SMIT Attch J-19 Transport Service Details Supplement_Final Rev1.docx

NAVAL ENTERPRISE NETWORK PROGRAM

UNITED STATES NAVY

Solicitation: N00039-18-R-0005 Attachment J-19, Transport Services Details

Version: Final Rev1 Date: 30 November 2018

Program Executive Office Enterprise Information Systems Program Manager, Naval Enterprise Networks 1325 10th Street, SE, Suite 301 Washington, DC 20374

Naval Enterprise Networks (NEN) Attachment J-19, Transport Services Details Program Management Office (PMW 205)

This document includes technical data for which the DON possesses Government Purpose Rights and should not be disclosed outside the Government except to entities, which have executed the DFARS Part 227 non-disclosure agreement and handled IAW the terms of such agreement.

i ii

Table of Contents

PART A

Program Management Office (PMW 205) i

PART A

INTRODUCTION

This document identifies additional details for delivery of Non-NMCI Server Connectivity Services, Non-NMCI Seat Connectivity Services, Network Interface Services and Deployable Site Transport Boundary (DSTB) Services referenced in section 3.3.3.1.1, 3.3.3.1.2, 3.3.3.1.3 & 3.3.3.2.2 of the SMIT PWS.

Non-NMCI Server Connectivity Services Non-NMCI Server Connectivity Services leverage NMCI network infrastructure and transport support services to provide network connectivity for non-NMCI servers. These Command Owned Servers are connected via SDP and B3 COI’s.

This service includes the following options:

a. Provides 100 Mbps, 1 Gbps, or 10 Gbps connectivity to the local NMCI environment.

b. Provides 100 Mbps, 1 Gbps, or 10 Gbps connectivity with additional availability outside or beyond the local NMCI environment with an increased level of availability, security and performance.

c. Provides for the one-time engineering and development of the capability and services including but not limited to Public IP, DNS, and Directory Service Uplifts and PKI Authentication, non-NMCI & NMCI Antivirus scan, and DNS Hosting uplifts for Navy application servers.

d. Provides static IP addresses (in addition to those provided under the Basic Application Server Services) assigned to the requested server’s Network Interface Card.

Non-NMCI Seat Connectivity Services Non-NMCI Seat Connectivity Services leverage NMCI network infrastructure and transport support services to provide network connectivity for non-NMCI seats. The Government is responsible for securing the ATO and maintaining the cybersecurity posture of the non-NMCI seat. This service provides network connectivity and other network-enabled services available as uplifts.

In addition, this service provides a one-time set up to allow Government-provided Program of Record (POR) workstations to access the network in accordance with Section 3.3.3.1.2 in the PWS. Examples of these devices include Defense Enrollment and Eligibility Reporting System (DEERS), Real-time Automated Personnel Identification System (RAPIDS) workstations, Global Command and Control System (GCCS) workstations and other similar workstations requiring direct connectivity of a POR device to the BAN/LAN/WAN. Only one (1) POR device shall be connected to its assigned access point.

These seats must connect to a secure VLAN to prevent unauthorized access on the network. The Government will be responsible for connecting and disconnecting all POR devices at the access point. The Government will be responsible for all IA scanning and for maintaining IAVA compliance of all devices connected to the NMCI network through the use of this service.

Network Interface Services Network Interface Services provides secure connectivity for internal and external Communities of Interest (COIs) via NMCI. This service provides network connectivity and other network-enabled services available as uplifts. Uplifts cover support for boundary change requests to existing solutions (e.g. modifications to ACLs, Firewalls, VPNs and GTSEs). The COIs include B3s, SDPs, DMZs, GTSEs and Legacy Systems Support.

Boundary Three Community of Interest (COI) Interface The B3 COI is an enclave within the NMCI network. The B3 boundary and network infrastructure within the COI is managed by the contractor. COIs are generally setup to either protect the data within the COI from the general NMCI user or to protect the NMCI network from the systems within the COI. The security mechanisms in B3 are flexible, and allow individual user participation in multiple COIs. Depending on the security requirements, the COI boundary could be a router, Access Control List (ACL), firewall, VPN or other similar equipment.

Figure depicts a Boundary Three COI:

Boundary Three (B3 COI) Switch -1 Switch -2 Switch -3 GFE Servers GFE Servers GFE Servers Enclave Router + ACL Or Firewall/VPN + rule

Figure 1-3 depicts a Boundary Three COI Interface:

Figure 13: Boundary Three COI Interface

Service Delivery Point (SDP) Community of Interest (COI) Interface The COI SDP is an enclave within the NMCI network. The COI SDP provides a network connection for the Government to plug their network into. In some cases, the COI requires transport Services only with no further access to any NMCI Services. In this scenario, the separation mechanism for transport can simply be Virtual Local Area Network (VLAN) isolation with an ACL, Virtual Route Forwarding (VRF) over Multiprotocol Label Switching (MPLS) or a more complex setup using an IP Security (IPSEC) VPN or Type I encryption.

Figure depicts a SDP COI:

Router + ACL Or Firewall/VPN & rule set Service Delivery Point (SDP) GFE Router or Switch GFE Servers GFE Servers GFE Servers Enclave

Figure 14 SDP COI Interface

Demilitarized Zones (DMZ) The DMZ restricts and controls access to information while shielding the internal NMCI network from outside attacks. Direct access to all external networks from the NMCI is restricted. Access by users external to the NMCI is through approved DMZ portals. This service also provides Intrusion Prevention System (IPS) and Host Intrusion Prevention System (HIPS). The IPS Service will provide the security infrastructure components (Network/Server/Seat) necessary for NMCI to automate the detection and prevention of anomalous or unauthorized network activity, as defined by Computer Network Defense (CND) authorities. This service includes Network based Intrusion Detection System (IDS)/IPS components as well as the capability to analyze and archive the data collected and report the data and analysis to external CND organizations.

