P03_JA-BNJ-Palo Alto Firewalls -redacted.pdf

Data Center Firewalls Technical Refresh Control Number VA-20-00047255

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement Acquisition and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

Description of Action: The proposed action is for a firm-fixed-priced delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name Palo Alto firewalls.

Description of the Supplies or Services: VA, Office of Information and Technology, Information Technology Operations and Services, Infrastructure Operations (IO), Network Operations has a requirement for brand name Palo Alto Networks (Palo Alto) PA-7080 Base AC firewalls, M-600 firewall appliances, software licenses, ancillary hardware maintenance/software support and training. The equipment configurations include log, switch management and network processing cards; power cords;

transceivers; power supplies and memory. These requirements do not include any type of product development or installation services. The Contractor shall also provide brand name Palo Alto Premium Support and Palo Alto training services. The Palo Alto Premium Support shall be for extended service agreement with advance parts replacement shipment, next business day response time, software updates and coverage for a three (3) year period from the date of equipment delivery. Parts replacement shall not include the return of any type of memory or hard/disk drives.

Training shall be provided during two, five day online (remote) training courses offered during two separate weeks. The Palo Alto firewalls will be used to replace existing firewalls that are currently part of the firewall infrastructure located at the four IO Data Centers. The firewalls protect the VA systems and prevent increased risk to the VA systems. The IO Data Center networks support all programs and VA administrations, from application to end- user connections. All such equipment is to be replaced as the existing firewall infrastructure nears end-of-service. The period of performance shall consist of delivery of the required Palo Alto equipment within 90 calendar days after award. The period of performance for hardware and software maintenance and support shall be 36 months following the final installation of the hardware and software. The total estimated value of the proposed action is

Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

Rationale Supporting Use of Authority Cited Above: Based on extensive market research, as described in Item 8 of this justification, it was determined that limited competition is available among authorized resellers for this requirement. The Government requires replacement of IO Data Center firewall infrastructure as it nears EOS. The VA currently utilizes Palo Alto Networks brand hardware and software to meet the VA’s requirements for Application Firewall. Palo Alto brand name firewalls and related firewall equipment is the only hardware that can be used to replace the current IO Data Center firewall infrastructure.

Palo Alto brand firewalls is the only manufacturer that fully meets the following Government requirements because it provides compatibility with the VA’s custom security monitoring and alerting tools currently based on existing Palo Alto Networks platform. The Palo Alto firewalls provide the ability to scale up to 720Gbps which allows the application layer inspection to be done seamlessly through the addition of one or more chassis line cards and not through the addition of additional firewall chassis. They support a chassis-based next generation firewall architecture which is scalable within a single chassis from an initial baseline of 216Gbps to 720Gbps of application visibility, control, and provide a firewall solution not consisting of more than two firewall chassis at each data center location. The chassis-based architecture that supports multiple network traffic load distribution policies ensures that there is no set constraint that determines the slot or processor to which a given session is processed. The load distribution policy includes the following characteristics; fixed data plane, hash sessions distributed based on a hash of the source address or destination address, and ingress-slot default setting for session distribution. In this case, Input /Output (I/O) and security processing will be coupled on a per slot basis. Sessions will be distributed to the slot that contains the ingress interface of the first packet and processor selection is based on a hash of the source address and destination address. The data plane will be randomly selected from a pool of active data planes. The data plane is based on round robin between active data planes;

meaning that I/O and security processing will be shared among all active data planes. The data plane selected is based on the session count of each data plane and the one with the lowest count is selected for security processing. The firewall selects the data plane by a symmetric hash of sorted source and destination IP addresses.

VA Technical experts have concluded that no other brand firewall, including those identified in Item 8, could fully meet all of the Government requirements above. The software licenses are required for the software to operate and are based on a subscription-based model. The licensing controls the features and functionality for the hardware device as well as future patches and upgrades. Without licensing, the hardware device is inoperable and will not function. All licensing and software are proprietary to the vendor’s equipment. If this purchase is not made, the four IO Data Centers will be unable to meet the compatibility requirements for the enterprise firewall system that are needed to protect VA systems. The functionality of the VA enterprise firewall system must be maintained utilizing the current access control list, in its entirety, in order to prevent any increased risk to VA systems. Therefore, for the reasons indicated above, only Palo Alto firewalls and related firewall subcomponents and licensing can be used to replace the existing IO Data Center’s firewall infrastructure to meet the Government’s requirements.

6. Efforts to Obtain Competition: Market Research was conducted, details of which are in Item 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, the undersigned VA technical experts determined that limited competition is available among authorized resellers for brand name Palo Alto firewalls. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within fourteen (14) days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. Specifically, IO Network Operations will continue to monitor market trends, new/emerging products, and look for compatible and more advanced technologies to meet VA needs.

8. Market Research: The Government’s technical experts are continuing to conduct market research by reviewing other similar firewalls, from as early as March 2020.

The other hardware reviewed included firewalls manufactured by Cisco and Checkpoint. VA networking experts regularly review industry trade publications and conduct internet research to ascertain if any other firewall equipment meets the Government’s requirements. Based on all these market research efforts, the Government’s technical experts have determined that only Palo Alto firewalls and related firewall subcomponents, licensing, support, maintenance and training can meet all of VA’s needs. The Cisco and Checkpoint products do not meet the VA’s operability and compatibility requirements as described in Paragraph 5 and cannot be modified to meet the VA’s requirements.

Market research utilizing the NASA SEWP V GWAC Provider Look-up Tool was conducted in March 2020 and revealed multiple resellers of Palo Alto products, including multiple Vendor Information Portal (VIP) verified Service Disabled Veteran Owned Small Business (SDVOSB) resellers in NASA SWEP Group B2. Therefore, VA does anticipate limited competition for this action.

9. Other Facts: None.

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for brand name Palo Alto firewalls on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.