D -- Web Scanning and Filtering Capability

Web Scanning and Filtering Capability1.0 TECHNICAL INFORMATION DISA is considering the deployment of a web scanning and filtering capability to check for and remove viruses and malicious code from web traffic as it enters the DoD unclassified network. The concept being considered is to place the web scanning and filtering devices at points where the DoD networks connect with the Internet, and have them scan: - traffic from the internet bound for DoD web servers and the replies - traffic from DoD sites bound for the internet and the replies. The current DoD architecture is modeled after a service provider environment. As such, each connection point between the DoD Network and the public Internet is an independent node. This design, which provides for resiliency and redundancy, also allows asymmetric routing of traffic. Therefore its possible that asymmetric routing does occur, in that a web request may exit one peering location while the reply comes back via a second. Therefore, the web filters must not require state information between request and replies. Management of the web filter devices will be done centrally. The ability to adjust policies on a single device, independent of the others, or globally to all devices is needed. Support for SNMP v3 is desired for, at a minimum, device health checks. Additionally, some method of reporting activity and blocks that have occurred is required (e-mail, SNMP, web page, etc). The ideal architecture will have the web filter connected to the DoD premise routers. The premise router will port forward all http/https traffic (and any other ports considered necessary for example 8080) to the web filter. The web filter will review each packet, take action according to its policy, and return approved packets to the premise router for further routing. The web filter should not maintain state information to match replies to request, but should simply check each packet against its policy and make the appropriate decision. Currently, the DoD premise router connections to the Internet are OC-12 rates and possible web filter devices must be capable of supporting these speeds either individually, through a cluster capability, or other capability provided by the vendor. DISA is interested in hearing from any vendor who has a product that they believe can work in this environment. A technical discussion of the device is desired to ascertain its capabilities and suitability for deployment at the DoD premise routers No procurement will be done based on this RFI. It may lead to a web filter pilot effort that will assist DISA in further defining requirements and the concept of operations. If a pilot appears to provide a useful capability DISA may decide to develop a separate RFP for the web filtering capability. Responding to this RFI or participating in a possible web filter pilot will have no affect on the outcome of a possible RFP and responses to a possible RFP will not be limited to those who responded to this RFI. 2.0 INSTRUCTIONS FOR RFI SUBMISSION 2.1 Submissions Vendor RFI responses must be received by 4:00 PM Eastern Standard Time on December 1st, 2005. Please limit responses to ten pages including addendums, attachments, appendices. E-mail responses are preferred. Submit your response to: Sherry Green DISA Network Security Division/Standard Perimeter Defense 5275 Leesburg Pike Falls Church, VA 22045 Email: Sherry.Green@disa.mil 2.2 Your Company Information As the first section of your response, include details regarding your company such as brochures and other published material. At a minimum, the following information should be provided: - Company name, address, city, state and zip, phone and fax numbers, and web address - One sales contact with phone number and e-mail address - One technical contact with phone number and e-mail address - Location of U.S. primary and satellite offices - Applicable product name(s) - Three references of solutions installed at other locations of similar size and complexity must be provided. If this is not available, provide three references of solutions similar in scope installed at locations of any size and complexity. Include contact names, telephone numbers, addresses, product names, and the date when the software was installed. DISA, Network Security Division, is not liable for any costs incurred by vendors in the preparation and delivery of their responses nor for any subsequent discussions and/or product demonstrations. Receipt of the RFI or submission of an RFI response confers no rights upon the vendor nor obligates the Network Security Division in any manner. 2.3 Questions Questions regarding the RFI should be submitted by electronic mail. Questions should be addressed to: Sherry Green, Network Security Division, e-mail: Sherry.Green@disa.mil