Request for Information (RFI) for Ruggedized NGFW 30 March 2026.docx

Request for Information (RFI) for Ruggedized Next-Generation Firewall Date: March 30, 2026

1.0 PURPOSE

The Air Force Life Cycle Management Center’s (AFLCMC) Control and Reporting Center (CRC) Program Management Office (PMO) is conducting market research to identify vendors with the capability to propose, deliver, and sustain a ruggedized, field-deployable Next-Generation Firewall (NGFW). This RFI seeks to identify sources capable of providing a comprehensive security solution that can be integrated into a transit case, operate in contested environments, and meet the demanding cybersecurity requirements of the Starshield project, enabling a Zero Trust security architecture, a security model that operates on the principle of "never trust, always verify," requiring strict identity verification for every person and device attempting to access resources on the network.

2.0 BACKGROUND

The CRC is modernizing its communications architecture to ensure Assured Tactical Communications for the Contested Environment and support Joint All-Domain Command and Control (JADC2) objectives. A key component of this modernization is the Starshield project, which leverages a commercial-first, proliferated Low Earth Orbit (pLEO) satellite architecture to provide a resilient, high-bandwidth data pathway.

The integration of the Starshield system necessitates a robust and agile cybersecurity solution to protect CRC networks and data. The Government requires an NGFW to act as a critical security enforcement point, integrating with existing CRC systems, Theater Deployable Communications (TDC) infrastructure, and future Deployable Infrastructure (DI). This firewall is foundational to establishing a Zero Trust framework, which relies on principles such as micro-segmentation, least-privilege access, and continuous verification. This RFI is focused on gaining information on a turnkey, ruggedized NGFW solution that can meet the performance, security, and environmental requirements for tactical deployment.

3.0 INFORMATION REQUESTED

The CRC PMO is seeking detailed information from vendors on their ability to provide a complete, ruggedized NGFW solution. Responses should address the following points in detail:

3.1 Solution Overview and Integration Approach

Describe your company's approach to providing a complete firewall solution. This shall include information on the proposed firewall model, its key features, and how it would be provided in a ruggedized configuration suitable for military transit and operation. The Government prefers Commercial-Off-The-Shelf (COTS) solutions that can be acquired through established government procurement vehicles. Include an estimated cost or rough order of magnitude (ROM) for the hardware and any ongoing subscriptions or support. Discuss any training or certifications for operating the equipment.

Vendors shall provide a detailed breakdown of the proposed licensing and subscription model. This description must clarify which security features, management capabilities, and support services require separate subscriptions. Please describe any available perpetual license options. Furthermore, explain the process for activating, renewing, and verifying licenses in environments that are air-gapped or operate without consistent internet connectivity. The proposed model must be suitable for disconnected, intermittent, and limited (DIL) operational scenarios.

3.2 Performance and Specifications

Provide detailed performance metrics for the proposed NGFW solution, including:

· Firewall Throughput (Gbps)

· Threat Prevention/Unified Threat Management (UTM) Throughput (Gbps)

· IPsec VPN Throughput (Gbps)

· Maximum Concurrent Sessions

· New Connections per Second

· Physical specifications including dimensions (e.g., rack units), weight, and port density (types, speed, and count for both copper and fiber).

For all stated performance metrics, including 'Threat Prevention throughput,' vendors must specify the exact conditions under which the measurements were obtained. This must include a description of the network traffic mix used for testing and a detailed list of all security services that were enabled during the performance test (e.g., Application Control (App-ID), Intrusion Prevention System (IPS), Anti-Malware, and SSL/TLS Decryption).

3.3 Advanced Security and Zero Trust Features

Describe the proposed firewall’s capabilities in the following areas:

· Application-level visibility and control (App-ID): Detail the ability to identify and control applications, regardless of port, protocol, or encryption.

· User-based policy enforcement (User-ID): Explain how the firewall integrates with user directories to enforce policies based on user and group identity.

· Advanced Threat Prevention: Describe the solution's capabilities for Intrusion Prevention (IPS), anti-malware (including sandboxing for unknown threats), and web/URL filtering.

· Encrypted Traffic Inspection: Detail the firewall’s ability to decrypt and inspect SSL/TLS traffic for threats.

· Encrypted traffic analysis: Describe the solution's ability to inspect and identify threats within encrypted traffic without requiring decryption. Detail any techniques used, such as encrypted traffic analysis, behavioral modeling, or metadata inspection

· Zero Trust Enablement: Explain how the proposed solution’s features (e.g., micro-segmentation, granular policy control, API integration) support the implementation of a Zero Trust architecture.

· To detect and mitigate network reconnaissance and denial-of-service attacks, including but not limited to IP address sweeps, port scans, and malformed packet attacks (e.g., LAND, Ping-of-Death, TCP SYN-FIN).

· Any artificial intelligence or machine learning capabilities.

3.4 Environmental Ruggedization

Describe how your solution will meet environmental requirements for transport and operation, referencing relevant standards (e.g., MIL-STD-810). Specifically address the system's suitability for military air transport requirements and for sustained operations in diverse and extreme global climates, including:

· Arid, high-temperature desert environments.

