RFP for Palo Alto Border Firewalls

RFP for Palo Alto Border Firewalls

1

REQUEST FOR PROPOSAL Palo Alto Border Firewalls

Toppenish Admin South (TAS/DC) Datacenter & Yakima Disaster Recovery Site (DR) Project No. IS 2021-5179

GENERAL INFORMATION Yakima Valley Farm Workers Clinic (YVFWC) is requesting proposals for a Palo Alto border firewall solution to replace the current Cisco ASA firewalls at YVFWC Disaster Recovery Data Center located at 1236 S 18th St. Yakima, WA 98901 & at YVFWC Data Center (DC) located at Toppenish Administration South (TAS), 603 W. 4th Ave, Toppenish, WA 98948. Quotes can be mailed, couriered, emailed or hand delivered to:

Yakima Valley Farm Workers Clinic Attn: Jeremy Staab 603 West Fourth Ave. Toppenish, WA 98948 [email protected]

Proposals must be received no later than 4:00pm Pacific, July 7th, 2021. Late proposals will not be accepted. PROJECT DESCRIPTION, BUDGET, AND SCHEDULE YVFWC is in need of a Palo Alto Networks (PAN) border firewall (FW) solution for DC & DR sites to integrate with current DCFW PAN & PAN Panorama centralized FW solutions and conforming to the list of requirements contained herein. No budget has been established for the project and YVFWC reserves the right to not select any proposal due to budget or other constraints. The selected vendor must be prepared to deploy, install, and configure the system so that it is 100% functional by October 31st, 2021. Failure to do so may result in negation of the purchase and a full refund of all expenses. PROPOSAL REQUIREMENTS: please submit the following information 1) Vendor Contact Information

a) Name of vendor: b) Business address: c) Vendor Contact Person for YVFWC: d) Telephone: e) Email

2) Brief description of the vendor. This section should provide YVFWC with information regarding the vendor’s expertise and experience in providing large amounts of equipment smoothly and on-time.

3) Vendor’s Personnel and Qualifications. This section should identify the individuals who will be participating in the YVFWC purchase process including installation, support, and maintenance, including the experience of each individual. Certification and/or proof of being an authorized vendor partner is also required by value added resellers and third parties.

4) References. This section should provide YVFWC with three references for work the vendor has performed in the past year delivering product with similar size and scope of this RFP.


2

SCOPE OF SERVICES The vendor will provide a 4x: Palo Alto 5220 firewall solution (2x: High-Availability (HA) pairs active/passive) including all necessary equipment, accessories, full onsite installation and configuration, and a 5-year maintenance and support contract to YVFWC with installation completed no later than October 31st, 2021. This solution shall also include: all applicable project management, design review workshop, project initiation & kickoff meetings, staging & configuration of equipment, assessment of current environment and current firewall dependencies, migration of all current firewall rules, objects, object-groups, client-VPNs, site-to-site VPNs, security contexts, zones, routing features including BGP relationships, ISE authentication & integration, DUO MFA authentication & integration for GlobalProect & FW administration. The deployment shall also include integration with currently deployed Palo Alto Panorama. This includes migration from the firewalls to Panorama all objects, object-groups, access-lists, contexts, SNMP monitoring, logging, DoS profiles, certificates, NAT, zones, interfaces, security inspection services, and any other applicable features to support template-based, and centralized firewall management. This migration shall include changing of access-lists from stateful-inspection to application-based. The solution will also include build, deployment, & tuning of PAN subscription based services including: malware management (file-blocking, antivirus, Wildfire), Global-Protect client VPN for YVFWC & all vendors, Threat-Prevention services, DNS Security, PANDB URL filtering & migration of rule-sets from current Forcepoint proxy deployment, PAN Wildfire build/tuning, and any related support and subscription services. Any delays in delivery will result in possible cancellation of the order and award to another vendor. Proposals need to include all installation, certification, taxes, and shipping to our Yakima Disaster Recovery facility. Only new and genuine equipment provided by authorized partner sources will be considered. All expenses must be outlined in the proposal. Any costs required outside of those listed in the proposal provided to make the solution meet the listed constraints and/or requirements to YVFWC’s satisfaction will be borne by the vendor. Proposal must include annual renewal costs YVFWC should anticipate after the initial five year contract period. Proposal must include training PAN PCCET (Palo Alto Networks Certified Entry-level Technician) - 10 seat, on/site or virtual training. YVFWC pays invoices within 45 day after receipt of product. Purchase order/s will be provided to the selected vendor. All communication, documentation, and/or invoices must include appropriate purchase order number/s. Invoices not including the appropriate information may not be paid. SELECTION CRITERIA Based on the proposal’s ability to meet the requirements/constraints, the vendor’s reputation and competency, and other factors contained herein, one proposal will be chosen. YVFWC reserves the right, however, to choose to not make a purchase if the proposals do not meet our needs or we are unable to secure the funding required. The selected vendor, if one is chosen, will be notified by July 28th, 2021. OTHER INFORMATION A. Costs for product must include all necessary fees, shipping, taxes, etc. No other costs will be considered. B. Cost of preparation of proposals will be borne by the applicant and the proposals shall become the property of Yakima Valley Farm Workers Clinic, whether accepted or rejected.


