Att 2 PWS WBAS 15 Nov 2024.pdf

Performance Work Statement for White Box Access Switch

1 | P a g e

PERFORMANCE WORK STATEMENT (PWS)

FOR

LAYER 2 WHITE BOX ACCESS SWITCHES (WBAS)

Fort Belvoir, Virginia

Final Draft 15 November 2024

2 | P a g e

Table of Contents

1. Background

2. Objective

3. Scope of Work

4. Requirements

4.1 Description of Services

4.2 Hardware Requirement

4.3 Software Requirement

4.4 Product Analysis

4.4.1 Market Research

4.4.2 Vendor Engagement

4.4.3 Technical Analysis

4.5 Test Plan Contribution

4.5.1 Test Methodology

4.5.2 Test Scenarios

4.5.3 Setup and Configuration

4.5.4 Test Plan Creation

4.5.5 Approval Process

4.6 Execution of Testing

4.6.1 Functional Testing

4.6.2 Performance and Stress Testing

4.6.3 Standards Validation

5. Deliverables/Reporting Requirements

5.1 Quality Assurance Plan

5.2 Status Reporting

5.3 Testing Reporting

5.3.1 Test Reports

5.3.2 Process Documentation

5.3.3 Supporting Documentation

5.3.4 Comprehensive Summary Report

5.4 Cost and Schedule

6. Acceptance Criteria

7. Period of Performance

8. Place of Performance

8.1. Test Sites

8.2 Test Site Conditions

8.3 Advanced Testing

8.4 Secure Data Handling Facilities

8.5 Technical Support Staff

8.6 Permissions

9. Project Management

9.1 Task Order Management

9.2 Configuration and Data Management

9.3 Records, Files and Documents

10. Timelines

11. Communication

12. References

3 | P a g e

1. Background The United States (U.S.) Army, Program Executive Office, Command, Control, Communications- Networking (PEO C3N), Program Manager (PM) Integrated Enterprise Network (PM IEN) identified the need for a flexible, scalable, and secure network solution that can be standardized and deployed across the entire Army enterprise. PM IEN is seeking information from Information Technology Enterprise Solutions 3-Services (ITES-3S) prime contractors that can provide certification testing support services for White Box Access Switch (WBAS) solutions. A WBAS is the combination of an open network install environment (ONIE) network switch with an open-sourced and/or custom network operating system (NOS) installed on it.

Traditionally, the Army has acquired software and hardware from the same original equipment manufacturers (OEM). OEMs often require technical refreshes of the hardware platform when a software upgrade is desired, even if a single component of the hardware (i.e., compute, storage, memory, network interface controller (NIC), etc.) is not adequate. The WBAS solution will address these challenges in a cost-effective manner. By embracing a Modular Open Systems Approach (MOSA), the Army will continue developing a robust, adaptable, and sustainable network infrastructure that aligns with the ever-evolving demands of the operational environment.

WBAS solutions must be compatible with software-defined local area network (SD-LAN) and software defined network (SDN) orchestration. This will allow centralized management and integration with existing management tools and equipment on the existing network. WBAS leverage an open network standards architecture to enhance network flexibility and programmability. This architecture disaggregates software and hardware, allowing for the implementation of open-sourced and/or custom NOS on the switch of choice. WBAS can function in multiple roles, including core, edge, distribution, spine, leaf, and data center switch roles. The focus area of this effort is the replacement of the Army’s current edge access switch (EAS) with a WBAS solution.

Before these solutions can be standardized and disseminated across the Army’s non-classified internet protocol router network installation campus area network (N-ICAN), they must undergo rigorous testing and evaluation to ensure compliance with all operational and cybersecurity standards. The selected contractor will play a critical role in selecting the products that meet or exceed the Army’s requirements, establishing a test strategy, conducting thorough assessments, and guiding the selected system configurations through the Department of Defense (DoD) approved products list (APL) or the National Information Assurance Partnership (NIAP) list certification process.

2. Objective The objective of this Performance Work Statement (PWS) is to gather information from industry and the commercial sector. The U.S. Army, PM IEN is seeking to identify contractors that have the ability to perform all requirements listed within the PWS and to use the information provided from said contractors to develop an acquisition strategy. From the responses received, PM IEN should be able to understand how the contractor will provide the analysis of which WBAS solutions (minimum of 3 separate configurations) meet the Army’s requirements, procure the WBAS elements, identify the contractor’s process to certify the hardware and software configurations through the APL or NIAP, understand how the contractor will be able to prove hardware and software assurance for the WBAS, and provide a Rough Order of Magnitude (ROM) outlining all costs and resources required.

