PWS_Appendix 5 - PWS Technical Requirements.xlsx

Contents

0001 Appliances

0001B - Data Center Console Server 0001C - Data Center Circuit to IP Converter Appliance 0001D - Enterprise Network Policy Compliance Appliance and Licenses 0001E - Mobility Controller Appliance 0001F - Enterprise Time Server Appliance, Licenses, and Accessories 0001G - Remote-managed mPDU 0001Z - Physical Emerging Tech - General

• Supports multiple device models and licenses

• Supports the ability to accelerate application and data transfer over wide area and hybrid networks

• Supports the ability to increases application performance

• Supports hot swappable hard drives

• Supports the routing of multiple communications protocols, including IPv4 and IPv6, includes BGP support, port mirror capability

• Device should be available in multiple tiers

• Requirement for small:

○ Minimum 100Mbps Optimized capacity

○ Minimum 6,000 optimized flows

○ Minimum data store of 300GB

• Requirements for medium:

○ Minimum 400Mbps Optimized capacity

○ Minimum 25,000 optimized flows

○ Minimum data store of 600GB

• Requirements for large:

○ Minimum 1Gbps Optimized capacity

○ Minimum 150,000 optimized flows

○ Minimum data store of 3TB

• Configurable user rights and customer groups

• Remote authentication: LDAP, RADIUS, TACACS+

• FIPS 140-2 compliant cryptography

• Supports both a graphical and command line interface

• Multiple concurrent SSH sessions

• Simultaneous access on the same port

• Supports SNMPv3

• Allows remote access to manage devices through the console port in either 8, 16, 32, or 48 port increments

• Optional redundant power supplies

• Must be able to convert TDM Multiplexing legacy technology into IP based

• Must have interface options include T1/E1, serial, and 4WTO analog voice (2WFXS, 2WFXO, 4WE&M).

• Must be able to support clock modules for voice applications

• Must be able to Supports both a graphical and command line interface

• Support up to 10,000 Endpoints

• Supports up to 200 Switches / Wireless Devices

• Rack Mountable Chassis

• Must have 8 1g Ethernet copper ports fixed

• Must be able to support at least two 10gMM SFPs

• Must support up to 3 HDD and RAID-1

• Must support up to 6Gbs traffic monitoring

• Must support 802.1x authentication

• Must support up to 4 vCPUs

• Must be supportable across VMWARE ESXi v5.1, v5.5, v6.0, v6.5, Microsoft Hyper-V Server 2012, 2016, KVM on Red Hat Enterprise Linux (RHEL)/CentOS7.0

• Management device supports up to 25 Network Policy Compliance Appliances

• Must support Clustering

• Must support Antivirus add-on clients

• Must be able to share real-time information with existing multi-vendor reporting applications

• Must support real-time events with GUI based reporting

• Must be able to detect devices the instant they connect without agent software

• Must be able to allow, deny, or limit network access based on device posture and security policies.

• Must be able to initiate remediation and risk mitigation actions on malicious or infected endpoints.

• Support up to 16384 concurrent mobile sessions

• Support up to 4 10g fiber connections

• Support GRE, IPSEC, and SSL

• Support up to 2m Active Firewall Sessions

• Support 20Gps wired throughput

• Support IPV4 and IPV6

• Supports authentication, encryption, VPN connections

• Support stateful firewall policy enforcement

• Support both BYOD and 802.11ac devices

• Must have redundant power supplies

• Supports the capability of being remotely managed

• Must have built in DDOS protection

• Must be Stratum 1 Operations via GNSS satellites compliant

• Must have web GUI

• Must support TACACS+, RADIUS, and LDAP

• Must be able to synchronize with 100,000 clients

• Must be compatible with offers’ own Antenna Kit (antenna, cables, and adapters)

• Must support IPv4/IPv6

• Must support Rubidium Atomic Clock / OCXO oscillator upgrades

• Capacity mPDUs must meet specifications listed in the Appliance Descriptions

• Capacity mPDUs must allow power cycling individual outlets via remote management interface