3

C. This request for proposals does not constitute an offer of employment nor to contract for services. Yakima Valley Farm Workers reserves the right to reject any and all proposals and to waive any informality, technical defect or clerical errors in any proposal. D. All proposals shall remain valid for sixty (60) Calendar Days following the last day to receive proposals. E. Proposals shall be signed by an authorized individual or officer of the vendor submitting the proposal. F. Proposals may be withdrawn by the vendor submitting the proposal at any time prior to the closing date and time for receipt of proposals. G. Federal funding requirements for this project may require the selected vendor to allow access to YVFWC, the HHS awarding agency, the U.S. Comptroller General, or any of their duly authorized representatives, to any books, documents, papers and records which are directly pertinent to a specific program for the purpose of making audits, examinations, excerpts and transcriptions. H. Per the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109–282), as amended by section 6202 of Public Law 110–252, selected vendor must provide required information to be posted at www.hrsa.gov/grants/ffata.html. I. Recipients and sub-recipients of Federal funds are subject to the structures of the Medicare and Medicaid anti-kickback statute (42 U.S.C. 1320a - 7b(b) and should be cognizant of the risk of criminal and administrative liability under this statute, specifically under 42 U.S.C. 1320 7b(b) Illegal remunerations which states, in part, that whoever knowingly and willfully:

(A) Solicits or receives (or offers or pays) any remuneration (including kickback, bribe, or rebate) directly or indirectly, overtly or covertly, in cash or in kind, in return for referring (or to induce such person to refer) an individual to a person for the furnishing or arranging for the furnishing of any item or service, OR

(B) In return for purchasing, leasing, ordering, or recommending purchasing, leasing, or ordering, or to purchase, lease, or order, any goods, facility, services, or item...For which payment may be made in whole or in part under subchapter XIII of this chapter or a State health care program, shall be guilty of a felony and upon conviction thereof, shall be fined not more than $25,000 or imprisoned for not more than five years, or both.

J. This award is subject to the requirements of Section 106 (g) of the Trafficking Victims Protection Act of 2000, as amended (22 U.S.C. 7104). For the full text of the award term, go to http://www.hrsa.gov/grants/trafficking.htm.

K. Vendors identified on the U.S.General Services Administration Lists of Parties Excluded from Federal Procurement or Non-Procurement Programs (debarred list) shall not be allowed to contract for services on this project. Please provide a quote for the PAN Border Firewall Solution (See Below). Remember to include installation, certification, testing, training, all associated parts, shipping and taxes.

http://www.hrsa.gov/grants/ffata.html


4

SOLUTION REQUIRMENTS AND CONSTRAINTS:

• Procurement, Delivery, Configuration, Installation, & Cutover of: o 4x: PAN-PA-5220-AC Palo Alto Networks PA-5220 with redundant AC power supplies

• 2x: (2) PAN 5220s Active/Standby HA pairs at each location (DC & DR) o 4x: PAN-PA-5200-RACK4 Palo Alto Networks PA-5200 4 post rack mount kit. o 4x: DNS Security subscription 3 year prepaid for device in an HA pair, PA-5220 o 4x: Threat-Prevention subscription 3 year prepaid for device in an HA pair, PA-5220 o 4x: GlobalProtect subscription 3 year prepaid for device in an HA pair, PA-5220

250x GlobalProtect User Licensing – If Applicable o 4x: PANDB URL Filtering subscription 3 year prepaid for device in an HA pair, PA-5220 o 4x: WildFire subscription 3 year prepaid for device in an HA pair, PA-5220 o 4x: PAN-SVC-PREM-5220-3YR Premium support 3-year prepaid, PA-5220

o DC: Firewall Setup & Migration Including: Analysis of current firewalls, IDS/IPS, architecture, & configurations. Coordination, cutover, scheduling, & after-hours changes to support migration from Cisco ASA

