Tender No. 61/20(83)/506/STPI-BH/2015, Dt: 06/04/2015. RFP for Supply, Installation and Commissioning of firewall at STPI- Bhubaneswar ISSUED BY

Transcription

1 SOFTWARE TECHNOLOGY PARKS OF INDIA (An Autonomous Body under Department of Electronics & IT, Ministry of Communications & Information Technology, Govt. of India) C-Ground Zero, Fortune Towers, C.S.Pur, Bhubaneswar Phone: /413, Fax: Website: Tender No. 61/20(83)/506/STPI-BH/2015, Dt: 06/04/2015 RFP for Supply, Installation and Commissioning of firewall at STPI- Bhubaneswar ISSUED BY Bhubaneswar Last Date for Submission of bids: 27/04/2015 at 30 PM Opening of Bids: 27/04/2015 at 4.00 PM The bids will be opened in the presence of authorized representatives of bidders who wish to attend. Tender documents can be downloaded from website: & must be submitted in:

2 Software Technology Parks of India, Bhubaneswar invites sealed bids from Experienced,Reputed Firms/dealers/vendors for Supply, Installation and Commissioning of Firewall at STPI-Bhubaneswar. The details are as following:- 1. COMMERCIAL OFFER: (Price Bid) SN Descriptions Specifications Qty Unit Price in Rs. 1 Supply and Installation As per attached in of firewall systems for Annex-I STPI-Bhubaneswar. 1 no. Value in Rs. 2 Taxes 3 Total Rs. Technical Specifications: Details of technical specifications (Features & Parameters) as attached in Annex-I. The details technical specifications with make, model & compliance statement must be as per the technical specifications (as per annex-i) which need to be supported by relevant product brochure etc. high lighting the specifications must be supplied along with the technical bid with duly signed & stamped by the authorized signatory.without proper compliance statement the bid is liable to be rejected

3 Terms & Conditions : a. Tender fee ( Non-Refundable): Rs. 500/- ( Rupees five hundred only) in form of DD/Pay Order favoring STPI payable at Bhubaneswar must be enclosed with the technical bid documents. Without tender fee, the tender will be rejected. b. EMD : ( Re-fundable to the un successful bidders without interest):the bidders should submit their quote along with EMD of Rs. 10,000/- ( Ten thousand only )in the form of DD favoring STPI payable at Bhubaneswar. c. The tenderer (s) must either be directly a principal /OEM or his authorized channel partner /dealer/distributor. In case of authorized channel partner /dealer/distributor, he should submit authorization letter from OEM failing which the offer will be summarily rejected. d. Unit Price must be mentioned in INR Inclusive of transportation. e. The vendors/suppliers must provide valid TIN, PAN Number & VAT certificate (photocopy to be enclosed with Signature, date and seal). f. The supplied firewall systems should carry three years Warranty. g. The bidder should not be black listed in any of the Govt. Organization in last 3 years. Undertaking in this regard must be submitted h. The bid validity for acceptance shall be for 90 days from the date of opening the technical bid i. The price quoted once can t be changed in any case. j. The materials must be supplied and installed within 4 weeks of issue of Purchase Order. k. Delivery of material should strictly be completed within the stipulated period of delivery otherwise the EMD will be forfeited & P.O. will be cancel. l. Transportation will be at Supplier s risks. m. Any incident during installation of firewall will be at supplier s risks n. The price offer through /Fax will neither be accepted nor entertained. o. The interested firms / manufacturers/suppliers are required to submit the technical bid & financial bid separately. The bid in sealed cover-i containing Technical bid & cover-ii containing Financial bid should be placed in a third sealed cover super scribed Tender Call for supply and installation of firewall systems at STPI- Bhubaneswar. on the top of the envelope and full address with phone number & E- Mail ID should be written in the sender s side of the envelope. p. 90% payment will be released after successful delivery, installation and testing of the firewall and 10% will be kept as performance guarantee for 3 years from the date of installation & testing

