OhioMHAS - Wireless Modernization Project

Lot 1, Round 4: Additional requirements were added to the RFP.  MISSION & GUIDING PRINCIPLES The mission of the Ohio Department of Mental Health and Addiction Services (OhioMHAS) is to provide statewide leadership of a high-quality mental health and addiction prevention, treatment and recovery system that is effective and valued by all Ohioans. OhioMHAS strives to be a national leader in implementing a comprehensive, accessible, and quality-focused system of addiction and mental health care and wellness for all Ohio citizens.  PURPOSE The Ohio Department of Mental Health and Addiction Services (OhioMHAS) is seeking proposals from qualified contractors to modernize our wireless infrastructure. BACKGROUND OhioMHAS owns and operates an Agency wide Aruba wireless system, comprised of 9 Aruba Controllers and 1300 Access Points installed at 8 primary locations, as well as several remote locations.  These access points provide wireless network connectivity for Voice, Data, and Video services at all locations.  These voice, data, and video services facilitate vital 24x7 “person to person” voice functionality, access to core Agency applications, and access to intranet/internet information sources. The user count for any given 24-hour period exceeds 1000 user/nodes on the wireless network, with hundreds of gigabytes of data throughput.OhioMHAS has the need to modernize the configuration of the wireless system to provide better security, increase visibility and troubleshooting of devices connecting to the wireless network, upgrade of the code base running on the infrastructure, and enhancement of the architecture implemented to support the wireless system. In support of this modernization effort – OhioMHAS seeks services to modernize our wireless infrastructure.  The selected vendor will provide: Project Management Oversight Service Planning Architecture and Design Design and Configuration Startup Support Development Validation Testing As-built Documentation Post Deployment (Production) Support Additional Items
  SCOPE OF WORK AND DELIVERABLES In support of this modernization effort – OhioMHAS seeks services to modernize our wireless infrastructure.  The selected vendor will provide: Project Management Oversight Service Planning Architecture and Design Design and Configuration Startup Support Development Validation Testing As-built Documentation Post Deployment (Production) Support Additional Items
The delivery specification for each of the requirements are: Project Management Oversight
In this phase, the selected vendor will: Schedule appropriate staff in a timely manner and coordinate all technical resources. Participate in scheduled project review meetings and conduct meetings and conference calls as required to meet the project deliverables and timelines. Provide a weekly activity report.
Deliverables for this Service include: Documented project plan with milestones for customer dependencies
Service Planning
In this phase, the selected Vendor’s Project Manager will coordinate the activities and activity sequence with the HAS project manager. In this phase, the selected Vendor’s technology specialist will conduct service planning meetings with the HAS project team and share service delivery requirements and prerequisites. The selected Vendor will help collect and review information to confirm that all prerequisites have been met. Activities during these meetings include: Provide and review prerequisite checklist for completion. Provide and review prerequisite instructions for completion. Review roles and responsibilities. Schedule High Level Design (HLD) collaboration meeting Discuss scheduling. Prerequisite readiness check Equipment availability/arrival Customer change management requirements
Deliverables for this Service include: Documented project plan with milestones for customer dependencies
Architecture and Design
In this phase, the selected vendor will Define the Controller Architecture, use cases, and high-level design. Define ClearPass Architecture, use cases and high-level design. Define Airwave Architecture, use cases and high-level design. Reviewing OhioMHAS requirements and included use cases. Reviewing firewall requirements with OhioMHAS’ network and security teams Reviewing pre-installation requirements
 
Design and Configuration
In this phase, the selected vendor will, with Customer assistance: Apply baseline configuration for all Aruba controllers in place at their respective geographical locations (i.e. on site at each site) which will include code upgrade to most current version possible. Apply baseline configuration for two (2) ClearPass nodes at a single geographical location which will include code upgrade to most current version possible. Apply baseline configuration for one (1) Airwave node at a single geographical location which will include upgrade to most current version possible. Reviewing Customer’s requirements and included use cases. Reviewing firewall requirements with Customer’s network and security team Reviewing pre-installation requirements
 
Startup Support
In this phase, the selected Vendor will: Provide provisioning instructions (including recommended code versions and upgrade procedures) for virtual or physical Aruba Controllers nodes. Provide provisioning instructions (including recommended code versions and upgrade procedures) for virtual or physical Aruba ClearPass nodes. Provide provisioning instructions (including recommended code versions and upgrade procedures) for virtual or physical Aruba Airwave nodes. Provide guidance to customer on how customer can provision physical or virtual appliances and perform software upgrades if needed. Assist with registration and application of Aruba licenses to in scope Aruba devices.
 
Development
In this phase, the selected Vendor will:  Controllers Configure each (all) controllers as part of the controller architecture, with a local controller at each site, connecting to the Primary Controller located at the main data center. Configure the local controllers in alignment with the system architecture determined during the Architecture and Design phase.

