SMIT Attch J-19 Transport Service Details Supplement_Final.docx

NAVAL ENTERPRISE NETWORK PROGRAM

UNITED STATES NAVY

Solicitation: N00039-18-R-0005 Attachment J-19, Transport Services Details

Version: Final Date: 18 October 2018

Program Executive Office Enterprise Information Systems Program Manager, Naval Enterprise Networks 1325 10th Street, SE, Suite 301 Washington, DC 20374

This document includes technical data for which the DON possesses Government Purpose Rights and should not be disclosed outside the Government except to entities, which have executed the DFARS Part 227 non-disclosure agreement and handled IAW the terms of such agreement.

i ii

Revision History

DOCUMENT HISTORY

i Table of Contents

PART A

PART A

INTRODUCTION

This document identifies additional details for delivery of Non-NMCI Server Connectivity Services, Non-NMCI Seat Connectivity Services, Network Interface Services and Deployable Site Transport Boundary (DSTB) Services referenced in section 3.3.3.1.1, 3.3.3.1.2, 3.3.3.1.3 & 3.3.3.2.2 of the SMIT PWS.

Non-NMCI Server Connectivity Services Non-NMCI Server Connectivity Services leverage NMCI network infrastructure and transport support services to provide network connectivity for non-NMCI servers. These Command Owned Servers are connected via SDP and B3 COI’s.

This service includes the following options:

a. Provides 100 Mbps, 1 Gbps, or 10 Gbps connectivity to the local NMCI environment.

b. Provides 100 Mbps, 1 Gbps, or 10 Gbps connectivity with additional availability outside or beyond the local NMCI environment with an increased level of availability, security and performance.

c. Provides for the one-time engineering and development of the capability and services including but not limited to Public IP, DNS, and Directory Service Uplifts and PKI Authentication, non-NMCI & NMCI Antivirus scan, and DNS Hosting uplifts for Navy application servers.

d. Provides static IP addresses (in addition to those provided under the Basic Application Server Services) assigned to the requested server’s Network Interface Card.

Non-NMCI Seat Connectivity Services Non-NMCI Seat Connectivity Services leverage NMCI network infrastructure and transport support services to provide network connectivity for non-NMCI seats. The Government is responsible for securing the ATO and maintaining the cybersecurity posture of the non-NMCI seat. This service provides network connectivity and other network-enabled services available as uplifts.

In addition, this service provides a one-time set up to allow Government-provided Program of Record (POR) workstations to access the network in accordance with Section 3.3.3.1.2 in the PWS. Examples of these devices include Defense Enrollment and Eligibility Reporting System (DEERS), Real-time Automated Personnel Identification System (RAPIDS) workstations, Global Command and Control System (GCCS) workstations and other similar workstations requiring direct connectivity of a POR device to the BAN/LAN/WAN. Only one (1) POR device shall be connected to its assigned access point.

These seats must connect to a secure VLAN to prevent unauthorized access on the network. The Government will be responsible for connecting and disconnecting all POR devices at the access point. The Government will be responsible for all IA scanning and for maintaining IAVA compliance of all devices connected to the NMCI network through the use of this service.

Network Interface Services Network Interface Services provides secure connectivity for internal and external Communities of Interest (COIs) via NMCI. This service provides network connectivity and other network-enabled services available as uplifts. Uplifts cover support for boundary change requests to existing solutions (e.g. modifications to ACLs, Firewalls, VPNs and GTSEs). The COIs include B3s, SDPs, DMZs, GTSEs and Legacy Systems Support.

Boundary Three Community of Interest (COI) Interface The B3 COI is an enclave within the NMCI network. The B3 boundary and network infrastructure within the COI is managed by the contractor. COIs are generally setup to either protect the data within the COI from the general NMCI user or to protect the NMCI network from the systems within the COI. The security mechanisms in B3 are flexible, and allow individual user participation in multiple COIs. Depending on the security requirements, the COI boundary could be a router, Access Control List (ACL), firewall, VPN or other similar equipment.

