CRETC, BCESD, CRUHSD Unified Threat Manager The Bullhead City Elementary School District (BCESD) and Colorado River Union High School District

Transcription

1 CRETC, BCESD, CRUHSD Unified Threat Manager The Bullhead City Elementary School District (BCESD) and Colorado River Union High School District (CRUHSD) are seeking proposals for a unified threat management system (UTM). This document is to provide vendors with guidelines concerning the network at BCESD and CRUHSD, and specify our key success factors for this project. BCESD and CRUHSD have formed the Colorado River Educational Technology Consortium (CRETC). While the project focuses only on BCESD and CRUHSD, other schools/districts may join the consortium in the future. On July 1, 2014, CRETC will purchase and provide 250Mbps of Internet bandwidth that will be shared between BCESD and CRUHSD. The first year of this contract is upgradeable to 500Mbps. However, the local service provider has committed to providing up 1000Mbps if required in the future. BCESD consists of four elementary schools and two middle schools, serving students from pre-school through eighth grade within Bullhead City. There are approximately 3200 students, 350 staff members, and 1500 devices at BCESD. However, BCESD is committed to provide more devices as needed. Currently BCESD is deploying tablets, laptops, and desktop computers. In the future, BCESD plans to implement Chrome books as well. CRUHSD consist of two high schools serving grades nine through twelve, in the Bullhead City, Fort Mohave, Mohave Valley, and Topock areas. CRUHSD has approximately 2200 students, 250 staff, and 1400 devices. Like BCESD, CRUHSD is also deploying other technology devices. Infrastructure BCESD and CRUHSD each have independent Microsoft Windows Active Directory servers. Any proposed solution must have the ability to provide authentication to two separate Windows AD/LDAP servers. All WAN connections from BCESD schools, CRUHSD schools, and the CRUHSD district office will terminate at the BCESD data center. On July 1, 2014 all schools will connect to the BCESD data center with a minimum of 250 Mbps fiber optic link. Please see attached map. Both BCESD and CRUHSD have VMWare virtual servers, and we will consider using virtual appliances if it is in our best interest. Existing Networks BCESD s network is primarily Enterasys. At the access level, Enterasys C2 and C3 switches are used. These are 10/100/1000Mbps switches with POE. However, in many classrooms, a smaller 12 port switch provides connectivity for classroom devices. At each school an Enterasys N5 or N7 blade switch provides aggregation and routing to the district office. Desktop security is generally provided by Microsoft anti-virus and firewall. The district firewall is a Watchguard. At the schools, an older Enterasys

2 wireless controller provides management for wireless access points. At the district office, BCESD has Ubiquity UniFi access points. CRUHSD s network is primarily Cisco. At the access level there are primarily 10/100 non-poe switches, and a few PoE switches for IP phones and wireless. Each location has a central blade switch that will provide aggregation and routing to the BCESD district office. All wireless AP s are Rucks and controlled by the wireless controller at Mohave High School. Desktop security is currently Sophos, managed through the Sophos enterprise console. The current firewall is a Cisco ASA. Commonalities between the two districts include: share 250Mbps Internet connection (effective July 1, 2014), access switches are connected via 1Gbps fiber, Sophos web content filter. Additionally, both districts use Google Apps for and collaboration. Existing Computers BCESD and CRUHSD have many older and aging computers. Any client software remains a concern for computers that are already being asked to do more than they should. Over 50% of the computers at BCESD and CRUHSD are more than five years old, some are even 10 or more years old. Many of these computers have limited RAM, CPU, and storage resources. Current computers, servers, and devices include: Windows XP, Windows 7, Server 2003, Server 2008, Server 2012, Max OS X, ios (ipads, iphones, and ipod Touch), Android (Samsung Galaxy Tab and Samsung Phones), and Chrome books. BCESD and CRUHSD expects 100% compatibility with these devices and aging computers. Key Success Factors Unless otherwise noted all of these factors are required and proposals must cover each area. Application level firewall Required Internal reverse firewall/proxy for internal websites required Site to Site VPN Required o Standard based VPN must work with current service provider s VPN Client VPN Required o Standards based VPN o Must not require manufacturer client o Must be compatible with all of BCESD and CRUHSD s devices without third party client o L2TP, IPSec, SSL, etc. o Must support AD/LDAP authentication HTML VPN Required o Gives network support and administrators the ability to access internal resources via a web browser interface Web content filter Required

3 o CIPA Compliant must include user level reporting and monitoring o Guest authentication o Must fully support all of BCESD and CRUHSD s devices o Transparent authentication mechanism o Web-based authentication for outside devices o Must not require client proxy settings must deploy in such a way that all traffic goes through the filter. o YouTube for schools Support enabling YouTube for schools by user group and/or IP address o Must filter SSL traffic and web traffic on non-standard ports o Must filter ALL web traffic Bandwidth management Optional but will be considered in final determination o Ability to limit bandwidth by: Category (streaming media, social media, etc) User group (student, administrators, teacher, etc) Network (guest wireless, etc) o Overall bandwidth management by district BCESD and CRUHSD will share 250Mb Internet bandwidth The ability to segment bandwidth between the two district is beneficial As an example: 100Mb dedicated for BCESD 100Mb dedicated for CRUHSD 50Mb to be shared when needed Allow one to borrow unused bandwidth from the other when needed. Intrusion Prevention/Detection System (IPS/IDS) Optional but will be considered o Signature and anomaly based Application control Required for CRUHSD, optional for BCESD o Ability to detect programs and prevent blocked programs from running o Must detect on hash or signature, not just filename o Vendor must provide examples of configuration methods and how new programs are added. Client Security Required o Provide desktop security for Windows and MAC Windows XP Windows 7 Windows 8 All version MAC OS X o Client operating requirements and system resources are a concern

4 o Client software must be compatible with all desktop operating systems listed above Reporting Required o Provide detailed user and usage reports Guest access Required o Guest devices connected to guest vlans/networks must be redirected to a slash page where guest s will accept district TOS. Networking Required o At least three physical or virtual interfaces o Support for the following interfaces CRUHSD Assume at least 15 different networks BCESD Assume at least 25 different networks DMZ o Support for multiple networks and vlans Vendors are urged to provide information on other features beneficial to BCESD and CRUHSD. The optional features will be considered when evaluating the proposals. Please provide detailed, extended pricing when adding the options. The expectation is an end to end solution provided by a single vendor/manufacturer. All required hardware, software, licensing, etc is to be included. Proposals provided on a purchasing contract, such as AZ state contract, MESC, TCPN, or TIPS/TAPS is preferred. Please clearly note the purchasing contract on the price proposal. Proposals Please include documentation in your proposals that cover each of the success factors above. Additional, vendors can include any additional information that will help BCESD and CRUHSD make a decision. The price proposal should include four parts: Required hardware, software, labor, and training o Include all costs for the first year o If on-site installation, training, or any professional services that are required. Professional services vendor provided on-site install Options Any hardware, software, and services that are optional Maintenance costs Annual price for year 2 5 maintenance For questions or clarifications, please jmcnutt@bullheadschools.com no phone calls. Vendors should expect an response within 24 hours. Responses to questions will also be posted at

5 BCESD and CRUHSD will not participate in any web product tours, demonstrations, or phone conferences before the RFP s are due. Vendors may include videos or web-links with proposals. Once BCESD and CRUHSD have completed an initial review of all RFP s, we will contact finalists for product demonstrations. Please provide proposals electronically, either by (10Mb limit) in PDF format, or in person/by mail (Jump drive, CD/DVD) in PDF or MS Office format. Proposals are due by 2:00PM local time, Wednesday, May 28 th.