5545 HA pair. Routed Mode Single Context Deploy Migration Tools: To assist with migration of rules Base security policy with external dynamic lists

• Blocking of predefined Palo Alto high-risk dynamic IPs • Blocking of bogon IP’s from external dynamic IP list

≤ 8x: Server Profiles: SNMP, Syslog, Email, Netflow, RADIUS, LDAP ≤ 4x: Logging Destinations: up to 2x custom reporting ≤ 85x: NAT Rules HA Pairing – Active/Passive with link monitoring. ≤ 50x: URL filtering rules migrated from Forcepoint User-ID Configuration

• ≤ 2x: User-ID Sources • ≤ 2x: Windows or Integrated Agent • Group-Mapping

≤ 2x: Threat profiles for antivirus, anti-spyware, file blocking, Wildfire and vulnerability protection in alert mode

Deploy WildFire Deploy Threat Prevention ≤ 2x: Panorama Integration for PAN 5220s ≤ 8x: physical interfaces/VLANs and security zones ≤ 12x: Logical sub-interfaces/VLANs and security zones ≤ 12x: Site-to-Site VPNs ≤ Client-Based VPNs (AnyConnect to GlobalProtect)

• ≤ 8x: Connection Profiles


5

• ≤ 45x: Group Policies & VPN Filters/ACLs • DUO MFA Integration – YVFWC Licensed

≤ 72x Access Lists & Related Elements • access-list inside_access_in; 6806 elements; name hash: 0x433a1af1 • access-list outside_access_in; 1 elements; name hash: 0x6892a938 • access-list split-exclude-VPN_POC; 129 elements; name hash: 0x5516ec4e • access-list Azure; 148 elements; name hash: 0x3094a69f • access-list crypto_AzureServices_VNET; 37 elements; name hash: 0xe0758327 • access-list Guest-WiFi-Outside_access_in; 1 elements; name hash: 0x8665b52d • access-list BusGuest_WiFi_access_in; 10 elements; name hash: 0x663b6392 • access-list WEBVPN_in; 3 elements; name hash: 0x45b1b19e • access-list crypto_Meditech; 12 elements; name hash: 0x5990f6e8 • access-list crypto_RL_Solutions; 4 elements; name hash: 0xb539069f • access-list Guest_WiFi_access_in; 13 elements; name hash: 0x1298fb8 • access-list crypto_ProvideEnterprise; 1 elements; name hash: 0xd6a16f5c • access-list split-exclude-SSL_VPN; 129 elements; name hash: 0x38780c56 • access-list WS_REDIRECT; 155 elements; name hash: 0xb9cdcf58 • access-list Seattle_Childrens_Hospital; 4 elements; name hash: 0x126457fb • access-list ScriptPro-YVFWC; 2 elements; name hash: 0xa09f5601 • access-list POLICER-Guest_Network-inside-ingress; 43 elements; name hash:

0xdd67f53e • access-list global_mpc_2; 1 elements; name hash: 0xeb994e93 • access-list Presidio_ACL; 25 elements; name hash: 0x9305be7d • access-list crypto_Seattle_Childrens_Hospital; 2 elements; name hash: 0x1e73d9e • access-list cap; 4 elements; name hash: 0xf034180f • access-list PROXY_WS; 1 elements; name hash: 0x97383acb • access-list crypto_ScriptPro; 1 elements; name hash: 0x1bf4bf36 • access-list Camtek; 5 elements; name hash: 0xb51bcf8a • access-list outside1_access_in; 438 elements; name hash: 0x467dc754 • access-list crypto_Memorial_Hospital; 4 elements; name hash: 0x6f3ac3d2 • access-list crypto_McKesson_HPP; 3 elements; name hash: 0x7339b74b • access-list SPHControls; 5 elements; name hash: 0xb584876c • access-list crypto_Dolphin; 1 elements; name hash: 0x18ef11cb • access-list TotalEnergyManagement; 6 elements; name hash: 0xbd94468d • access-list Epicor; 16 elements; name hash: 0x2d933c69 • access-list EnterpriseRX; 2 elements; name hash: 0xef4383d1 • access-list AIS; 4 elements; name hash: 0x34d9ec36 • access-list GuestTransit_access_in; 27 elements; name hash: 0x2aca8fe9 • access-list RelayHealth_access_in; 17 elements; name hash: 0x532abd89 • access-list RelayHealth; 5 elements; name hash: 0xb4318279 • access-list crypto_Epic; 5 elements; name hash: 0x324cf98d • access-list Epic; 145 elements; name hash: 0x5499731a • access-list Corepoint_Health; 5 elements; name hash: 0x81a7c603 • access-list OnePacs_ACL; 2 elements; name hash: 0x19c3e836 • access-list Health_eFormatics; 4 elements; name hash: 0xa263bbe3