0002 Firewalls

0002B - Network Stateful Firewall, Licenses, and Modules 0002C - Boundary Firewall , Licenses, Modules, and Management Systems 0002D - Data Center Premise Firewall Device and Modules 0002Z - Physical Emerging Tech - Firewalls

• Support for advanced threat detection and defense techniques to include machine learning

• Supports fine-grained visibility and policy control over application access/functionality, multi-gigabit, low latency and in-line deployment

• Supports identification of applications regardless of port, protocol, evasive tactic or Secure Sockets Layer (SSL)

• Supports protection against known and unknown application-borne threats

• Supports protection by IP address and port/protocol and also by inspecting certain application elements at layer 7

• Can be managed through a centralized manager that controls policies for multiple sites and devices

• Must have redundant power supplies

• Supports the ability to identify and control users regardless of IP address, location or device

• Supports the ability to perform layer 7 analysis in order to restrict access based on application layer filtering rule sets

• Supports the routing of multiple communications protocols, including IPv4 and IPv6

• These devices should be available on a tiered basis

• Requirements for Small:

○ Minimum 8Gbps throughput

○ Minimum 4Gbps IPSEC VPN throughput

○ Minimum 3Gbps threat prevention throughput

○ Minimum 900,000 concurrent sessions

○ Supports 1G copper and 1G/10G fiber interfaces

• Requirements for Medium:

○ Minimum 20Gbps throughput

○ Minimum 9Gbps IPSEC VPN throughput

○ Minimum 7Gbps threat prevention throughput

○ Minimum 2,000,000 concurrent sessions

○ Supports 1G copper and 1G/10G fiber interfaces

• Requirements for Large:

○ Minimum 90Gbps throughput

○ Minimum 60Gbps IPSEC VPN throughput

○ Minimum 70Gbps threat prevention throughput

○ Minimum 45,000,000 concurrent sessions

○ Supports up to 100G interfaces

• Requirements for Extra Large:

○ Supports various throughputs up to 200G via modules

○ Supports various IPSEC VPN throughputs up to 152G via modules

○ Supports various threat prevention throughputs up to 85G via modules

○ Modular supports of up to 100G interfaces

• Requirements for Enterprise:

○ Supports various throughputs up to 350G via modules

○ Supports various IPSEC VPN throughputs up to 190G via modules

○ Supports various threat prevention throughputs up to 184G via modules

○ Modular supports of up to 100G interfaces

• Base solution for each size category must include licensing to meet government encryption standards

• Must have redundant power supplies if supported by the model; Automatic Transfer Switch is acceptable if redundant power supplies not supported

• Supports management through a centralized platform capable of managing firewall policies

• Supports the ability to either terminate or support end remote access VPN

• Supports the ability to logically partition instances to allow multi-tenancy on a single platform

• Supports the ability to operate in routed or bridged mode

• Supports LACP

• Can deploy in both traditional HA as well as N+1 high availability architectures

• Supports the ability to provide stateful layer 3 and layer 4 inspection of traffic

• Supports the ability to terminate FIPS 140-3 compliant site to site VPN tunnels

• Supports the routing of multiple communications protocols, including IPv4 and IPv6

• Devices should be available on a tiered basis

• Requirements for Small:

○ Minimum of 3G multiprotocol throughput

○ Minimum 1,000,000 concurrent sessions

○ Support 1G copper and 1G SFP interfaces on-board

• Requirements for Medium:

○ Minimum of 10Gbps throughput

○ Minimum 3,000,000 concurrent sessions

○ Support 1G copper and 1G SFP interfaces on-board

○ Modular support of up to 10G SFP+ interfaces

• Requirements for Large:

○ Minimum of 30G multiprotocol throughput

○ Minimum 10,000,000 concurrent sessions

○ Modular support of 10G SFP+ interfaces

• Requirements for Extra Large:

○ Minimum of 50G multiprotocol throughput

○ Minimum 40,000,000 concurrent sessions

○ Modular support of 10G/40G interfaces

• Requirements for Enterprise:

○ Supports various throughputs up to 235G throughput via modular components

○ Supoorts various concurrent sessions greater than 30,000,000 via modular components

○ Modular support of up to 100G fiber interfaces

• VPN License should be available in a tiered structure based on supported user quantities

• Supports a management system that can be used to deploy configuration such as firewall policy and VPNs

• Supports application security licenses

• Supports DHCP relay

• Supports integrated security and LAN/WAN routing across high-density LAN/WAN interfaces

• Supports protection for all type of attacks and malware utilizing stateful inspection methods

• Must have redundant power supplies

• Supports LACP LAG

• Must support multiple routing instances on the same device in order to segregate routing tables

• Supports securing small to medium sized locations, large distributed enterprises, and co-located data centers

• Supports site to site IPSEC VPN that meet current DISA STIG requirements

• Supports the ability to provide stateful layer 3 and layer 4 inspection of traffic

• Supports the routing of multiple communications protocols, including IPv4, IPv6, OSPF,and BGP support

• Devices should be available on a tiered basis

• Requirements for Small:

○ Minimum 9Gbps throughput

○ Minimum 4Gbps IPSEC VPN throughput

○ Minimum 2,000,000 concurrent sessions

○ Minimum 15,000 security policies

○ Support up to 10G interfaces

• Requirements for Medium:

○ Minimum 40Gbps throughput

○ Minimum 5,000,000 concurrent sessions

○ Minimum 50,000 security policies

○ Support 1G/10G interfaces

• Requirements for Large:

○ Minimum 80Gbps throughput

○ Minimum 10,000,000 concurrent sessions

○ Minimum 50,000 security policies

○ Support 1G/ 10G interfaces

• Requirements for Extra Large

○ Minimum 400 Gbps throughput

○ Minimum 70 Gbps IPSEC VPN throughput

○ Minimum 60,000,000 concurrent sessions

○ Minimum 80,000 security policies

○ Support 1G/10G/40G/100G interfaces

• Requirements for Enterprise

○ Support various throughputs up to 1.4Tbps via modules

○ Support up to 269Gbps IPSEC VPN using AES-256

○ Support 1G/10G/40G/100G interfaces via modules

• Supports 10 Gbps interface modules

• Must integrate with firewall load balancer

• Must support LACP LAG

• Supports a management system that can be used to deploy configurations

• Supports high-speed multi-layer security for applications and systems in the data center

• Supports the ability to apply multiple layers of protection to prevent sophisticated cyber-threats

• Supports the routing of multiple communications protocols, including IPv4, IPv6, and BGP support

• Devices should be available in multiple tiers; small, medium, large, Extra Large

• Requirements for small:

○ Minimum 5Gbps throughput

○ Minimum 3,000,000 concurrent sessions

○ Minimum 2 Gbps VPN throughput

○ Must support 1/10Gbps interface speeds

• Requirements for medium:

○ Minimum 25Gbps throughput

○ Minimum 28,000,000 concurrent sessions

○ Minimum 16 Gbps VPN throughput

○ Must support 1/10Gbps interface speeds

• Requirements for large:

○ Minimum 50Gbps throughput

○ Minimum 45 ,000,000 concurrent sessions

○ Minimum 35 Gbps VPN throughput

○ Must support 1/10/25/40/100 Gbps interface speeds

• Requirements for Extra Large:

○ Minimum 400Gbps throughput

○ Minimum 200,000,000 concurrent sessions

○ Minimum 100 Gbps VPN throughput

○ Must support 1/10/25/40/100 Gbps interface speeds

0003 Load Balancers

0003B - Modular Data Center Load Balancer 0003C - Enterprise Load Balancer and Modules

0003Z - Physical Emerging Tech - Load Balancers

• Medium, Large, and Enterprise must support Multi-Tenancy

• Must support advanced authentication through CAC, Kerberos, and SAML

• Must support different high availability options. Different options would include traditional HA as well as N+1 options

• Must support multiple SSL capabilities to include SSL man in the middle, SSL bridging, SSL offload, and SSL passthrough

