SECTION- F (Revised) BOM & TECHNICAL SPECIFICATIONS

Transcription

1 SECTION- F (Revised) BOM & TECHNICAL SPECIFICATIONS ALL TECHNICAL PARAMETERS ARE MANDATORY NO DOWNWARD DEVIATION IS ALLOWED IN CASE OF ANY DEVIATIONS IN SPECIFICATIONS, THE BID WILL BE SUMMERILY REJECTED TECHNICAL SPECIFICATIONS FOR WEBSECURITY Sl No Specifications Functionality Required in the Appliance Solution The Appliance should support HTTP, HTTPS and FTP traffic 1 Appliance Requirement and Functionality The solution should be a hardened Web Proxy, Caching, Web based Reputation filtering, URL filtering, Antivirus and Anti-malware appliance All the functionalities should be in a single appliance only 2 The web proxy appliance should not allow end users connections directly to the internet The appliance should maintain user connections & initiate connections to the internet on behalf of end clients Appliance Hardware and Operating System Specifications for Internet & Non-Internet Gateway locations 3 Network Interface cards The appliances should have minimum 4 nos Gigabit Ethernet ports 4 Operating System The solution should support 2500 users from day one and should have the scalability to support users on the same appliance, without any change in the hardware 5 Operating System Performance The underlying operating system and hardware should be capable of supporting at least 10,000 users from day one 6 Operating System Security The operating system should be secure from vulnerabilities and hardened for web proxy and caching functionality 7 Hardware The appliance should have at least 1 TB of disk space with Raid support 8 Power Supplies /Hard Drives Appliance should support redundant power supplies & hot swappable hard drives from day one 9 Caching Web Proxy appliance should support at least 100 Gb of cache space & minimum object size in cache of 1Gb Proxy & Caching Deployment Options 10 Forward proxy mode The solution should support explicit forward proxy mode deployment in which client applications like browsers are pointed towards the proxy for web traffic 11 Forward proxy mode - The forward proxy mode deployment should support single IP proxy configuration and Single and Dual IP dual IP proxy configuration where one IP will be of local LAN and another IP will be of configuration DMZ 12 Transparent mode The solution should also support transparent mode deployment using WCCP v2 and L4 switches/pbr (Policy-based Routing) 13 Pac File support The appliance should support hosting proxy auto-config files that define how web browsers can automatically choose the appropriate web proxy for fetching a URL 14 Support multiple deployment options The solution should allow to deploy the appliance in explicit proxy as well as transparent mode together 15 Proxy Chaining The solution should support proxy configuration in a Chain The Lower end proxies at spoke locations should be able to forward the request to an Higher end proxies at Hub Location forming a Chain of Proxies 16 DNS Splitting The solution should support configuration to use Split DNS It should be able to refer to different DNS for Different Domains eg (root dns for all external domains and internal DNS for organization domain 17 IP Spoofing support in transparent mode deployments The solution should have facility to do IP spoofing When enabled, requests originating from a client should retain the client s source address and appear to originate from the client instead of the appliance This is useful in scenarios where policies are based on original IP and logging/reporting is required to track activity of individual IP basis WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 1 of 6