6

• access-list MSFW; 12 elements; name hash: 0x91f30edc • access-list RelayHealth_RTE; 5 elements; name hash: 0x8a5a87d3 • access-list Climatech; 2 elements; name hash: 0x90e51498 • access-list StructuredCommunications; 6 elements; name hash: 0xb1d8fc45 • access-list LabCorpVPNTunnel; 36 elements; name hash: 0x1dd77f3a • access-list vDMZ_access_in; 958 elements; name hash: 0x9d83d475 • access-list vDMZ_PBR_in; 32 elements; name hash: 0xb518c21c • access-list crypto_PDMP-Appriss; 6 elements; name hash: 0xd0b3a831 • access-list NCAC-VPN; 1 elements; name hash: 0x100ccf4a • access-list BrickHouse-VPN; 1 elements; name hash: 0x5166041d • access-list Cerium_Networks; 32 elements; name hash: 0x564f45ce • access-list Change_Healthcare_RTE; 4 elements; name hash: 0x9aa2341f • access-list crypto_ChangeHealthcare_RTEtoChangeHealthCareRTE; 1 elements; name

hash: 0xc00164e8 • access-list BusGuest_WiFi_PBR; 2 elements; name hash: 0x3117c66f • access-list Arcadia-VPN; 8 elements; name hash: 0xebea8965 • access-list crypto_Prosser_Hospital; 2 elements; name hash: 0xe56e38a6 • access-list HONEY_DMZ_IN; 37 elements; name hash: 0x4d6c9735 • access-list Vendor_DMZ_IN; 4585 elements; name hash: 0x580096a0 • access-list edneticsvpn_VPNFilter; 1002 elements; name hash: 0xb8511f70 • access-list edneticsvpn_SplitTun; 3 elements; name hash: 0xa19f884a • access-list VOIP_vDMZ_access_in; 1 elements; name hash: 0xedf830d5 • access-list Apriss-PDMP-VPN; 8 elements; name hash: 0x72cfb81c • access-list outside1_cryptomap_1; 6 elements; name hash: 0x32c0094c • access-list AnyConnect_Client_Local_Print; 8 elements; name hash: 0xe76ce9d1 • access-list DMZ_EpicH_access_in; 12442 elements; name hash: 0xa7f25770 • access-list DMZ_EpicH_access_out; 18971 elements; name hash: 0x1d61bee0 • access-list syslogcap; 2 elements; name hash: 0xd8ca5301 • access-list sfr-map; 3 elements; name hash: 0x3976a26b • access-list POLICER-Guest_Network-inside-egress; 43 elements; name hash:

0x9d1cca40 • access-list POLICER-BusinessGuest_Network-inside-ingress; 42 elements; name hash:

0x72ac3772 • access-list POLICER-BusinessGuest_Network-inside-egress; 42 elements; name hash:

0xe3e70d4 o Validation of Configuration & Policy Review o Perform Cutover

Install (4) PAN 5220s during (2) 6 Hour (Weekend/Sunday) Change Window(s) Provide up to 8 Hours of Day One Support Following Final Cutover Verify URL Filtering is operational Verify Connectivity to All Related Entities – Direct Link & STS VPN Verify All Related Services are Functional to Support Business

o Threat Review Security profiles integrated into up to (10) security rules in blocking mode. This may take

place up to 30 days after deployment. o Provide Final Documentation


7

Full Network Diagrams Final Best-Practices Report

o Current Network Diagram:

o DR: Firewall Setup & Migration Including: Full mirror-imaging of DR firewall to DC through Panorama As much dynamic failover support/integration as possible from DC to DR Analysis of current firewalls, IDS/IPS, architecture, & configurations. Coordination, cutover, scheduling, & after-hours changes to support migration from single Cisco

ASA 5525 Routed Mode Single Context Deploy Migration Tools: To assist with migration of rules Base security policy with external dynamic lists

• Blocking of predefined Palo Alto high-risk dynamic IPs


8

• Blocking of bogon IP’s from external dynamic IP list ≤ 61x: NAT Rules HA Pairing – Active/Passive with link monitoring. ≤ 50x: URL filtering rules migrated from Forcepoint User-ID Configuration