4 | P a g e

3. Scope of Work This PWS specifies the requirements for a contractor to identify and procure commercial off the shelf (COTS), open network install environment (ONIE) configurable, Layer 2 power over ethernet (PoE) preferred (not required) access switches capable of performing Layer 3 functions. The contractor must also be able to configure an open-sourced NOS on the selected hardware. This requires a detailed analysis of the selected Original Device Manufacture (ODM) hardware (HW) and software (SW).

The contractor shall also test, provide assurance reports, and accepted testing articles (test results that are accepted by the DoD which would allow the HW and SW to integrate into the Army’s network).

Key activities will involve establishing a robust testing framework, performing comprehensive testing procedures, and documenting all findings. Government approval of the proposed solutions will ensure compliance and facilitate their acceptance within DoD regulations, thus promoting their validity for APL or NIAP certification. The contractor will provide all necessary personnel and resources to fulfill the functional and technical requirements outlined in this PWS.

The contractor’s work will be limited to supporting the project officer and acquisition specialist in a manner that ensures the government retains inherently governmental decision-making authority; and shall not perform any functions specifically mandated as government employee functions. This restriction includes but is not limited to activities that require either the exercise of discretion in applying government authority, or the making of value judgments in decision making for the government.

4. Requirements

4.1 Description of Services

The contractor is responsible for delivering the expertise, workforce, and resources necessary to execute various services, including but not limited to: program management and engineering support for on-site testing. The contractor will provide the specialized engineering assistance to verify that the WBAS aligns with the Army's performance, scalability, and security criteria.

4.2 Hardware Requirement

Hardware Requirements Requirement Description Availability The ODM switch must be COTS Configuration The switch must be ONIE Network Maturity Level The switch must be Layer 2; however, it must support Layer 3 capabilities for future maturation.

Ports Must support a minimum 12 x 1 Gigabit Ethernet ports/maximum

48 x 1 Gigabit Ethernet ports, with at least 4 x (10 Gigabit or higher) ethernet/fiber uplink ports.

Port Type Must support RJ45 user ports, must support a minimum of 4 SFP/SFP+, and or QSFP/QSFP+ uplink ports.

Switching Capacity The switch must support a minimum threshold for switching capacity:

o 24 port 1GbE ethernet switch @ 48 Gbps o 48 port 1GbE ethernet switch @ 96 Gbps

5 | P a g e

Forwarding Rate The system must support a minimum threshold for the forwarding rate:

o 24 port 1GbE ethernet switch @ 71 Mpps o 48 port 1GbE ethernet switch @ 142 Mpps

Latency Must support latency of less than 2 microseconds.

MAC Address Table Size Must support a minimum 16,000 entries.

VLAN Support Must support a minimum 1,000 VLANs.

Jumbo Frame Support Must support up to 9198 bytes.

PoE Support IEEE 802.3af/at – user ports must support PoE/PoE+ with a minimum of 15W per port (preferred not required).

Redundancy Stacking ports must not reduce backbone uplink port capacity.

Power Supply Must support dual redundant, hot-swappable power supplies.

Cooling Must support dual redundant, hot swappable fans or have variable speed fan control.

Mounting Options The chassis must be rack mountable.

Dimensions Must support standard 1U or 2U form factor.

Environmental Specifications

Must be able to operate in the following conditions: Operating temperature: 0°C to 45°C, Storage temperature: -40°C to 70°C, Humidity: 10% to 90% non-condensing.

Packet Buffer Must support a minimum of 8MB.

DRAM Must support a minimum system memory of 8GB.

Management Must support a console port, USB port, and logical Out-of-band management.

4.3 Software Requirement

Software Requirements Requirement Description Network Operating System (NOS)

The switch must run an open source-based operating system (BSD/Linux) with support for containerized/virtual applications.

Management Must support CLI over SSH and Telnet, Web-based GUI, CLI, SNMP v2/v3, RMON, and RESTful API, Syslog, OOBM.

Security Features Must support Access Control Lists (ACLs), Port Security, DHCP Snooping, 802.1X Authentication, IP Source Guard, MAC address filtering, MACSec.

Quality of Service (QoS) Must support Layer 2/3/4 QoS, with support for 8 queues per port. Classification, Policing, Shaping, Scheduling.

Spanning Tree Protocol Must support IEEE 802.1D STP, 802.1w RSTP, and 802.1s MST.

Link Aggregation Must support IEEE 802.3ad LACP, Static Link Aggregation.

Multicast Must support IGMP Snooping v1/v2/v3, MLD Snooping.