• Must support LACP LAG

• Support for BGP for use with anycast

• On Demand Scaling for virtual instances

• Product has extensible capabilities (scripting)

• Can be managed by a redundant central management system

• Can support forward proxy function

• Requires the option to automatically sync configurations across multiple devices in the same cluster

• Requires the ability to synchronize FIPS enabled key stores across all devices in the cluster

• Must meet all FIPS 140-3 guidelines with regards to TLS/SSL termination

• Device should be available in at least four tiers; small, medium, large, extra large

• Supports access policy management via a single management interface

• Supports enhancements to a load balancer provided via software modules

• Supports FIPS 140-3 capability either locally or through an HSM

• Supports FIPS 140-3 compliant key length requirements

• Supports FIPS 140-3 compliant application delivery services

• Supports global load balancing, SSL offload, DNSSec enhancements, access control, and firewall functionality.

• Supports multiple authentication methods such as Kerberos Constrained Delegation (KCD), LDAP, and OCSP, hardware accelerated SSL offload

• Supports IPv4/IPv6

• Supports multiple media types

• Supports multiple persistence methods including cookies, source IP address, and SSL Session ID

• Must have redundant power supplies

• Supports reverse-proxy load balancer that is capable of tearing down front-side Virtual IP address when some or all back-end servers cannot be reached

• Supports upgrading performance for each size tier via licensing

• Supports small software module for use with small data center load balancers

• Supports web application firewall functionality which resides as a software license on top of the existing enterprise load balancers.

• Requirements for small chassis:

○ Must support a minimum of 19 million concurrent layer 4 connections

○ Must support a minimum of 25Gbps throughput

○ Must support minimum 10,000 SSL transactions per second using FIPS 140-3 key sizes

○ Must support up to 25G interfaces

• Requirements for medium chassis:

○ Supports multi-tenancy for 4 tenants

○ Must support a minimum of 38 million concurrent layer 4 connections

○ Must support a minimum of 50Gbps throughput

○ Must support minimum 20,000 SSL transactions per second using FIPS 140-3 key sizes

○ Must support up to 25G interfaces

• Requirements for large chassis:

○ Supports multi tenant 18 tenants

○ Must support a minimum of 85 million concurrent layer 4 connections

○ Must support a minimum of 95 Gbps throughput

○ Must support minimum 50,000 SSL transactions per second using FIPS 140-3 key sizes

○ Must support up to 100G interfaces

• Requirements for Extra Large chassis:

○ Supports multi-tenancy for 36 tenants

○ Must support a minmum of 180 million concurrent layer 4 connections

○ Must support a minimum of 190 Gbps throughput

○ Must support a minimum 140,000 SSL transactions per second using FIPS 140-3 key

○ Must support up to 100G interfaces

• Requirements for Feature License Tier 1:

○ Must support Load Balancing and monitoring

○ L7 Intelligent traffic management

○ Must support extensible capabilities (scripting)

• Requirements for Feature License Tier 2 (plus everything in Tier1):

o Must support Advance routing o Global server load balancing o Must support DNS Services o Protocol Anomaly Detection o Network DDOS Protection o Must support high performance firewall

• Requirements for Feature License Tier 3 (plus everything in Tier 1 and Tier 2):

○ Must support Application Layer DDOS protection

○ Must support Layer 7 protection

○ Supports protections against structured query language (SQL) injection as well as cross site scripting (XSS)

○ Must include Access Management

○ Supports source IP reverse DNS look-up for access management

• Performance License Tier to allow the allocation of additional hardware resources to include:

○ Physical cores

○ Logical cores

○ Aggregate CPU

• Must support advanced authentication through CAC, Kerberos, and SAML

• Must support different high availability options. Different options would include traditional HA as well as N+1 options

• Product has extensible capabilities (scripting)

• Can be managed by a redundant central management system

• Can support forward proxy function

• Must support multiple SSL capabilities to include SSL man in the middle, SSL bridging, SSL offload, and SSL passthrough

