SOO.docx

STATEMENT OF OBJECTIVES (SOO) IN SUPPORT OF THE Global Enterprise Fabric (GEF)

3 September 2015

1.0 INTRODUCTION

1.1 PURPOSE - The Global Enterprise Fabric is the Network Enterprise Technology Command (NETCOM) description for a cloud enterprise environment that will provide the US Army a complete suite of computing enterprise services under three broad areas: Infrastructure as a Service (IaaS), Network Services, and Computer Network Defense (CND). NETCOM will implement these requirements to meet the Department of Defense goals of a secure network and a responsive enterprise as envisioned by the Joint Information Environment (JIE).The paragraphs below provides description of the three Global Fabric Nodes.

The Dedicated Fabric Management Node (DFMN) - The DFMN is the most upper part of the fabric hierarchy from which it provides the full roll up and visibility of the LWN enterprise. Its concept is to "centrally managed, while de-centrally execute" cyber operations from the "command view" the DFMN will provide.

The Regional Fabric Node (RFN) - The RFN is the "middle layer" of the GEF and acts as the IFN "roll up" of the LWN Enterprise "health status" and enterprise performance. The RFN's are operated and maintained (O&M) by the RCC's in the theater and serve as a vital part of the command, control and daily cyber operations of the fabric. Since the number of RFN's is determined by the number of sites in a theater, smaller theaters may not feature RFNs at all, having only IFNs and DMFNs for the fabric in that theater. Currently NETCOM only envisions the RFNs for CONUS NIPRNET.

The Installation Fabric Node (IFN) - The IFN represents the lowest in the hierarchy of the GEF, but is the most common node in the fabric. It represents the installation with all of the network enterprise center (NEC) services for that site. All local applications hosted on physical servers will be placed as virtual workloads on the IFN. The NEC's will assist the RCC in operations but will transition from the maintainers of the hardware and software environment to "consumers" of virtualized local services at their site.

The Army envisions each DFMN, RFN and IFN as the same or similar types of converged hardware systems represented by their compute, storage and network components. The only difference is the role each will serve in the GEF. While this document discusses the complete Global Fabric concept, this initial purchase only covers DFMN & RFN.

This acquisition does not include the Installation Fabric Nodes (IFN) for site level Network Enterprise Centers (NECs) at US Army C/P/S. That will be a separate procurement action at a later date and will be openly and fairly competed. The intent is for the Global Enterprise Fabric to provide virtualization hosting environment that will host NETOPS enterprise tools and directory services workloads and other enterprise capabilities servicing the NIPRNET, SIPRNET and the Global Mission Network (GMN). The GMN is a separate network that the Army built to extend strategic SIPRNET to the tactical formations. The intent is to merge the GMN infrastructure into the GEF using the same technical concepts of cloud, virtualization and hosted services.

1.2 BACKGROUND -- Information technology (IT), data, computer and enterprise networks across the Department of Defense (DoD) have been steadily shifting towards a cloud computing architecture, and today, the term cloud computing is more synonymous with the term “virtualization.”

Each year, the armed forces are investing in a scalable computing services concept that is independent of hardware changes made to their underlying infrastructure. This concept is notionally called a “converged hardware architecture.” The focus of this effort is to reduce IT costs, provide consistent and timely services to users, improve management of resources from a centralized design (i.e. a converged architecture), and establish responsive security measures uniform to the enterprise. With virtualization, physical resources such as servers, clients, data storage, and networking are conserved, while delivering the following attributes:

0. Elasticity and Scalability – Adding new resources and services is flexible and customizable to each organization’s mission need. Operations can better handle surging demands and peak usage through the tailoring of resources from computing power, virtual machines, storage, and bandwidth utilization.

Pooled Resources – Computing, storage, and network resources are grouped in the same infrastructure environment to allow for reallocation of those resources by demand.

Customer Self-Service – Virtualization provisioning basic resources for a customer such as services, virtual machines, mailboxes, and user accounts without needing IT intervention.

Usage Monitoring and Auditing – Capturing metrics on resource consumption, reporting on installed services, and recording data for comparative baseline analysis will aid in the efficient management of the enterprise.

This trend continually evolves as the DoD seeks to leverage the armed services in adapting cloud computing strategies that will enable the department to achieve the goals of the Joint Information Environment (JIE).

1.3 Envisioning the US Army GEF:

NETCOM envisions the GEF computing enterprise services in three broad areas: (i) Infrastructure as a Service, (ii) Network Services, and (iii) Computer Network Defense. Each computing enterprise service, having a broad area, is supported by specific services or “capabilities”. These services are evaluated in status and “rolls up” to give an overall status of the area in which they are organized. By establishing these three broad areas, as depicted in figure 1 below, NETCOM believes it will enable the ability to centrally manage and view the overall “health” status of its network.