 
ClearPass Configure all ClearPass server(s) in alignment with the system architecture determined during the Architecture and Design phase.
Configure up to four (4) nodes in a single cluster3. Configure one (1) node as the Publisher and one (1) node as the Backup Publisher Configure the cluster for RADIUS, TACACS and Guest authentication. Configure up to four (4) ClearPass-based Virtual IP addresses (VIPs) to support high availability. Configure the cluster with one (1) external location or server for automated configuration backup. Configure the cluster with up to one (1) Active Directory (AD) authentication source. Apply up to two (2) customer-provided server certificates: one (1) SSL for ClearPass guest4 and administration, and one (1) for RADIUS 802.1X use cases on up to four (4) ClearPass nodes. Configure up to three (3) wireless Network Access Devices (NADs)5 and three (3) wired NADs. Configure up to two (2) TACACS services, with up to two (4) AD groups configured for read and read/write role derivation. Configure one (1) wired service for 802.1X, with or without MAC Authentication Bypass (MAB), to include one (1) authentication type and up to two (2) VLAN mappings. Configure one (1) wired service for MAC authentication to include one (1) authentication type and up to two (2) VLAN mappings. Configure one (1) wireless service for 802.1X (Secure SSID) to include one (1) authentication type and up to two (2) VLAN mappings. Configure one (1) wireless service for open or PSK MAC authentication to include one (1) authentication type and up to two (2) VLAN mappings. Configure one (1) wireless Guest self-registration workflow, utilizing ClearPass guest webpage templates4 for self-registration and a downloadable receipt. Configure the cluster data retention settings.



Airwave Configure the Airwave server in alignment with the system architecture determined during the Architecture and Design phase.

 
Additional Configuration Items In cases where unforeseen configuration items are discovered, or some configuration items exceed the limits as described in parts 6A, 6B, and 6C, those configuration items will be completed to meet the Architectural Design (as described within part 3) and be validated accordingly in accordance to part 7.

 
Validation and Testing Phase
In this phase, the selected vendor will: Create and provide a standard validation checklist encompassing all configured use cases/scenarios as defined within the Architecture and Design Phase Assist with the execution of each test in the checklist to validate the use cases, defined in the Design and Architecture Phase, are being met.
As Built Documentation Phase
In this phase, the selected vendor will provide:
A topology diagram describing the logical interconnection of the in-scope Aruba devices. A diagram showing the configured Aruba Controllers, ClearPass services, Airwave services and their relationship to each other. A list of configured IP addresses for in scope Aruba devices and TACACS/RADIUS shared keys used during the configuration phase.

Post Deployment (Production) Support
In this phase, the selected vendor will provide: 40 hours of post-production remote support for all configuration items described in part 6. The support window will be in effect for 6 months after phase 7 is completed. Support to be consumed (billed) in 6-minute increments (10 increments per hour possible) Support duration will be communicated at the completion of each request, via email for confirmation regarding the call duration, and so that duration can be tracked. Support calls would be limited to normal business hours, 8:00AM-5:00PM E.S.T. Support responsiveness will be 8x5 NBD (meaning, normal business hours Monday – Friday with an expected response window not to exceed next business day (but may be sooner if available)
 Additional Items
Nonproduction impacting services are to be performed during regular OhioMHAS workdays and business hours (8:00AM – 5:00PM, Monday – Friday).  Production impacting services, during critical implementation steps and after approval by HAS management and HAS change control, may be required to be performed after normal business hours, and during weekends.  Some work may require travel to remote OhioMHAS sites located in Toledo, Cleveland, Cincinnati, Columbus, Athens, and Massillon Ohio. The selected vendor will participate in any additional trainings required as a pre-requisite to enter and work within remote OhioMHAS sites (Mental Health Hospitals).  The selected vendor will be required to complete vendor access request forms and adhere to State of Ohio remote work standards (where applicable).  The selected vendor technical staff will be required (at a minimum) to be on site at 30 East Broad Street, 33rd floor two days/week (Wednesday and Friday from 7:00AM – 3:30PM) throughout the duration of the project, however they may be required to be on site more often dependent upon configuration tasks needed to achieve project success. Out of scope configuration / integration tasks will be performed by State of Ohio Infrastructure Specialists
Wireless Modernization Project – Locations  The James A. Rhodes State Office Tower (SOT), 30 East Broad Street, Columbus, Ohio 43215 MHA IT work location on the 33rd floor This is the primary work location for in-office workdays
The State of Ohio Computer Center (SOCC), 1320 Arthur E. Adams Drive, Columbus, Ohio 43215 This is the location of the Primary Aruba Controller (Mobility Master) This is a secure facility, with limited and controlled access that must be scheduled prior to arrival
Appalachian Behavioral Healthcare (ABH), 100 Hospital Drive, Athens, Ohio 45701 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Central Ohio Behavioral Healthcare (COBH), 2200 West Broad Street, Columbus, Ohio, 43223 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Heartland Behavioral Healthcare (HBH), 3000 Erie Street South, Massillon, Ohio, 44646 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Northcoast Behavioral Healthcare (NBH), 1756 Sagamore Road, Northfield, Ohio, 44067 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Northwest Ohio Behavioral Healthcare (NOBH), 930 South Detroit Avenue, Toledo, Ohio 43614 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Summit Behavioral Healthcare (SBH), 1101 Summit Road, Cincinnati, Ohio, 45237 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival
Ohio Pharmacy Services (OPS), 2150 West Broad Street, Columbus, Ohio 43223 This is a location with a Local Aruba Controller This is a secure facility, with limited and controlled access that may require site training prior to entry, and which will need to be scheduled prior to arrival