IPv6 Support Must support Full IPv6 including RA Guard, DHCPv6 Snooping.

Firmware Updates Must support open-sourced online/offline firmware updating.

Logging and Monitoring Must support Syslog, sFlow, NetFlow, and Port Mirroring.

Software Licensing Must provide clear information regarding any software licensing and any additional costs.

6 | P a g e

VLAN Support Must support VLAN tagging (802.1Q), Voice VLAN, Private

VLAN.

4.4 Product Analysis

4.4.1 Market Research

Conduct comprehensive market research to identify existing and available COTS Layer 2 access switches that can perform Layer 3 functions (PoE preferred). They must meet the U.S. Army’s requirements. The focus will be on hardware solutions that have ONIE standards, which will enable the installation and configuration of any NOS. The NOS should be open-sourced and free from any proprietary association to the hardware.

4.4.2 Vendor Engagement

Engage potential vendors to obtain quotes for WBAS solutions, including hardware and software.

Quotes should include the baseline costs, warranty costs, and any subscription/recurring costs associated with the products.

4.4.3 Technical Analysis

Identify and provide an analysis on the hardware and software selections that would be used to provide a WBAS solution. Exhibit interoperability and integration with the Army’s network by confirming traceability to the Army’s requirements. Showcase a minimum of 3 WBAS solutions, ranking them from most to least viable.

4.5 Test Plan Contribution

4.5.1 Test Methodology

Assist the government in creating a comprehensive test plan (TP) outlining the methodology for assessing WBAS performance, functionality, interoperability, cyber security compliance, software and hardware assurance, and integration with the Army’s N-ICAN. The contractor shall define the test agencies and locations, identify costs associated with test events, coordinate post-test data processing and evaluation, and provide detailed test synopses for the review of all approved and interested personnel. The test methodology needs to incorporate certification of the products on the APL or NIAP list.

4.5.2 Test Scenarios

Create test scenarios that will prove integration with the Army’s N-ICAN requirements, that will validate features and functionality for Layer 3 SD-LAN/SDN interoperability, and that will thoroughly evaluate the security baseline of the product to ensure each component of the WBAS solution may be used on the Department of Defense Information Network (DoDIN).

4.5.3 Setup and Configuration

Establish a testing environment replicating the operational conditions within the U.S. Army's N-ICAN, and a Layer 3 SD-LAN/SDN infrastructure. Configure a minimum of 3 WBAS options to test.

4.5.4 Test Plan Creation

Develop a detailed TP outlining procedures for assessing the functionality, performance, 7 | P a g e interoperability, scalability, and security of each selected model.

4.5.5 Approval Process

Submit the TP for evaluation and approval by the U.S. Army Contracting Officer’s Representative (COR) to ensure it meets all defined requirements.

4.6 Execution of Testing

4.6.1 Functional Testing

Implement the TP to rigorously evaluate selected configuration’s capabilities and identify areas requiring enhancement. Conduct thorough testing of WBAS solutions to ensure robust, adaptable, and secure network services. Conduct functional tests to evaluate WBAS interoperability with diverse NOS, integration within the existing N-ICAN, and compatibility with SD-LAN/SDN orchestration.

4.6.2 Performance and Stress Testing

Assess WBAS performance under different network loads and stress scenarios to confirm it meets the Army's operational requirements.

4.6.3 Standards Validation

Ensure each configuration satisfies all operational and cybersecurity standards necessary for Army network compliance upon completion of all necessary testing.

5. Deliverables/Reporting Requirements The contractor shall furnish equipment and/or materials for the purpose of supporting the initial delivery of each new configuration item procured via the contract. All deliverables are subject to Government approval and acceptance. They shall meet DoD standards and the requirements set forth within the PWS. All deliverables shall be produced using recommended software tools/versions as accepted by the Government.

All deliverables shall be submitted to the COR via email and to the Contracting Officer (CO).

Delivery format for reports, documentation presentations, briefings, and diagrams shall be via electronic media. All technical documentation and data exchanged between the contractor and the Government shall be protected from public disclosure.

5.1 Quality Assurance Plan

The Contractor shall be required to provide a Quality Assurance Plan (QAP). At a minimum, the detailed QAP shall address best practices, service assurance, and key personnel. The government will review and provide concurrence or make recommendations for adjustments as needed. The contractor’s QAP will address the coordination of the workload and job scheduling priorities. There will be no supervision of the offeror’s employees by the COR. The offeror shall ensure that the offeror’s personnel perform professionally and provide deliverables as required.

