a failure, with minimal downtime.

C.3 Product, Service or Outcome Needed:

The Transportation Security Administration (TSA) Office of Information Technology (OIT) Operations and Engineering Division (OED) requires an Indefinite Delivery/Indefinite Quantity (IDIQ) agreement to replace network equipment. The equipment is End of Life (EOL), End of Service Life (EOSL), and underpowered switches at multiple field locations

C. 4 Scope of the Product, Service, or Outcome:

The purpose of this procurement is to replace the EOL, EOSL, and underperforming network hardware currently deployed in the TSA Enterprise Field networks, along with support and services to maintain this hardware.

There are seven types of equipment defined in the technical requirements:

1) Ethernet Access Switch

2) Ethernet Compact Access Switch

3) Ethernet Small Office/Home Office Router/Switch

4) Ethernet Core/Aggregation/Distribution Switch

5) End of Row/Top of Rack Switch

6) Access Router

7) VoIP Gateway Router

C. 5 Technical Requirements:

1) Ethernet Access Switch

a) 24 or 48 10/100/1000 PoE+, 24 or 48 10/100/1000 non-PoE models, and 12 and 24 GE SFP port models

b) Shall possess a scalable clustering (stacking) capability for at least (4) devices

c) A minimum of two optional uplink module ports supporting Gigabit and/or 10 Gigabit

Ethernet both LX/LH and SX interface types

d) Models equipped with PoE+ shall be capable of supporting 30W power on all ports in 1 rack unit (RU) form factor

e) Dual redundant, modular power supplies and fans in larger chassis

f) Comprehensive Layer 2 switching features and Layer 3 routing capabilities

g) Must include support for: DHCP, SNMPv3, RADIUS, AAA, QOS Tagging, STP, sFLOW, SYSLOG, SSHv2, LLDP or equivalent, Class of Service (CoS), Rate Limiting, Virtual Routing and Forwarding (VRF) with overlapping IP addresses, Virtual Router Redundancy Protocol (VRRP), and Differentiated Service Code Point (DSCP)

h) Support for Layer 3 routing protocols including OSPF (v2 and v3), EIGRP, and BGP. Both IPv4 and IPv6 unicast and multicast forwarding

i) Multicast functionality/compatibility; compatible with TSA’s existing IGMP/multicast schema

j) Physical compatibility with existing rack dimensions (19” standard)

k) Multi-port trunking required Link Aggregation Control Protocol (LACP) or equivalent

l) Network Access Control (NAC) consistent with Support 802.1x

m) FIPS 140-1 & 140-2 compliant

n) Managed capability – switches must allow remote management capabilities, to include at a minimum the following remote management abilities:

i) Turn port ranges on or off

ii) Adjust link bandwidth and duplex settings

iii) Prioritize ports

iv) Perform IP management and IP clustering

v) Implement and modify MAC filtering

vi) Manage Port Security for inventory control and to prevent MAC flooding

vii) Manage Spanning Tree Protocol version 3

viii) Provide SNMP monitoring of devices and link health

ix) Port mirroring

x) Link aggregation

xi) VLAN creation and setting management

2) Ethernet Compact Access Switch

a) 8 or 12 port 10/100/1000 PoE+,8 or 12 port 10/100 non-PoE models

b) Mounting accessories for a standard 19” rack

c) Models offering PoE+ shall be cable of supporting 30W power on all ports

d) IPv4 and IPv6 routing, Multicast routing, Differentiated Service Model QoS compatible support

e) Multicast functionality/compatibility; compatible with TSA’s existing IGMP/multicast schema

f) Must include support for: DHCP, SNMPv3, TACACs, RADIUS, AAA, QOS Tagging, STP, sFLOW, SYSLOG, SSHv2, LLDP or equivalent, Class of Service (CoS), Rate Limiting, and Differentiated Service Code Point (DSCP)

o) Multi-port trunking Link Aggregation Control Protocol (LACP) or equivalent

p) Network Access Control (NAC) consistent with 802.1x

g) FIPS 140-1 & 140-2 compliant

3) Ethernet Small Office/Home Office Router/Switch

a) Minimum of 8 ports 10/100/1000Mbps)

b) Optional models with PoE

c) LLDP protocol support or equivalent.

d) WAN links: Fast Ethernet (FE) v.92, Gigabit Ethernet (GE), ADSL2+/VDSL (Annex A/B/M), Multimode G. SHDSL, and Small Form Factor Pluggable (SFP)

e) Support for multiple IPSEC VPN tunnels.