Floorplans, square footage, and areas needing coverage are not listed. AP/RF coverage is not in scope for this project.Wireless Modernization Project – Hardware Specifications The existing hardware vendor is:  HP/Aruba ClearPass is a VM, Airwave is a VM.  All other components are hardware. The existing ClearPass (as described in question 3 “BOM”) is installed and assigned an IP address, however it is not performing ANY NAC functions – and is a priority focus of this project No other NAC solution exists There is not an “Orchestrator” node, only the Mobility Master HW-5K None of the equipment is net new.  The projects primary focus is to modernize existing equipment footprint. The controllers in the remote locations are up and running, but not operational (no AP’s terminated on remote controllers) The MM-HW-5K and one 7240 at the SOCC are in production hosting all AP’s and Clients, and will need to be reconfigured in accordance with the Project Plan If there are recommendations for upgrades/purchases they can be addressed in the architectural design phase of the project, however – maximizing the use of existing hardware is a priority. RF coverage improvements are not in scope for this project All APs are in place, currently in production supporting MHA wireless needs The vendor is free to make forward looking recommendations in the closing phase of the project
  Aruba Controllers:           
SOCC Aruba MM-HW-5K (hardware); Aruba OS - 8.6.0.9 Aruba 7240 (hardware); Aruba OS - 8.6.0.9_79813 Aruba 7240 (hardware); Aruba OS - 8.6.0.9_7981
ABH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
HBH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
NBH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
NOPH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
OPS Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
SBH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226
COBH Aruba 7210 (hardware); Aruba OS - 8.3.0.9_72226

Aruba Controllers:   Primary Controller (Mobility Master) is actively servicing the wireless network with over 1300 AP’s and over 2000 clients daily The SOCC controller is actively servicing the wireless network with over 1300 AP’s and over 2000 clients daily All other controllers are existing, installed, powered on, active with an assigned IP address, and responding to SNMP queries, however they are not in production
Aruba Clearpass Server(s)   One server VM is installed, “powered on”, active with an assigned IP address, and accessible on the network One server VM license is in process of being purchased, is not powered – nor active, the selected vendor would be responsible for installation and setup
The Aruba Airwave server is installed, powered on, active with an assigned IP address, and collecting some data from the Mobility Master Controller All Aruba access points are installed, powered on, active with an assigned IP address – and providing wireless connectivity (Video, Voice, Data) for over 2000 clients daily Clearpass server: SOCC ClearPass Policy Manager (VM) 6.9.0.130064 on C1000V platform Additional “redundant” ClearPass server is in procurement
Airwave Server: SOCC AirWave Management Platform (VM) 8.2.13.0
Access Points
AP's using a license in Airwave105's125 205's113 215's72 275's68 303h's10 315's205 375's25 505's3 515's107  728   AP’s in Airwave with no license105's22 205's29 215's17 275's16 303h's8 315's6 375's5 505's10 515's130  243   AP’s on hand, not deployed inventory515's50 Juniper and Cisco230  280   Total by AP model105's147 205's142 215's89 275's84 303h's18 315's211 375's30 505's13 515's287Grand Total AP's 1021Current Total Count for Airwave 1301Current Airwave License Count 1126   MINIMUM QUALIFICATIONS OF CONTRACTOR In support of this modernization effort – OhioMHAS seeks services to modernize our wireless infrastructure.  The selected vendor should show, in detail, how they will provide the following services as outlined in Section IV. Scope of Work and Deliverables: Project Management Oversight (Project Manager) Service Planning (Project Manager) Architecture and Design (ACDP or ACMX) Design and Configuration (ACMP or ACDP or ACMX) Startup Support (ACMP) Development (ACMP) Validation Testing (ACMP) As-built Documentation (ACMP) Post Deployment (Production) Support (ACMP) Additional Items
The minimum qualifications of the project staff shall be: Project Management Oversight – by a PMP certified project manager with at least 5 years of experience managing technology projects. Architecture and Design – by an Aruba Certified Design Professional (ACDP), or an Aruba Certified Mobility Expert (ACMX) with at least 5 years of experience architecting Aruba wireless network solutions which include Clearpass authentication. Design and Configuration – by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience. Startup Support– by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience Development – by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience Validation and Testing Phase– by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience As-built Documentation – by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience Post Deployment (Production) Support – by an Aruba Certified Mobility Professional (ACMP) or higher-level Aruba Certification (ACMX or ACDP) with at least 5 years of experience.
** Aruba certifications may not be required if vendor can show demonstrative experience implementing the Clearpass and Airwave technology and are willing to provide references the HAS is permitted to contact for verification.Contractor shall not be subject to an “unresolved” finding for recovery under Section 9.24 of Ohio Revised Code.