5.2 Status Reporting

The contractor shall provide a written Status Report (SR) in recurring intervals. An updated SR should be provided whenever a government decision is needed, a change in the project occurs, or when a milestone is accomplished during the project. The SR shall include both a technical update on current

8 | P a g e status, summary of work accomplished during the reporting period and percent complete, problems encountered and resolutions, a funding profile showing hours expended by labor category for the month and a schedule of activities planned. The contractor will be responsible for tracking remaining hours to complete activities.

5.3 Testing Reporting

5.3.1 Test Reports

Generate comprehensive Test Reports (TR) for each evaluated WBAS solution, detailing test scenarios, methodologies, data analyses, and overall results. The contractor shall provide detailed post-test reports to the government to include a description of the test set-up, all data collected during the testing, diagrams of the test setup and execution (as applicable), and any observations made during the test. Any test failures shall be well documented.

5.3.2 Process Documentation

Prepare necessary documentation for certifying the selected WBAS solution into the APL or NIAP, ensuring compliance with all U.S. Army standards, and aligning the WBAS solutions with the governing requirements of the chosen product list certification. For cybersecurity capture all necessary information and document the results of all tests to ensure they are accepted for integration of the WBAS solution on the DoDIN.

5.3.3 Supporting Documentation

Include all pertinent supporting materials, such as testing reports, product datasheets, specifications, RFI documentation, and APL/NIAP/cybersecurity documentation.

5.3.4 Comprehensive Summary Report

Compile a final project report summarizing the testing and evaluation process, assessing the suitability of each WBAS solution for the U.S. Army, and proposing the most appropriate WBAS solution(s) based on findings from testing and market analysis. Include testing articles, certifications, letters of compliance (LoC), authorization documentation, or acceptable forms or reports that enable the WBAS solution to operate on the DoDIN.

5.4 Cost and Schedule

The Rough Order of Magnitude (ROM) estimate includes assumptions regarding the scope of work, deliverables, schedule, and resources. Any significant changes to these assumptions may result in adjustments to the requirement. Once additional information becomes available, a more detailed requirement will be provided during subsequent phases of the project.

Please provide a Rough Order of Magnitude (ROM) with breakout of all activities associated with procuring hardware and software, testing (functional, performance, cybersecurity) and any additional activities necessary to obtain APL/NIAP certification: labor hours, labor categories and labor rates.

6. Acceptance Criteria To assure the quality and completeness of the deliverables, the following acceptance criteria must be met:

9 | P a g e

• Documentation: must thoroughly summarize market research, including detailed comparisons of WBAS solutions and vendor quotes.

• Test Plan: Must be reviewed and approved by the U.S. Army COR before testing begins, clearly defining methodology, scenarios, and tools.

• Testing Documentation: Must meet all U.S. Army or authoritative testing agency requirements for completeness, accuracy, and format to support the solution’s inclusion in the APL/NIAP, to capture cybersecurity findings, and reporting full discovery of HW/SW assurance tests.

• Testing Reports: Must be accurate, comprehensive, clear, and include documented issues and mitigation strategies and approved by the U.S. Army COR.

• Final Report: Must provide a comprehensive and well-supported assessment of WBAS solutions, including clear recommendations, and must be approved by U.S. Army COR.

7. Period of Performance The period of performance shall be for 12 months from the date of Task Order (T.O.) award, with an option for additional support (up to 24 months) to be provided in support of the WBAS.

8. Place of Performance

8.1. Test Sites

The primary test site will serve as the central hub for all major testing activities evaluating the WBAS solutions. This site will be fully equipped with the necessary infrastructure, tools, and resources to replicate the U.S. Army's N-ICAN environment with the ability to test SD-LAN/SDN functionality. Any third-party testing facility must be identified and accepted by the government COR.

All test labs must comply with DoD standards for security, data handling, and operational procedures.

This includes secure access controls, data encryption, and compliance with additional requirements specific to the testing activities.

8.2 Test Site Conditions

Any damage caused by the contractor to existing government agency test site facilities or equipment which might occur during site preparation, installation, testing or cutover of the system will be repaired at the expense of the contractor. The site shall be restored to the original condition which existed prior to the event unless otherwise directed.

8.3 Advanced Testing

The contractor shall demonstrate that the installed system meets the reliability/ availability/ maintainability requirements of the T.O. Mean Time Between Failure (MTBF) and Mean Time to Recovery (MTTR) data will be used to calculate the reliability/ availability/ maintainability of the system. The calculations shall be based on all of the equipment installed in the network.