4 q. The agency/firm must sign on each page of the quotation document as published in the website as well as other relevant documents with seal & date before submission of tender. r. STPI reserves the right to cancel the order without any liability in case the materials are not supplied within the stipulated period and/or non-fulfillment of contractual obligation. s. The material must be properly packed against any damage and insured except where hand delivery is proposed. t. Instruments/Components/materials supplied are liable to be subjected to performance tests and in case the articles do not function/reach the expected standard, the supplier is liable to replace the items free of cost. Cost of returning goods will be on supplier s accounts. u. If any equipment or part thereof is lost or rendered defective during the transit the supplier shall immediately arrange for the supply of the equipment/materials or part thereof as the case may be. v. Delivery/ installation of the store should strictly be completed within the stipulated period of delivery. w. We reserve the right to reject the items, if found unsuitable and/or not performing the approved specifications. x. A work shop (Training) on firewall must be conducted at STPI-Bhubaneswar by the successful bidder. y. A pre receipted bill in triplicate in the name of the Director Software Technology Parks of India, C-ground Zero, Fortune Towers, Bhubaneswar , Odisha shall be submitted soon after the completion of the work. Reputed manufacturer/supplier/dealer/vendor may send their offer clearly mentioning their price. The complete offer should reach Office of the Director, STPI-Bhuaneswar, Fortune Towers on or before 27/04/2015.at 30 PM. Incomplete offer or communication after due date and time will be rejected. Director reserves the right to reject /cancel the offer without assigning any reason thereof

5 TECHNICLA BID Annex-I. FIREWALL Features and Parameters Firewall: Complie d (Y/N) Appliance based firewall, Should be EAL or ICSA certified for firewall and IPSEC. Model quoted should be new and should support for at least 5 years from the date of purchase order. Number of Network Interfaces to be mentioned exactly as supported by the device, Vendor to quote with minimum of 6 no of Gigabit interfaces (10/100/1000 TX RJ45 Type). 4. Should support firewall throughput of at least 5 Gbps 5. Should support VPN throughput of at least 100 Mbps Should support at least 5,00,000 concurrent sessions and at least new sessions per second The device should not have license restriction on number of users Should support at least 25 IPSec Site-to-Site VPN tunnels and 25 IPSec Remote access VPN tunnels. (If licensed separately should include 5 IP Sec Site to Site and 10 IP Sec Remote Access License) Should support at least 25 concurrent SSL VPN users (If license separately should include 5 SSL VPN License ) Appliance should have hot-swappable redundant power supplies High Availability: The firewall should be able to support high availability and dynamic load balancing for data passing through the firewall (active-active). If external firewall load balancers are required to achieve active-active, the same is to be mentioned. Dual WAN/ISP support: Should support automatic ISP failover as well as ISP load sharing and load balancing for outbound traffic. 1 Traffic Management: option to configure traffic shaping on a per policy basis for specific application/specific networks and - 5 -

6 should be able to define guaranteed bandwidth and maximum bandwidth per policy. The appliance Should support Link aggregation (IEEE 802.3ad) technology to group multiple physical links into a single logical link of higher bandwidth and link fail over capability. The appliance Should support VLAN tagging (IEEE 802.1q) and Should support VLAN on all interfaces and minimum of 64 VLAN/ Interface should be supported 16. The Appliance should be Rack mountable 17. Appliance should support Power input AC 100~240V,50-60 Hz 1 ISA should support IPSec NAT Traversal 1 ISA should support OSPF, RIP V1 and V2 routing protocol. 20. ISA should support IPV6 and all Policies on IPV Bandwidth Control/ Restriction per IP Address & Per policy should be available. Should Support NAT without degrading the performance of the firewall Should support authentication using Radius, Tacacs+, LDAP etc. 24. Should support Routing between Vlans 25. Should have Layer 2 bridge support 26. Should support minimum of 2,000 policies IPS Features 1. Throughput : should have at least 1Gbps of IPS throughput 2. IPS shall be able to detect incidents that originate from inside the network perimeter as well as from outside the network perimeter and shall be able to take action on the basis of configured policies. Support at least 1500 or more signatures with online download support of newer signatures. 4. Should have option to create User-specified signatures. 5. The software on the IPS should support online software reconfiguration to ensure that changes made to an IPS configuration take place with immediate effect

7 The IPS should support high availability, so that in case if the primary fails the secondary appliance will become active without any manual intervention. Each IPS signature should have a configurable actions like terminate a TCP session by issuing TCP Reset packets to each end of the connection, or drop the traffic in addition to sending a alert and logging the incident Signatures should have a severity level defined to it so that it helps the administrator to understand and decide which signatures to enable for what traffic (eg. for severity level: critical, high, medium, low) IPS shall be able to be configured such that attack signature and traffic analysis focus only on specified hosts, specified protocols, or specified services. Should be able to generate graphical reports on top attacks, source for attack etc. Should have the option to schedule reports for automatic generation. Vendor updates its attack signature database regularly and it should be configurable to update the signatures automatically without manual intervention. Vendor makes new attack signatures and new major software releases available for download from their Web site Anti-Virus Features Should be a integrated solution with appliance based firewall or should be a appliance based solution which can be integrated with firewall The proposed solution should have minimum 200 Mbps of AV throughput Antivirus should provide real-time detection of viruses and malicious code at the gateway for SMTP, POP3, IMAP, HTTP, and FTP Internet traffic. IM protocols (AIM, ICQ, MSN, Yahoo). The proposed solution should be licensed per unit as against per user. Antivirus Gateway should have option to configure to respond to virus detection in several ways i.e. Delete the file, quarantine the file, Alert Frequent updates of virus pattern files Should be available from the Website, and option for scheduling for automatic download and installation should be available