2 Web Proxy performance 18 Sustained RPS or TPS The appliance should support a sustained RPS/TPS of atleast 575 requests per second/transaction Per seconds with the below mentioned services without reporting data loss & in no loss in any applicable functionality of the web proxy appliance The overall solution should be able to support to scale upto atleast 1000 sustained requests per second 19 Web Security Services The web security services should include URL-Filtering, Web Proxy, Application visibility control for web traffic, Web based reputation filtering, should support industry known Anti-virus/Anti-Malware engines simultaneously, with access policies, NTLM authentication & adaptive scanning with atleast 10% of the https traffic being decrypted Proxy Requirements 20 Proxy support The proposed solution should be a Fast Web Proxy and should support HTTP, FTP and HTTPS proxy 21 HTTPS Decryption The solution should support HTTPS decryption 22 HTTPS decrypted traffic The solution should support scanning of the https decrypted traffic by the on-board scanning anti-malware and/or anti-virus engines 23 HTTPS decryption controls The solution should provide the flexibility of deciding whether to decrypt https traffic or not to the solution administrator The solution should offer three aspects to decide These are: 1) URL category based decryption 2) Web Reputation based decryption 3) Default action for the specific policy 24 HTTPS decryption policy HTTPS decryption should provide flexibility to have multiple decryption policies and should not be just a Global action 25 Protocol Tunneling Should support the functionality to block applications that attempts to tunnel non- HTTP traffic on ports typically used for HTTP traffic Should support the functionality for blocking non-ssl traffic on SSL ports & should also support the functionality to tunnel the transaction 26 Native FTP protection The solution should act as an FTP proxy and enable organizations to exercise granular control, including: allow/block FTP connections, restrict users/groups, control downloads or uploads and downloads both, and restrict sent/received files to certain types or sizes 27 File download and size restrictions The solution should be capable of blocking specific files downloads and based on user or group basis 28 IP based Access Control The solution should allow administrator to define access to internet based on IP addresses, range of IP addresses, subnet and CIDR basis It should also support to be forced for Authentication from Specific IP addresses, Subnet or CIDR's 29 User based Access Control The solution should support integration with active directory and/or LDAP This should allow administrator to define user or group based access policies to Internet 30 Multiple Authentication Server Support 31 Application and Protocol Control The solution should support Multiple Auth Servers / Auth Failover using Multi Scheme Auth (NTLM and LDAP) It should also support authentication exemption The solution should support granular application control over web eg Facebook controls like block file upload, block posting text, enforcing bandwidth limits on application types 32 Layer 4 Traffic Monitoring Should detect Phone Home attempts occurring from the entire Network It should also detect the PC's that are already infected with Malware in the Network across all network ports that attempts to bypass port Layer 4 Traffic Monitoring Solution should support scanning of traffic on all ports to match against domain names & IP addresses against entries in it s own database table which should be continuously updated 34 Layer 4 Traffic Monitoring It should support through monitoring and blocking of malware address 35 Bandwidth restrictions The solution should support providing bandwidth limitation or optimization for streaming media application traffic This should be possible at the Global level as well as at a per policy level WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 2 of 6

3 Security 36 Anti Malware The appliance should have support for known Anti Malware/Anti Virus engine that can scan HTTP, HTTPS and FTP traffic for web based threats, that can range from adware, browser hijackers, phishing and pharming attacks to more malicious threats such as rootkits, Trojans, worms, system monitors and Keyloggers and as defined by the organizations policy 37 Anti-Malware With AV/Anti-Malware engine scanning when a URL causes different verdicts from the scanning engine the appliance should perform the most restrictive action 38 Malware Protection The AV/Malware engines should protect atleast against the follow types of malware/threats: Adware, Browser Helper Object, Commercial system monitor softwares, Dialer, Generic spyware, Hijacker, Phishing URL, potentially unwanted applications, Trojan downloader, virus, worm etc 39 Web Reputation The solution should provide Web Reputation engine in built within the solution 40 Web Reputation parameters 41 Incoming/Outgoing Traffic scanning 42 Outbound connection control on all ports and protocols The Web Reputation Filters should have capability to analyze more than 100 different web traffic and network-related parameters to accurately evaluate the trustworthiness of a URL or IP address Solution should also support in participating by providing information to the cloud based servers to increase the efficacy & reputation based scoring The solution should scan for Incoming and outgoing traffic The solution shall provide option to scan all ports at wire speed, detecting and blocking spyware activity trying to connect to the outside Internet By tracking all network ports and all protocols, the solution shall effectively mitigate malware that attempts to bypass Port URL filtering The solution should have an inbuilt URL filtering functionality with multiple pre-defined categories 44 Custom URL filtering The solution should support creation of custom URL categories for allowing/blocking specific destinations as required by the Organization 45 URL Filtering Options The web Proxy should support following actions like allow, monitor, block, time-based access Should also support displaying a warning page but allows the user to continue clicking a hypertext link in the warning page 46 Dynamic Categorization Provision should be available to enable Real Time Dynamic categorization that shall classify in real time in case the URL the user is visiting is not already under the predefined or custom categories database 47 Reporting Miscategorization The solution should have facility for End User to report Mis-categorisation in URL Category through the administrator 48 URL check & submission Support portal should give facility to end user to check URL category and submit new URL for categorization 49 Filtering Content Solution should support filtering adult content from web searches & websites on search engines like google 50 Application control The solution should support signature / application based control For instance, it should allow Facebook but should support blocking of only chat or file transfer or playing games within Facebook This blocking should be based on signature / application and not only on URL The application signature database should be updated periodically by the vendor Mention the number of signatures available in the current release or mention the number of web based applications that can be blocked by the current signature set WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 3 of 6