The site will have access to a suite of advanced network testing tools, including traffic generators, network analyzers, and simulation software. These tools will be used for functional, performance, and stress testing under various scenarios and network conditions.

8.4 Secure Data Handling Facilities

10 | P a g e

All project and test data produced at any testing facility must be secured properly, safely handled, and stored appropriately. Data storage and handling must comply DoD security requirements. All data collected during testing will be encrypted and stored in compliance with military standards, ensuring sensitive information is protected.

8.5 Technical Support Staff

The contractor must supply the appropriate level of support elements to ensure that all testing activities are executed according to the approved test plans and to ensure the staff are capable of promptly addressing any issues that may arise.

8.6 Permissions

Strict access control mechanisms should be implemented to limit access to the testing environment.

Only authorized project personnel should have access to the source code, project documents, and configuration files. Use role-based access control (RBAC) to assign appropriate permissions and track access logs to ensure accountability.

9. Project Management Within 15 days of the task order award, the contractor shall obtain approval through the government outlined in this PWS. Additionally, the contractor shall identify a Program Manager (PM) who will be the primary representative responsible for all work awarded under this contract. The PM will participate in program management reviews and ensure all standards referenced herein are adhered to.

9.1 Task Order Management

The contractor shall establish and provide a qualified workforce capable of performing the required tasks. The workforce may include a project/T.O. manager who will oversee all aspects of the T.O. The contractor shall use key performance parameters to monitor work performance, measure results, ensure delivery of contracted product deliverables and services, support management and decision-making and facilitate communications. The contractor shall identify risks, resolve problems and verify effectiveness of corrective actions.

9.2 Configuration and Data Management

The contractor shall establish, maintain and administer an integrated data management system for collection, control, publishing and delivery of all program documents. The data management system shall include but not be limited to the following types of documents: white papers, status reports, audit reports, agendas, presentation materials, meeting minutes, contract letters, and T.O. Proposals. The contractor shall provide the government with electronic access to this data, including access to printable reports. The contractor shall provide as-built documentation including, but not limited to, drawings and diagrams of the solution provided under each T.O. The contractor shall review and update the T.O.

associated documentation to include test data.

9.3 Records, Files and Documents

All physical records, files, documents and work papers, provided and/or generated by the government and/or generated for the government in performance of this PWS, maintained by the contractor which are to be transferred or released to the government or successor contractor, shall become and remain government property and shall be maintained and disposed of IAW AFMAN 33-363, Management of Records; AFI 33-364, Records Disposition – Procedures and Responsibilities; the Federal Acquisition

11 | P a g e

Regulation, and/or the Defense Federal Acquisition Regulation Supplement, as applicable. Nothing in this section alters the rights of the government or the contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS (including all clauses that are or to shall be included or incorporated by reference into that contract).

10. Timelines Meet all project deadlines as concurred with the COR in the schedule, with contingency plans for delays.

11. Communication Maintain clear and consistent communication with U.S. Army COR and project leads, providing regular updates, and promptly addressing any issues.

12. References The contractor shall adhere to all relevant standards and guidelines, including but not limited to:

REFERENCE DESCRIPTION / TITLE

FISMA Federal Information System Modernization Act (FISMA) (2014) FIPS 199 Federal Information Processing Standards (FIPS) Publication 199 – Standards for Security Categorization of Federal Information and Information Systems FIPS 200 Minimum Security Requirements for Federal Information and Information

Systems NIST SP 800-30 Rev

National Institute of Standards and Technology (NIST) Guide for Conducting Risk Assessments

NIST SP 800-35 Guide to Information Technology Security Services NIST SP 800-37 Rev

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

NIST SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View

NIST SP 800-53 Rev

Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-53A

Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

NIST SP 800-61 Rev

Computer Security Incident Handling Guide

NIST SP 800-115 Technical Guide to Information Security Testing and Assessment NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems NIST SP 800-150 Guide to Cyber Threat Information Sharing

NIST SP 800-160

Vol. 1 Rev. 1

Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

NIST SP 800-171

Rev 1

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information P.L. 93-579 Public Law 93-579 Privacy Act, December 1974 (Privacy Act) 40 U.S.C. 11331 Responsibilities for Federal Information Systems Standards OMB M-19-03 Office of Management and Budget (OMB) Memorandum 19-03, Strengthening the

12 | P a g e

REFERENCE DESCRIPTION / TITLE

Cybersecurity of Federal Agencies by Enhancing the High-Value Asset Program

DoDI 8520.04 Access Management for DoD Information System

13 | P a g e

Contract Data Requirements List (CDRLs) to be posted here in future version.