Figure depicts a Boundary Three COI:

Boundary Three (B3 COI) Switch -1 Switch -2 Switch -3 GFE Servers GFE Servers GFE Servers Enclave Router + ACL Or Firewall/VPN + rule

Figure 1-3 depicts a Boundary Three COI Interface:

Figure 13: Boundary Three COI Interface

Service Delivery Point (SDP) Community of Interest (COI) Interface The COI SDP is an enclave within the NMCI network. The COI SDP provides a network connection for the Government to plug their network into. In some cases, the COI requires transport Services only with no further access to any NMCI Services. In this scenario, the separation mechanism for transport can simply be Virtual Local Area Network (VLAN) isolation with an ACL, Virtual Route Forwarding (VRF) over Multiprotocol Label Switching (MPLS) or a more complex setup using an IP Security (IPSEC) VPN or Type I encryption.

Figure depicts a SDP COI:

Router + ACL Or Firewall/VPN & rule set Service Delivery Point (SDP) GFE Router or Switch GFE Servers GFE Servers GFE Servers Enclave

Figure 14 SDP COI Interface

Demilitarized Zones (DMZ) The DMZ restricts and controls access to information while shielding the internal NMCI network from outside attacks. Direct access to all external networks from the NMCI is restricted. Access by users external to the NMCI is through approved DMZ portals. This service also provides Intrusion Prevention System (IPS) and Host Intrusion Prevention System (HIPS). The IPS Service will provide the security infrastructure components (Network/Server/Seat) necessary for NMCI to automate the detection and prevention of anomalous or unauthorized network activity, as defined by Computer Network Defense (CND) authorities. This service includes Network based Intrusion Detection System (IDS)/IPS components as well as the capability to analyze and archive the data collected and report the data and analysis to external CND organizations.

Figure 1-5 depicts a Demilitarized Zones (DMZ):

Figure 15 Demilitarized Zone (DMZ)

Generic Transport Service Extension (GTSE) The GTSE solution provides a virtual point-to-point circuit between two locations using the NMCI network as transport. In some cases, this is used to bring NIPRNet or SIPRNet to a site by creating a virtual circuit between the site and the outer router of the NMCI Boundary 1. GTSE also provides direct connectivity for collocated third-party network domains or logical transport services where the end-points are outside the NMCI enclave. The GTSE solution architecture is to provide NIPRNet access to third-party USN network enclaves, such as Information Technology for the 21st Century (IT-21), outside the Continental United States (OCONUS)-Navy Enterprise Network (ONENet), and other approved USN legacy network domains.

Figure 1-6 Generic Transport Services Extension (GTSE)

B1 Outer Router Enclave Boundary 1 NIPRNet or SIPRNet Enclave Site X VPN / Type 1 Encryption Enclave

WAN

VPN / Type 1 Encryption Legacy or Customer Network

Legacy Network Connectivity Services The USN network is connected to a number of legacy networks via B2 Firewalls to access legacy applications. This provides continuous legacy systems support for operational and functional systems to enable operation on the NMCI network. Figure 1-7 depicts a Boundary Two connection to Legacy Networks.

Figure 17 B2 for "Reach Back" into Legacy Networks

NIPRN/ Internet NMCI Enclave Legacy Network

GFE

GFE Servers GFE Switch or Router B2 Firewall + rule set Traffic Initiated

Figure 18 B2 for Legacy Networks to Access Enclave Citrix Service

NIPRNET/ Internet NMCI Enclave Legacy Network Traffic Initiated GFE Workstations GFE Switch or Router B2 Firewall + rule set Citrix Server Farm

Deployable Site Transport Boundary (DSTB) Services DSTB services allow the end–users to establish connectivity to the NMCI/MCEN using a variety of commercially available transports including broadband cable, wireless, satellite, and cellular communications.

The Deployable Site Transport Boundary (DSTB) solution offering provides USN and USMC personnel direct access to the NMCI network while deployed. DSTB is a secure solution that allows a small network footprint to reach NMCI resources from the field. The DSTB solution offering presents two solution options, the DSTB Core and the DSTB Fly-Away Kit (FAK).