4 51 End User Notification Solution should support following end user notification functionalities The proxy should support the functionality to display a custom message to the end user to specify the reason the web request is blocked When the website is blocked due to suspected malware or URL-Filters it should allow the end user or administrator to report that the webpage has been wrongly misclassified The solution should support the functionality of redirecting all notification pages to a custom URL to display a different block page for different reasons Should support the functionality to force users to explicitly agree to the terms and conditions for browsing the World Wide Web from the organization s network to let the user know that the Organization is monitoring their web activity Fine tuning performance parameters Caching Technical Support Connection parameters Appliance should support the functionality to remove a Url from the cache & also support specifying a Url or domain to never cache Should support the functionality to apply per user bandwidth controls to content served from the web cache in addition to the content served from web servers Appliance should support the functionality to specify how long the Web Proxy keeps open a connection to a client or server after a transaction has been completed Appliance should support the functionality for how long the Web Proxy waits for more data from an idle client or server when the current transaction has not been completed Appliance should support the functionality to specify the maximum number of connections (sockets) the Web Proxy keeps open with servers Appliance should support forwarding HTTP X-Forwarded-For headers 56 Remote support The remote support from principal company should be available via India Toll Free and The Support Portal access should be provided for Case management, knowledgebase, new version information, tools etc 57 Secure Remote Access The Support Engineers should be able to login to appliance using secure tunneling methods such as SSH for troubleshooting purposes 58 Diagnostic Tools The appliance should have diagnostic network utilities like telnet, traceroute, nslookup and tcpdump/packet capture 59 Updates and Upgrades The appliance should provide seamless version upgrades and updates Appliance Administration and Management Secure Web Based management CLI based management Serial Console access Ethernet Management Appliance should support a web interface that includes a tool that traces & can simulate client requests as if they were made by the end users and describes Web Proxy processes the request for troubleshooting purpose It should support simulating HTTP GET & POST requests The appliance should be manageable via HTTP or HTTPS The appliance should be manageable via command line using SSH For emergency, the appliance should have serial console access Should have provision for Ethernet for managing the appliance WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 4 of 6