• ≤ 2x: User-ID Sources • ≤ 2x: Windows or Integrated Agent • Group-Mapping

≤ 2x: Threat profiles for antivirus, anti-spyware, file blocking, Wildfire and vulnerability protection in alert mode

Deploy WildFire Deploy Threat Prevention ≤ 8x: Server Profiles: SNMP, Syslog, Email, Netflow, RADIUS, LDAP ≤ 4x: Logging Destinations: up to 2x custom reporting HA Pairing – Active/Passive with link monitoring. ≤ 2x: Threat profiles for antivirus, anti-spyware, file blocking, Wildfire and vulnerability

protection in alert mode ≤ 8x: physical interfaces/VLANs and security zones ≤ 2x: Logical sub-interfaces/VLANs and security zones ≤ 12x: Site-to-Site VPNs ≤ Client-Based VPNs (AnyConnect to GlobalProtect)

• ≤ 8x: Connection Profiles • ≤ 45x: Group Policies & VPN Filters/ACLs • DUO MFA Integration – YVFWC Licensed

≤ 28x Access Lists & Related Elements • access-list Inside_access_in; 1506 elements; name hash: 0xa231c4d3 • access-list AnyConnect_Access_in; 1 elements; name hash: 0x19e2d52f • access-list outside_access_in; 306 elements; name hash: 0x6892a938 • access-list split-exclude-SSL_VPN; 129 elements; name hash: 0x38780c56 • access-list edneticsvpn_SplitTun; 3 elements; name hash: 0xa19f884a • access-list edneticsvpn_VPNFilter; 930 elements; name hash: 0xb8511f70 • access-list Arcadia-VPN; 8 elements; name hash: 0xebea8965 • access-list SPHControls; 2 elements; name hash: 0xb584876c • access-list WEBVPN_in; 3 elements; name hash: 0x45b1b19e • access-list Epicor; 15 elements; name hash: 0x2d933c69 • access-list Cerium_Networks; 32 elements; name hash: 0x564f45ce • access-list split-exclude-VPN_POC; 129 elements; name hash: 0x5516ec4e • access-list StructuredCommunications; 6 elements; name hash: 0xb1d8fc45 • access-list TotalEnergyManagement; 3 elements; name hash: 0xbd94468d • access-list EnterpriseRX; 2 elements; name hash: 0xef4383d1 • access-list Corepoint_Health; 5 elements; name hash: 0x81a7c603 • access-list Health_eFormatics; 3 elements; name hash: 0xa263bbe3 • access-list MSFW; 12 elements; name hash: 0x91f30edc • access-list NCAC-VPN; 1 elements; name hash: 0x100ccf4a


9

• access-list DMZ_EpicH_access_in; 12425 elements; name hash: 0xa7f25770 • access-list Climatech; 4 elements; name hash: 0x90e51498 • access-list AIS; 4 elements; name hash: 0x34d9ec36 • access-list Camtek; 1 elements; name hash: 0xb51bcf8a • access-list DMZ_EpicH_access_out; 18958 elements; name hash: 0x1d61bee0 • access-list POLICER-Guest_Network-inside-ingress; 42 elements; name hash:

0xdd67 f53e • access-list POLICER-Guest_Network-inside-egress; 42 elements; name hash:

0x9d1cca40 • access-list POLICER-BusinessGuest_Network-inside-ingress; 42 elements; name

hash: 0x72ac3772 • access-list POLICER-BusinessGuest_Network-inside-egress; 42 elements; name

hash: 0xe3e70d49 o Validation of Configuration & Policy Review o Perform Cutover

Install (4) PAN 5220s during (2) 6 Hour (Weekend/Sunday) Change Window(s) Provide up to 8 Hours of Day One Support Following Final Cutover Verify URL Filtering is operational Verify Connectivity to All Related Entities – Direct Link & STS VPN Verify All Related Services are Functional to Support Business

o Threat Review Security profiles integrated into up to (10) security rules in blocking mode. This may take

place up to 30 days after deployment. o Provide Final Documentation

Full Network Diagrams Final Best-Practices Report

o Current Network Diagram


10

• Dual Power Supplies for All PAN 5220 Units • All associated Interconnect cabling and SFPs • Complete Racking/cabling of the solution • Initial configuration. • Training: Administration, 10 seats, instructor-led. • 3 years of 24/7 premium (4HR response) software and hardware support.

Proposal for solutions which do not meet all the requirements/constraints may be considered if sufficient information is provided by the vendor on an alternate method of achieving the same outcome which YVFWC considers of equal value. End of Document


11

RFP for Palo Alto Border Firewalls

Documents