DSTB provides connectivity to NMCI from both military and commercial network service providers. DSTB offers a versatile and mobile virtual NMCI environment with office-like connectivity, while providing bandwidth optimization over high-latency circuits. DSTB provides virtual private network (VPN) / Internet Protocol security (IPsec) encrypted traffic over multiple external networks, and provides a single tunnel versus many Broadband unclassified Remote Access Service (BuRAS) connection.

The standard DSTB provides direct connectivity to the NMCI network for up to 44 devices with the option to scale up to 200 devices with additional switches.

The DSTB FAK is a compact solution with most of the same capabilities as the standard DSTB. The FAK supports 2–12 connections, is FAA compliant as carry-on luggage and allows for self-deployment as an option.

Activation of DSTB FAK I. The customer requests a DSTB activation as follows:

· The client site submits a DSTB FAK activation request with as much advance notice as possible. The request should be submitted at least 3 days before the activation time, but shorter intervals are accommodated whenever possible.

· The client submits the activation requests to one of the following commands:

· For an NMCI USN request, email the following:

GNOC: itservice.operations@navy.mil.

· For an NMCI USMC request, email the following:

MCNOSC: mcnoscwo@mcnosc.usmc.mil and cc NMCICCDM@nmci-isf.com

· For phone requests for when email is not accessible, call the following

GNOSC (USN): 1-757-203-0118

MCNOSC (USMC): 1-703-784-5300

· The GNOSC and MCNOSC each act respectively as the SPOC between the USN or USMC NMCI user community and the NMCI CC for DSTB Activations. GNOC and MCNOSC also act as the ultimate arbiter as to which enterprise capability completes the required direction in matters or disputes

· The following activation request information is required:

· Email title: DSTB Deployment for <location>

· Include the following in the email body:

· DSTB Cox ID

· Deployment location

· Deployment start and end dates

· Government and technical POC that can be reached for the DSTB activation. Provide names, email addresses, and complete phone numbers. Include the country code for commercial or Defense Switched Network (DSN).

· Connection type (ISP or satellite) ISP requires a contract number and service provider contact (for example…Verizon, AT&T, Comcast). Include which service provider and how the service can be identified if engagement is required

Satellite connections require a mission number or circuit identifier.

· DSTB public external static IP address, if known.

· Number of users to be supported by the DSTB.

· Planned deactivation date, if known.

· Any special instructions that can aid in the activation.

· If Premier Services are included in the order, briefly state the type of support requested (for example…Engineer deployment, Field Services [FS] technician dispatch, and so forth)

NOTE: Users can refer to the DSTB training materials or call the appropriate command (GNOC or MCNOSC) for assistance in submitting this request.

II. NMCI GNOC DET or MCNOSC Generates a DSTB Activation Ticket in Remedy The NMCI GNOC DET or MCNOSC processing the DSTB FAK activation request generates a BMC Remedy ticket to notify NMCI. The submitter receives an email confirming the request and providing the DSTB Activation request number III. NMCI CC Initiates Activation Process The NMCI CC processes the DSTB Activation request from the USN/USMC commands to the NMCI NOC IV. NMCI NOC Activates DSTB FAK NCMI NOC calls the user at the scheduled time to activate the DSTB FAK and provides the following enterprise services support:

· Acts as the technical lead between the client-site DSTB and the NMCI boundary for activation

· Verifies all user services on the DSTB activation request (for example…email, file, web, and print services)

Deactivation of DSTB FAK The following is an important security procedure that must be followed before DSTB is disconnected or turned off:

· On the planned deactivation date, the GNOC DET or MCNOSC contacts the POC to coordinate the time of deactivation.

· At an agreed-to time, a conference call is established to allow all parties to shut down the network port. The POC is included in this call.

· For securing the DSTB after usage, as part of the user training, the customer is provided instructions on how to remove data from the WANX device using the restart clean command.

· After the port has been shut down, the device may be turned off and packed away.

A-13

Acronyms

image1.png image2.jpeg image3.emf oleObject1.bin Text

Text image4.png image5.jpeg