5 Logging and Reporting Web Logs Log retention & rollover Log transfer Retention Period User Reports The Proxy Log should be scalable The log formats shall include Apache, Squid or W3C or Xml Solution should support automatic rollover & archive the log file when it reaches admin defined maximum file-size or time interval like daily/weekly rollover of logs Should support compressing rolled over log files before storing them on disk to reduce disk space consumption The appliance should support following mechanism to transfer log files: Should support remote FTP client to access the appliance to retrieve log files using an admin or operator user s username and password Periodically pushing log files to an FTP server Periodically pushes log files using the secure copy protocol to an SCP server on a remote computer Sending logs to a remote syslog server confirming to RFC 3164 The retention period should be customizable Options should be provided to transfer the logs to an FTP server using FTP or SCP Informative and exhaustive set of reports on User Activity and URL filtering activities (GUI to report past activity, top usage users and top malware threat) 67 Bandwidth Reports Reports on Bandwidth Consumed / Bandwidth Saved 68 Detailed logging Product to maintain detailed proxy access logs that can be searched via filters, for easy location of any desired access of the user and to see how the product dealt with it 69 Off Box Reporting Solution should also support centralized reporting 70 L4 traffic reports 71 Blocked by reputation & malware reports Detailed report on an IP basis should be provided on the L4 traffic monitoring / Network Layer Malware Detection It should support reporting web requests blocked due to web reputation & blocked by malware Warranty 72 Optional Points Report Formats Scheduling of Reports System Reports Updates and Upgrades Customizable Web Reputation Solution Solution should support generating a printer-friendly formatted pdf version of any of the report pages Should also support exporting reports as CSV files Solution should support to schedule reports to run on a daily, weekly, or monthly basis Should support system reports to show CPU usage, RAM usage, percentage of disk space used for reporting & logging Support should cover all upgrades for the time period the licenses and support purchased from principal vendor The Appliance should have customizable setting in the Web Based Reputation Services, like Allow, Scan and Block based on the scoring settings by the Administrator Solution should provide deployment flexibility as a appliance based, software based, SAAS based and Hybrid deployment then management should be from single management console in case of any deployment mode Solution should provide in-built gateway level AV and SSL decryption within same appliance Web category bypass from decryption WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 5 of 6

6 MANAGEMENT SERVER: Sl Component Detailed Specification No 1 Processor type Intel xeon E5-2609, 240 GHz / E5, 15M Cache, 72GT/s QPI, Turbo, 6C, 95W 2 No of Cores 4 core per processor 3 Chassis 25-inch Chassis, risers with up to 4, x8pcie slots + 2, x16 PCIe Slot 4 Cache per processor 10 MB (Min) 5 No of processor 2 processor 6 RAM DDR III - 16 GB RDIMM, 1333 MHz, Low Volt, Dual Rank, x4 Bandwidth 7 HDD 2 x 600 GB HDD or higher with SAS interface with RAID 15 configuration 8 Networking Integrated 2 nos 10/100/1000 Base TX ethernet Interface 9 Optical Drive DVD/R/W Drive 10 Power Supply Dual, Hot-plug, Redundant Power Supply (1+1), 750W 11 USB port Minimum 5 nos USB Display 17" LCD Monitor (4:3 or 16:9 aspect ratio) 13 KeyBoard 104 Keyboard 14 Mouse Optical Scroll Mouse 15 Operating System Vendor to provide as per the requirement of solution 16 Database Vendor to provide as per the requirement of solution 17 Form factor 2U Rack mounted with accessories 18 Certification The offered servers are certified for EMC, FCC, UL 19 PC Table PC Table to house the monitor 20 Warranty 03 (Three) Years comprehensive onsite with NBD resolution NB 1 All the Hardware should be with 3 years onsite comprehensive warranty from the date of commissioning 2 Bidders must provide the MAFs (Manufacturer s Authorization Form) for all the equipments quoted in the proposal 3 All the OEMs of the offered product/solution of the bidders must have their owned or authorized service/support centre operational for at least last 3 years in Kolkata Bidders are required to submit their undertaking supported with confirmation of OEM with details of such service centers in Kolkata with contact person, mobile no, address, years of operation of the service centre, supported credentials/orders/customers satisfactory certificate Any non-compliance of the above service/support centre of the OEMs or its authorized partner shall make the proposal as being unresponsive and may lead to disqualification of the proposal The Nodal Agency reserves the right to take appropriate action in this regard WEB GATEWAY SOLUTION AND MANAGEMENT SERVER Page 6 of 6