8 Sl. No. 1. In terms of SMTP AV scanning the solution should not act as mail relay or MTA by itself. Should have facility to block files based on file extensions and file types over HTTP, FTP, SMTP, POP3 as well as IMAP Should have facility to configure the maximum file/ size which can be downloaded thru internet Should have configurable policy options to select what traffic to scan for viruses The proposed solution should be scalable and offer fault tolerance to safeguard against hardware failures. The failover box should be capable of taking over from the primary box in the case of a failure in the primary box without any manual intervention The solution should support load balancing for the AV scanning, so that the traffic which needs to be scanned can be load balanced across the boxes in the cluster Should have reporting facility to generate reports on virus detected over different protocols, top sources for viruses, destination for viruses, top viruses etc. Web Filtering Features Description Web content filtering solution should work independently without the need to integrate with proxy server Requireme nt 2. Should have facility to block URLs based on categories 4. The proposed solution should be licensed per unit as against per user. URL database should have at least 15 million sites and 30 + categories. 5. URL Database should be updated regularly Should be able to block different categories/sites based on users. Should have configurable parameters to block/allow unrated sites Should have configurable options to allow/deny access to web sites in case if the URL rating service is unavailable Should have options to customize the block message information send to end users - 8 -

9 Should have facility to configurable policy options to block web sites based on banned words. Should have configurable policy options to block URLs based on web patterns (eg. Mail.* to block web mail related sites) Should have configurable policy options to define the URL exempt list 1 The solution should be able to block spywares/adwares etc Sl. No. The solution Should have options to block java applets, activex as well as cookies The solution should have options to configure in such a way that in case if the primary ISA fails the secondary becomes active without manual intervention Anti SPAM Features Description Requireme nt 1. Should be a integrated solution with the Firewall appliance Vendor should have their own RBL database of known spam sources to validate/check whether the mail is a spam or not The proposed solution should be licensed per unit as against per user. Should be able to detect spam mails in SMTP, POP3 as well as IMAP protocols The proposed solution should have inspection facility on the header and body of the mail to check for spam content and identify whether the mail is a spam mail or not. Option should be available to manually configure multiple RBL servers to check for spam mail Should have options to configure white list as well black list, based on IP address and validate against the same to detect whether a mail is spam mail or not Should have options to configure white list and black list based on address/domain and validate against the same to detect whether a mail is spam mail or not. Should have provision to define banned key words and check against that key words to identify spam mails. Should have options to define mime headers and check against the same to identify spam mail. Should have configurable spam actions for detected spam mails (eg, tag the mail, delete the spam mail etc)

10 Sl. No. Logging & Reporting Description Requireme nt 1. Logging and reporting solution should be supported The solution should generate the reports for the firewall, gateway level AV, IPS web filtering and spam functionalities requested. The solution shall have readymade templates to generate reports like complete reports or attack reports, bandwidth report, intranet report The ISA should support SNMP V2C and V3 for integration with existing NMS The solution should help to analyze/understand Attacks over various protocols like http, ftp, SMTP, POP3 and IMAP as well as to sources and destination for these attacks. The solution should help to analyze/understand the security breaches hacker attacks and the sources and destination for these attacks The solution should help to analyze/understand the protocol and bandwidth usage by users to help in capacity planning and understand network utilization Should have options to generate reports in terms of which are the frequent attacks as well as top sources and destination for attacks Should have options to generate reports in different formats like html, pdf, ms word etc.. The solution should have configurable options to send the reports as a mail to the designated address or to ftp to the configured ftp location Should have configurable parameters to send alert s based on event type or attack type or total number of attacks Should have configurable parameters to set alert thresholds (eg. If same event/attack occurs more than 5 times within an hrs time) The solution should have configurable options to schedule the report generation (eg. hourly, daily, weekly etc.) The solution should be running its own syslog server to collect the logs The solution should also have the option to generate reports based on the logs collected from multiple firewalls

11 17. 1 Should have options to create users with different access rights (eg. users who can only view reports, users who can create schedules and reports etc) ISA should support backup Policies and Firewall OS using TFTP or any other method