Figure 1. Network visibility vision on the GEF NETCOM envisions that the GEF will allow for centralized management and monitoring as the LWN enterprise matures into a cloud computing environment.

2.0 SPECIFIC OBJECTIVES

2.1 SCOPE - The scope of the objectives laid out in this document applies to the Non-secure Internet Protocol Router Network (NIPRNet) and the Secret Internet Protocol Router Network (SIPRNet) environment for all US Army units and organizations, including Army Global Mission Network (GMN), National Guard and Army Reserves. The Army estimates 3 CONUS and 8 OCONUS DFMN sites (NIPRNet and SIPRNet) and 11 CONUS RFN sites (NIPRNet Only). Final architecture, configurations and designs are to be informed by industry.

2.2 PROGRAM MANAGEMENT - The Governments primary management objectives are three-fold. First, allow the contractor maximum flexibility to utilize strategies that leverage industry best practices, and as appropriate, Commercial Off-The-Shelf (COTS) Service products and/or available Government Furnished Equipment (GFE), technologies, and enterprise services. This is to support the accomplishment of the Army’s three enterprise IT goals: to improve the delivery of IT enterprise services; increase the security of its information and networks; and reduce the total cost of ownership of its IT Enterprise. Second, ensure that the contractor applies sound system engineering principles to manage program cost, schedule, performance, risks, warranties, vendors, and data required to deliver an effective and affordable service that meets the stated performance requirements. Lastly, exercise program insight versus oversight by ensuring that the contractor provides the Government with clear and continuous insight into program schedule, technical performance, and risk.

2.2.1 Integrated Product Teams (IPTs) - The contractor shall participate in IPTs that may include several Government agencies and contractors. Working level IPTs will be established as necessary.

2.3 Converged Architecture Objectives:

2.3.1 The Enterprise Fabric features a convergence of the US Army architecture in three broad areas:

Hardware converged architecture, where computing and network hardware are integrated, shared resources for the hosted infrastructure services (shown in Fig 1);

Virtual converged architecture, where virtual machines (VM) host each infrastructure service stored in a Storage Area Network (SAN)’s array;

Army converged services, where enterprise management systems are used for maintaining the environment.

2.3.2 This approach is to package hardware architecture in three configurable sizes for the GEF: small (IFN), medium (RFN or IFN), and large (DFMN), which are intended for deployment across US Army posts, camps, and stations within the enterprise. The GEF will consolidate the architecture at each site with the following objectives in mind.

a. Build Operate, Maintain, Defend, and “See the Core Operating Environment (COE) End-to-End”

b. Global unfettered access to information

c. Global standards for Army networks, workstations, servers, applications, and data

d. Secure/reliable service, anywhere, anytime

e. Synchronization with the DoD’s and Army JRSS solution

f. Centralized management, monitoring, and reporting

2.3.3 Converged Architecture Goals:

2.3.3.1 Listed as follows are the envisioned goals:

a. Support for multiple diverse workloads

b. Full end-to-end high-availability

c. 100% virtualization

d. 100% automation

e. Self Service Portal for Administration and Guests

f. Sub-system scale-out for the following:

i. Compute

ii. Storage

iii. Networking

g. Reduction of cost to serve

h. Removal of middleware

i. Hardware platform independent

j. Just-in-time hardware provisioning

2.3.4 US Army GEF Program Benefits:

2.3.4.1 Listed as follows are the envisioned benefits the GEF will offer:

a. Faster Deployment

i. End-to-end architectural and deployment guidance

ii. Streamlined infrastructure planning due to predefined capacity

iii. Enhanced functionality and automation through deep knowledge of infrastructure

iv. Integrated management for VM and infrastructure deployment

b. Reduced Risk

i. Tested end-to-end interoperability for computing, storage, and networking

ii. Predefined, out-of-box solutions based on a common cloud architecture

iii. High degree of service availability through automated load balancing

c. Lower Cost-of-Ownership

i. Near-zero downtime with exceptional fault tolerance, providing high availability

ii. Dynamic Pooling that can enhance the use of virtualization resources by combining Hypervisor and supported storage and network devices

iii. Use of low-cost switches that consume less power and deliver high throughput for large bandwidth requirements

2.4 Operational Requirements:

These principles, defined below, help power the GEF elasticity and also distinguish it from a traditional local area network (LAN) in which key pieces are virtualized. While the virtualized LAN delivers some of the benefits of virtualization, such as increased utilization, an enterprise fabric model includes automation and management capabilities that can mean revolutionary changes in how the Army delivers enterprise IT services and how users consume them.