• Must support LACP LAG

• Support for BGP for use with anycast

• Requires the option to automatically sync configurations across multiple devices in the same cluster

• Requires the ability to synchronize FIPS enabled key stores across all devices in the cluster

• Must meet all FIPS 140-3 guidelines with regards to TLS/SSL termination

• Supports access policy management via a single management interface

• Supports enhancements to a load balancer provided via software modules

• Supports FIPS 140-3 capability

• Supports FIPS 140-3 compliant key length requirements

• Supports FIPS 140-3 compliant application delivery services

• Supports global load balancing, SSL offload, DNSSec enhancements, access control, and firewall functionality.

• Supports multiple authentication methods such as Kerberos Constrained Delegation (KCD), LDAP, and OCSP, hardware accelerated SSL offload and IPv6

• Supports multiple media types

• Supports multiple persistence methods including cookies, source IP address, and SSL Session ID

• Must have redundant power supplies

• Supports reverse-proxy load balancer that is capable of tearing down front-side Virtual IP address when some or all back-end servers cannot be reached

• Supports small software module for use with small data center load balancers

• Supports web application firewall functionality which resides as a software license on top of the existing enterprise load balancers.

• On Demand Scaling of virtual instances

• Requirements for standard chassis:

○ Supports up to 8 modular processing cards

○ Load process sharing across the entire chassis

○ Fully meshed physical interfaces

○ Industry standard rack-mount chassis

○ Power Supply: AC power supply

○ Two to four 200-240 VAC (3000W)

○ DC power supply (option)

• Requirements for Enterprise chassis:

○ Supports more than 8 modular processing cards

○ Load process sharing across the entire chassis

○ Fully meshed physical interfaces

○ Industry standard rack-mount chassis

○ Power Supply: AC power supply

○ DC power supply (option)

• Requirements for Standard processing card:

○ 1.2 million l4 connections per second

○ L4/L7 Throughput: 95 Gbps

○ Max SSL TPS: 55,000 (2K keys)

○ Virtualization Support: 16-32 (4-8 per blade)

○ Processors: 14 physical processor cores (a total of 28 hyperthreaded logical processing cores)

○ 128GB or RAM

○ 1TB SSD Drive

○ Ability to easily remove SSD (if needed)

○ Network Interfaces:

○ 2x QSFP28/QSFP+

○ Proxied system controllers

○ Even allocation across operating guests for compression and SSL resources

○ Dedicated allocation of CPU, memory, and other resources

○ Per-guest rate limiting for bandwidth and SSL

• Requirements for Enterprise processing card:

○ 1.5 million l4 connections per second

○ L4/L7 Throughput: 100 Gbps

○ Max SSL TPS: 55,000 (2K keys)

○ Virtualization Support: 16-32 (4-8 per blade)

○ Processors: 14 physical processor cores (a total of 28 hyperthreaded logical processing cores)

○ 128GB or RAM

○ 1TB SSD Drive

○ Ability to easily remove SSD (if needed)

○ Network Interfaces:

○ 2x QSFP28/QSFP+

○ Proxied system controllers

○ Even allocation across operating guests for compression and SSL resources

○ Dedicated allocation of CPU, memory, and other resources

○ Per-guest rate limiting for bandwidth and SSL

• Requirements for Feature License Tier 1:

○ Must support Load Balancing and monitoring

○ L7 Intelligent traffic management

○ Must support extensible capabilities (scripting)

• Requirements for Feature License Tier 2 (plus everything in Tier1):

○ Must support Advance routing

○ Global server load balancing

○ Must support DNS Services

○ Protocol Anomaly Detection

○ Network DDOS Protection

○ Must support high performance firewall

• Requirements for Feature License Tier 3 (plus everything in Tier 1 and Tier 2):

○ Must support Application Layer DDOS protection

○ Must support Layer 7 protection

○ Supports protections against structured query language (SQL) injection as well as cross site scripting (XSS)

○ Must include Access Management

○ Supports source IP reverse DNS look-up for access management