f) Network Access Control (NAC) with 802.1x

g) Support for Layer 3 routing protocols including OSPF v2 & v3, EIGRP, and BGP.

h) Both IPv4 and IPv6 unicast and multicast forwarding

i) Must include support for: DHCP, SNMPv3, RADIUS, AAA, QOS Tagging, STP, sFLOW, SYSLOG, SSHv2, LLDP or equivalent, Class of Service (CoS), Rate Limiting, Virtual Routing and Forwarding (VRF) with overlapping IP addresses, Virtual Router Redundancy Protocol (VRRP), and Differentiated Service Code Point (DSCP)

j) VLAN support (802.1q) for at least 10 VLANs

k) FIPS 140-1 & 140-2 compliant

4) Ethernet Core/Aggregation/Distribution Switch

a) Modular Chassis to support 10/100/1000-MBPS Ethernet

b) Capable of supporting advanced optics with 10GbE - 100GbE modules

c) Capable of wire-speed routing and switching

d) Redundant routing/supervisor engines

e) Support for multiple IPSEC VPN tunnels

f) Capable of supporting Software Defined Networking (SDN)

g) Network Access Control (NAC) consistent with 802.1x

h) Multi-Tenancy and Switch Virtualization support

i) Dual redundant, modular power supplies and fans in larger chassis

j) Support for a minimum of 10,000 simultaneous IGP routes and 100, 000 BGP routes

k) Support throughput of at least 180Gbps per slot

l) Support backplane throughput of at least 4Tbps

m) Must have chassis compatible with 19” racks; may have chassis compatible with 23” racks

n) Modular Blades must be hot-swappable

o) Support for Layer 3 routing protocols including OSPF v2 & v3, EIGRP, and BGP.

p) Both IPv4 and IPv6 unicast and multicast forwarding

q) Must include support for: DHCP, SNMPv3, RADIUS, AAA, QOS Tagging, STP, sFLOW, SYSLOG, SSHv2, LLDP or equivalent, Class of Service (CoS), Rate Limiting, Virtual Routing and Forwarding (VRF) with overlapping IP addresses, Virtual Router Redundancy Protocol (VRRP), and Differentiated Service Code Point (DSCP)

r) Multicast functionality/compatibility; compatible with TSA’s existing Protocol Independent Multicast (PIM) and IGMP/multicast schema

s) FIPS 140-1 & 140-2 compliant

t) Managed capability – switches must allow remote management capabilities, to include at a minimum the following remote management abilities:

i) Turn port ranges on or off

ii) Adjust link bandwidth and duplex settings

iii) Prioritize ports

iv) Perform IP management and IP clustering

v) Implement and modify MAC filtering

vi) Manage Port Security for inventory control and to prevent MAC flooding

vii) Manage Spanning Tree Protocol

viii) Provide SNMP monitoring of devices and link health

ix) Port mirroring

x) Link aggregation

xi) VLAN creation and setting management

5) End of Row/Top of Rack Switch

a) Modular chassis or scalable clustering capability with 60 TB non-blocking performance with latency of less than 5 micro seconds

b) Support redundant supervisor modules/engines

c) 10 GB – 100 GB server access/connectivity

d) Capable of supporting Software Defined Networking (SDN)

e) Redundant Supervisor Engines

f) 1U or 2U rack dimension form factor

g) Dual redundant, modular power supplies and fans in larger chassis

h) Must have chassis compatible with 19” racks; may have chassis compatible with 23” racks

i) Must include support for: DHCP, SNMPv3, RADIUS, AAA, QOS Tagging, STP, sFLOW, SYSLOG, SSHv2, LLDP or equivalent, Class of Service (CoS), Rate Limiting, Virtual Routing and Forwarding (VRF) with overlapping IP addresses, Virtual Router Redundancy Protocol (VRRP), and Differentiated Service Code Point (DSCP)

j) Network Access Control (NAC) with 802.1x

k) FIPS 140-1 & 140-2 compliant

l) Managed capability – switches must allow remote management capabilities, to include at a minimum the following remote management abilities:

i) Turn port ranges on or off

ii) Adjust link bandwidth and duplex settings

iii) Prioritize ports

iv) Perform IP management and IP clustering

v) Implement and modify MAC filtering

vi) Manage Port Security for inventory control and to prevent MAC flooding

vii) Manage Spanning Tree Protocol

viii) Provide SNMP monitoring of devices and link health

ix) Port mirroring

x) Link aggregation

xi) VLAN creation and setting management

m) Must support network and server virtualization and cloud computing

n) Must be compatible with the currently deployed TSA infrastructure: i.e. compatible with the current Cisco environment

o) Must be compatible with current TSA monitoring/management tools, such as Cisco LAN

Management Solution (LMS), or appropriate management tools shall be delivered with the replacement switches to provide similar functionality to the currently deployed LMS.