2.4.1 Resource Pooling

The GEF depends on the flexible pooling of computing (processor and memory), storage, networking, and software resources. This pooling helps deliver greater utilization and efficiency and is powered by virtualization, which abstracts the platform from the physical infrastructure. Multiple consumers—such as multiple customers or multiple organizational units—can share pooled resources, resulting in higher resource utilization and efficiency for both planners and users.

2.4.2 Elasticity and Perception of Infinite Capacity

From the user’s perspective, GEF services should appear to have infinite capacity. End users can consume as much or as little of the service as needed, just as they consume electricity. This perception is possible because, in contrast to a reactive approach that leads to inefficient resource use, the private cloud facilitates proactive capacity planning so that the infrastructure can satisfy peak requests on demand. This principle helps achieve greater balance between the cost of unused capacity and the desire for agility.

2.4.3 Perception of Continuous Availability

From the user’s perspective, GEF services should always be available when needed. The consumer should never experience an interruption in IT services, even if failures occur within the cloud infrastructure. To achieve this continuous availability, the private cloud architecture delivers a highly automated environment in which infrastructure redundancies, such as failover clustering, are complemented by intelligent automation and management capabilities.

2.4.4 Predictability

Both Regional Cyber Centers (RCCs) and users require predictability from a private cloud infrastructure. For consumers, GEF services should be consistent—they should have the same quality and functionality each time they are used.

To achieve this predictability, the virtualized environment standardizes functions across physical servers, network devices, and storage. This standardization helps to assure consistent treatment of hosted workloads, even during fluctuating demand. With virtualization, users can also benefit from predictability on the service Planner’s side of the console through its management and automation tools, which standardize service offerings and processes. This predictability is a fundamental requirement if planners are to deliver on the potential of a virtualized environment.

2.4.5 Service Planner’s Approach to IT

Historically, when units needed new or expanded IT services, they purchased the necessary components and then built an infrastructure specific to the service requirements. The result was often disappointing in terms of agility and also meant delays, duplicate infrastructure, increased costs, and poor utilization.

With virtualization, units can instead make use of IT as a set of services they consume rather than as a collection of hardware they deploy. The virtualized environment helps planners provide infrastructure as a service (IaaS) so that users can consume what they need when they need it, avoiding an underutilized, duplicating infrastructure. In addition, the shared resource model means planners can take advantage of economies of scale and greater agility in providing additional services or expanding existing ones.

2.4.6 Multi-Tenancy

The GEF can be subdivided for each mission partner and provision logically isolated resources to different customers. Users can also benefit from the multitenant capabilities of the GEF infrastructure because resources can be provisioned for distinct organizational units within the Army LWN, which facilitates usage metering and chargeback.

2.4.7 Security and Identity

The private cloud delivers strong security for cloud computing through three pillars:

0. Protected infrastructure Application access Network access The GEF uses security and identity technologies to protect both physical and virtual hosts, information, and applications in the data center. These technologies take advantage of the least-privileged user account access principle—an approach that ensures that users always log on with limited user accounts until they are granted additional privileges.

The GEF will secure application access through integration with the DoD’s and Army Identity and Access Management (IdAM) system. IdAM is an enterprise capability that would be hosted as a workload on the fabric. This identity foundation ensures that users have secure access to IT resources within the enterprise by using numerous devices.

Network access in the private cloud is secured at the perimeter through the JRSS and through Host-Based Security System (HBSS, a DoD mandated capability). Internet Protocol Security (IPsec) also enables logical isolation of server and domain resources so that administrators can limit access to authenticated and authorized computers. Alternative solutions will be considered if proposed.

2.5 SUMMARY - The GEF is conceived primarily as a hosting platform to virtualize the US Army NETOPS Enterprise capabilities at various US Army sites globally. The minimum NETOPS capabilities envisioned and which are currently used include Enterprise Directory Services (DS) and Authentication, Host-Based Security Systems (HBSS), ITSM/Remedy, Spectrum, Microsoft System Center, REM/Retina (Assured Compliance Assessment Solution) and Security Incident Management System (SIMS). These and other capabilities to include regional and local applications would be hosted as “workloads” or virtualized servers on a converged architecture solution. These capabilities will integrate and function within the NIPRNET, SIPRNET and GMN environments. For detailed requirements of any of the objectives stated above, see “Global Enterprise Fabric (GEF) Functional Requirements Document (FRD)” dated 23 July 2015.

image1.png