Figure 1-5 depicts a Demilitarized Zones (DMZ):

Figure 15 Demilitarized Zone (DMZ)

Generic Transport Service Extension (GTSE) The GTSE solution provides a virtual point-to-point circuit between two locations using the NMCI network as transport. In some cases, this is used to bring NIPRNet or SIPRNet to a site by creating a virtual circuit between the site and the outer router of the NMCI Boundary 1. GTSE also provides direct connectivity for collocated third-party network domains or logical transport services where the end-points are outside the NMCI enclave. The GTSE solution architecture is to provide NIPRNet access to third-party USN network enclaves, such as Information Technology for the 21st Century (IT-21), outside the Continental United States (OCONUS)-Navy Enterprise Network (ONENet), and other approved USN legacy network domains.

Figure 1-6 Generic Transport Services Extension (GTSE)

MB1

Outer Router Enclave Boundary 1 NIPRNet or SIPRNet Enclave Site X VPN / Type 1 Encryption Enclave

WAN

VPN / Type 1 Encryption Legacy or Customer Network

Legacy Network Connectivity Services The USN network is connected to a number of legacy networks via B2 Firewalls to access legacy applications. This provides continuous legacy systems support for operational and functional systems to enable operation on the NMCI network. Figure 1-7 depicts a Boundary Two connection to Legacy Networks.

Figure 17 B2 for "Reach Back" into Legacy Networks

NIPRN/ Internet NMCI Enclave Legacy Network

GFE

GFE Servers GFE Switch or Router B2 Firewall + rule set Traffic Initiated

Figure 18 B2 for Legacy Networks to Access Enclave Citrix Service

NIPRNET/ Internet NMCI Enclave Legacy Network Traffic Initiated GFE Workstations GFE Switch or Router B2 Firewall + rule set Citrix Server Farm

Deployable Site Transport Boundary (DSTB) Services DSTB services allow the end–users to establish connectivity to the NMCI/Marine Corps Enterprise Network (MCEN) using a variety of commercially available transports including commercial, Digital Subscriber Line (DSL), wireless, satellite, and cellular communications.

The DSTB solution offering provides USN and USMC personnel direct access to the NMCI network while deployed. DSTB is a secure solution that allows a small network footprint to reach NMCI resources from the field. The DSTB solution offering presents two solution options, the DSTB Core and the DSTB Fly-Away Kit (FAK).

DSTB provides connectivity to NMCI/MCEN from both military and commercial network service providers. DSTB offers a versatile and mobile virtual NMCI environment with office-like connectivity, while providing bandwidth optimization over high-latency circuits. DSTB provides virtual private network (VPN) / Internet Protocol security (IPsec) encrypted traffic over multiple external networks, and provides a single tunnel versus many Broadband unclassified Remote Access Service (BuRAS) connection.

The DSTB solution offering provides a stand-alone, mobile transport boundary solution to connect directly to the NMCI network. DSTB Core assembles, in a single unit, everything needed to remotely connect up to 48 connections (with the option to support up to 200 connections with additional switches) on the NMCI network. The DSTB Core solution comes complete with routers, switches, virtual private network (VPN) appliance and WAN accelerator (WANX). DSTB provides versatile WAN connectivity options including T1, digital subscriber line (DSL), DS3, Ethernet, and Fiber.

The DSTB FAK is a smaller, more compact solution with all of the same capabilities as the DSTB Core. The DSTB FAK solution comes complete with virtual private network (VPN) appliance and WAN accelerator (WANX) and two switches. The FAK supports up to 12 connections, is Federal Aviation Administration (FAA) compliant as carry-on luggage. DSTB Fly-Away Kit (FAK) can connect to WAN transport using only an Ethernet connection. Both kits can self-deploy (training is required) and has the option of deploying SIPRNET.Activation of DSTB I. The customer requests a DSTB activation as follows:

The client site submits a DSTB activation request with as much advance notice as possible. The request should be submitted at least 2 days before the activation time, but shorter intervals are accommodated whenever possible. The client will submit activation requests to the Navy NETWARCOM (NNWC) and Marine Corps Network Operations and Security Center (MCNOSC) for their respective NMCI user communities.

II. NNWC or MCNOSC Generates a DSTB Activation Ticket in HP Service Manager.

The submitter receives an email confirming the request and providing the DSTB Activation request number when it becomes available.

III. NMCI CC Initiates Activation Process The NMCI CC processes the DSTB Activation request from the USN/USMC commands to the NMCI NOC IV. NMCI NOC Activates DSTB NCMI NOC calls the user at the scheduled time to activate the DSTB and provides the following enterprise services support:

· Acts as the technical lead between the client-site DSTB and the NMCI boundary for activation

· Verifies all user services on the DSTB activation request (for example…email, file, web, and print services)

Deactivation of DSTB The following is an important security procedure that must be followed before DSTB is disconnected or turned off:

· On the planned deactivation date, the NMCI NOC or MCNOSC contacts the POC to coordinate the time of deactivation.

· At an agreed-to time, a conference call is established to allow all parties to shut down the network port. The POC is included in this call.

· For securing the DSTB after usage, as part of the user training, the customer is provided instructions on how to remove data from the WANX device using the restart clean command.

· After the port has been shut down, the device may be turned off and packed away.

A-14

Acronyms

image1.png image2.jpeg image3.emf oleObject1.bin Text

Text image4.png image5.emf oleObject2.bin

INTERNET

NIPRNET

image6.emf oleObject3.bin

INTERNET

NIPRNET