6) Access Router

a) Must include minimum of (4) 1Gb with (optional SFP) ports

b) Must support remote management

c) Must have chassis compatible with 19” racks

d) May have chassis compatible with 23” racks

e) Protocol Support: IPv4, IPv6, Static Routes, Open Shortest Path First (OSPF) v2 & v3, Support of Enhanced IGRP (EIGRP), Border Gateway Protocol (BGP), BGP Router Reflector, Intermediate System-to-Intermediate System (IS-IS), Multicast Internet Group Management Protocol (IGMPv3) IPSec, Generic Routing Encapsulation (GRE), Bi- Directional Forwarding Detection (BVD), IPv4-to-IPv6 Multicast, MPLS, LLDP or equivalent, L2TPv3, 802.1ag, 802.3ah, L2 and L3 VPN, Multicast routing, Cisco compatible QoS schema support

f) Support for multiple IPSEC VPN tunnels

g) Dual redundant, modular power supplies and fans in larger chassis Product line must provide support for both:

i) Smaller routers with multiple T1’s, up to DS3 circuit speeds

ii) Larger routers able to support a minimum of OC192 circuits and faster

h) Must support virtual routing and forwarding

i) FIPS 140-1 & 140-2 compliant

7) VoIP Gateway Router

a) 2 & 4 Gigabit Ethernet interfaces

b) 4 & 8 Channelized T1/PRI ports

c) Support for multiple IPSEC VPN tunnels

d) Must have the capability for MGCP, SIP, H.323, SRST

e) Dual power supply

f) Must have chassis compatible with 19” racks

g) May have chassis compatible with 23” racks

h) Must support remote management

i) Audit logging capability

j) Protocol Support: IPv4, IPv6, Static Routes, Open Shortest Path First (OSPF), Support of

Enhanced IGRP (EIGRP), , Multicast Internet Group Management Protocol (IGMPv3) IPSec, Generic Routing Encapsulation (GRE), Bi- IPv4-to-IPv6 Multicast, LLDP or equivalent, L2TPv3, , L2 and L3 VPN, Multicast routing, Differentiated Service model compatible QoS

k) Dual redundant, modular power supplies and fans in larger chassis

l) FIPS 140-1 & 140-2 compliant

8) Support & Maintenance Services

a. 24x7 telephone support.

b. Standard hardware maintenance requirements are 8X5 next business day;

however, TSA has multiple sites that require 4 hour replacement support 24X7.

The zip codes associated with these requirements will be provided upon award.

c. The vendor shall ensure that all personnel who are granted access to TSA information, or networks and systems that process TSA information are citizens of the United States of America. Requests for exception to citizenship requirements must be consistent with the procedure identified in DHS 4300A, Attachment 3-4, Requesting Exceptions to Citizenship Requirements.

d. Electronic incident submission with a 1-hour response by telephone or email.

e. Problem Management - Critical technical issues are managed with a formal

Problem Management process.

f. Level IV Support - Direct access to a qualified team of, certified Senior Technical resources with subject matter expert support experience.

g. The contractor shall have an existing capability to support the secure transfer, review, and comment of shared files (log files, architecture diagrams, IP addresses and locations) by cleared U.S. only as determined by the Office of Personnel Management- Federal Investigative Services.

C. 6 Deliverables:

Equipment delivered by the contractor in fulfillment of this contract shall not be identified for End-of-Support / End-of-Life by the manufacturer within five (5) years of delivery.

The intended purchase is an IDIQ; therefore, schedule requirements will be for individual orders associated with the IDIQ. TSA requires orders to be fulfilled and shipped TSA Warehouse within 20 business days (unless otherwise specified).

C.7 Technology Refreshment Requirements The Contractor shall be responsible for introducing new equipment to the TSA community as soon as it is commercially available from the OEM(s).

C.8 Warranty Note: TSA requires a minimum of two (2) years of standard warranty on network equipment.

The Contractor shall provide the standard commercial warranty for all products under this contract, unless otherwise specified in the individual Delivery Order. Product warranties shall include a product return policy. If a product return policy is not included with the standard commercial warranty for the item being procured, the Contractor shall notify the CO, in writing, that the standard commercial warranty for the item does not include a return policy, and/or identify what return policy it may elect to offer. Any OEM warranties associated with products delivered under this contract shall be available directly to TSA.