· High-humidity, saline-rich coastal or tropical regions.

· Sustained sub-freezing conditions.

· Operation in environments with high shock and vibration.

The proposed NGFW solution must be ruggedized and proven to withstand harsh operational environments. The solution must meet or exceed the following environmental and durability standards:

· MIL-STD-810H Compliance: Vendors must provide evidence of testing for the following methods:

· Operating Temperature (Method 501.7 & 502.7): Capable of sustained operation in ambient temperatures from -51°C to +71°C.

· Shock (Method 516.8): Certified for operational shock and crash safety profiles relevant to ground vehicles.

· Vibration (Method 514.8): Certified for vibration profiles common to ground vehicular and airborne transport.

· Humidity (Method 507.6): Capable of operating in high-humidity and salt-fog environments.

· Altitude (MIL-STD-810H, Method 500.6): The solution must be certified for full, unpressurized operation during air transport and at ground locations up to 15,000 feet.

· MIL-STD-461G (Electromagnetic Compatibility): The device must be certified for electromagnetic compatibility to ensure it does not produce or become susceptible to electromagnetic interference (EMI) when co-located with other electronic systems.

3.5 Management and Integration

Describe the management interface of the firewall. Explain how the device can be configured, monitored, and updated both locally and from a central management platform. Detail the solution's API capabilities and its ability to integrate with Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms.

Describe the firewall's ability to operate autonomously and continue enforcing all security policies when disconnected from the central management server. Explain the mechanism for local event logging, storage capacity for logs while disconnected, and the process by which stored logs are securely synchronized with the central manager upon reconnection.

Describe the solution's high availability (HA) and resiliency features. Specify the supported HA modes (e.g., Active/Standby, Active/Active), the mechanism for session state synchronization, and the typical failover time. Detail how an HA pair would be configured and managed within a single ruggedized transit case.

3.6 System Power Architecture

The solution shall be architected for primary use with standard AC power sources while providing seamless contingency operation from tactical DC sources.

Primary Power (AC): The system's primary power interface shall accept 90-264 VAC, 47-63 Hz single-phase power. The power entry and conditioning subsystem must be compatible with the electrical interface characteristics for AC power to ensure resilience against variations from generator and field power sources.

Secondary Power (DC): The system must include the capability to be powered directly from a 28 VDC nominal source characteristic of military vehicles, compliant with MIL-STD-1275E. This secondary input is critical for contingency operations and maintaining operational readiness in disconnected environments. Vendors shall detail their approach to power management, including any automatic or manual failover between AC and DC sources, and how their design ensures conditioned, stable power is delivered to all enclosed components regardless of the input source.

3.7 Component Power and Consumption

For the proposed integrated solution, vendors must detail the following:

· Input Power: Specify the supported AC input connector, voltage and frequency ranges (e.g., NEMA 5-15P, 100-240V AC, 50/60 Hz).

· Power Consumption: State the typical and maximum power consumption (in Watts) for the entire transit case solution under operational load.

· Redundancy: Describe options for redundant power supplies within the transit case and the failover mechanism.

3.8 Compliance and Support Requirements

Describe the proposed solution’s compliance with the following mandatory requirements:

· Approved Product Lists: The solution must be listed on one or more of the following approved product lists. Please specify the listing status for each.

· DISA Approved Products List Integrated Tracking System (APLITS): https://aplits.disa.mil/processAPList

· NIAP Product Compliant List (must be a U.S. Certified product): https://www.niap-ccevs.org/products

· Vendor Support: The proposed hardware must be fully supported by the vendor with ongoing security updates and patches. Confirm that the product is not end-of-life or end-of-support.

· TAA Compliance: The solution must be compliant with the Trade Agreements Act (TAA).

· "Cryptographic Validation: The solution's cryptographic modules must be validated as compliant with FIPS 140-2 or FIPS 140-3."

· "Supply Chain Risk Management (SCRM): Vendors must describe their corporate SCRM plan and detail the practices used to ensure the integrity of all hardware and software components throughout the product lifecycle."

4.0 REQUESTED RFI RESPONSE

Interested parties are requested to respond to this RFI by 30 April 2026. Send responses to Wendy Farley, Contracting Officer, wendy.farley@us.af.mil and Carlos Michel, Contracting Specialist, carlos.michel@us.af.mil. Hard copy submittals are not required. If late information is received, it may not be considered by the United States Government (USG) reviewers, depending on agency time constraints. Please note: the USG is not required to provide feedback to RFI Responders.

RFI responses shall be submitted in 8.5 x 11-inch page format using Microsoft Word or searchable Adobe Acrobat Portable Document Format. Responses shall be limited to 15 pages. Existing commercial documentation and product literature may also be submitted and are not included in the 15-page maximum. Responses must be unclassified, and any proprietary information provided must be marked accordingly.

5.0 DISCLAIMER

This is a Request for Information (RFI) only as defined in RFO Part 15.101 (c) to obtain information about capabilities and market information. This RFI is not a request for competitive proposals; Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.