JA F5 Virtual Application Redacted.pdf

F5 Virtual Application Delivery Controllers Control Number VA-25-00067905 rules. Only brand name F5 License Bundles can meet VA’s technical requirements and ensure continued architectural integrity, compatibility, and interoperability with existing integrations both in and outside the VA Enterprise Cloud.

VA requires brand name F5 software maintenance as only F5 or its resellers are the only source with the requisite technical knowledge and access to the architecture including security patches and proprietary F5 source code necessary to ensure the systems operate at full capacity. Only F5, or an authorized reseller, can provide the necessary software because of the suite’s propriety source code which only F5 can provide access to. Due to the proprietary constraints use of any alternative vendor software or maintenance and services would require a complete replacement of the existing F5 infrastructure in place.

Based on previous acquisition history, VA technical experts estimate that replacing VA’s current F5 architecture would produce estimated duplicated costs of approximately $1.5M for the re-configuration, development, re-architecture, and implementation of a replacement product. These estimated duplicative costs would not be recovered through competition. The F5 load balancers ensures that the IAM has distributed traffic across multiple clusters and the automated failover capability required to sustain the operation of VA enterprise IAM services. If a service outage occurs due to technical difficulties encountered during the replacement of the F5 infrastructure, applications that depend on IAM security and identity services would become unavailable which would have a catastrophic impact on VA’s mission. As a result, production systems would be at risk of shutting down which has the potential to cause Veterans to not have access to health, compensation, loan, and education benefits. In addition, IAM would not be able to manage and monitor these virtual environments and address any security related issues i.e., the inadvertent release of Veteran Personally Identifiable Information and Protected Health Information.

Current initiatives and programs that are heavily dependent on enterprise IAM services include the following: Community Care/Providers, Mission Act, Colmery Act, Electronic Health Record Modernization VA.gov, Mobile applications, Zero Trust Architecture, Social Security Reduction, Continuous Diagnostics Monitoring, and VA Profile. Other critical systems within VA dependent on enterprise IAM services are Veterans Health Information Systems and Technology Architecture, Computerized Patient Record System, Benefits Integration Platform, Veterans Benefits Management System, Veterans Crisis Line, Salesforce Government Plus, Joint Legacy Viewer, and Telehealth Management Platform.

IAM also requires, as optional items, training and technical consulting services.

Optional tasks for training and technical consulting services are required to ensure the IAM Operations Team has the knowledge of new product capabilities and Subject Matter Expert support required to configure and maintain the new capabilities in the F5 load balancers to ensure the VA requirements for IAM service availability are achieved.

Failure to purchase brand name F5 software maintenance introduces risk of an IAM outage due to a single F5 load balancer not being operational. The F5 Delivery

Controllers balance traffic loads and perform automatic failover to ensure the availability and responsiveness of the top three VA bedrock services, VA Master Person Index (VA MPI), Single Sign-on external (SSOe), and Single Sign-on internal (SSOi). These IAM services are integrated with over 1,300 VA applications that rely on IAM services to provide the standard set of identity traits and secure streamlined access required to provide healthcare and benefits to Veterans.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, limited competition is available among Service-Disabled Veteran Owned Small Business (SDVOSB) authorized resellers on the NASA SEWP GWAC. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award.

7.Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, VA will continue to monitor market trends, new/emerging products and look for compatible and more advanced technologies to meet VA needs.

8. Market Research: The Government’s technical experts conducted market research in February 2025 by reviewing Azure Government Cloud products (load balancer, application gateway, and traffic manager) to ascertain the ability to satisfy VA’s requirements. It was determined the Azure Government Cloud product grouping is not able to meet the VA requirements for streamlined traffic flow, non-standard ports, and creation and enforcement of traffic and event management rules. The products do not integrate seamlessly with Azure Government Cloud which results in adding an extra redirect for all traffic which introduces performance lag delays that are incompatible with VA’s current F5 architecture. The application gateway is limited to standard http traffic and will not support existing non-standard IAM traffic. The Azure load balancer is incapable of creating and enforcing VA traffic and event management rules for traffic handling. The Azure Government Cloud product vendor does not have the inherent technical knowledge or access to F5’s proprietary source code necessary to license or maintain the current brand name F5 load balancers configured in IAM’s Azure Government Cloud environment. Introducing the Azure Government Cloud products would require a complete replacement effort as described above in Section 5 of this justification.

In May 2025, further market research was conducted using the Provider Look-Up Tool on the NASA SEWP V GWAC website. The tool revealed multiple authorized resellers of F5 products, including 19 verified Service-Disabled Veteran-Owned Small Business (SDVOSB) resellers. Therefore, based on the market research results, there is a reasonable expectation that limited competition exists among verified SDVOSB contract holders on the NASA SEWP GWAC.

Additional market research was conducted by the Contract Specialist by posting a Request for Information (RFI) on May 14, 2025, on NASA SEWP, to include a draft Product Description. One (1) response was received to the RFI, from V3Gate. V3Gate is a F5 authorized resellers and a SDVOSB and was found to be capable of fulfilling these requirements by the requiring activity. No alternative solutions were proposed in response to the RFI.

9. Other Facts: None