تطوير انظمة الجدار الناري لديوان رئاسة أمن الدولة

رقم المنافسة

210739386348

رقم المنافسة الداخلي

2021-109م

الجهة الحكومية

الديوان العام لرئاسة أمن الدولة

الفرع / الإدارة

المنافسات

نوع المنافسة

منافسة عامة

حالة المنافسة

—

طريقة تقديم العروض

—

رسوم الاشتراك

500 ر.س

سعر كراسة الاشتراط

200 ر.س

تكلفة الدعوة

200 ر.س

تكلفة الشراء

500 ر.س

الضمان الإبتدائي

—

الضمان النهائي

—

مدة العقد

—

التأمين مطلوب

—

مدة الوقفة (أيام)

—

داخل المملكة

—

التاريخ	ميلادي	هجري
تاريخ النشر	2021/07/13 10:03	—
آخر موعد للاستفسارات	2021/07/29	1442-12-19
آخر موعد تقديم العروض	2021/08/03 15:00	1442-12-24
موعد فتح العروض	2021/08/04 10:00	1442-12-25
موعد فحص العروض	—	—
التاريخ المتوقع للترسية	—	—
تاريخ بدء الأعمال	—	—
تاريخ خطاب تأكيد المشاركة	—	—
بداية إرسال الأسئلة	—	—

موقع التنفيذ

منطقة التنفيذ

—

مدن التنفيذ

—

مجال التصنيف

يشمل مواد توريد

لا

جدول 1 المواد - توريد عام

البند	الفئة	الكمية	وصف البند	المواصفات	وحدة القياس
1	تقنية معلومات	30	الجدار الناري PA-220 من الشركة المصنعة مع كابل الجدار الناري	الجدار الناري Firewall throughput (App-ID, appmix) is 540 MbpsThe proposed firewall must be ML enabled and must use in-line machine learning models to help prevent previously unknown attacks inline on the firewall itself. The proposed firewall must provide up to 95% of unknown file and web-based threats instantly on the box itself and automate policy recommendations. The proposed firewall must be able to receive Threat and Signature Updates in Realtime where the updates should be received no longer than 9 seconds. Proposed Firewall must be recognized as leader in Gartner Enterprise Network Firewall Report for 2019, 2018, 2017,2016, 2015, 2014 and 2013 consecutively. The proposed firewalls must have one mode of operation, and any other firewall solutions that have two, or more of operation modes like (proxy, or flow modes) are going to be disqualified Proposed firewalls must support all functions are working in parallel when all features are enabled including Application identification (APP-ID), User identification (User-ID) and Threat Prevention (IPS, Anti-Virus, and Anti-Spyware) and URL Filtering. Proposed Firewalls must be built based on a unique Single Pass Parallel Processing (SP3) Architecture which enables high-throughput, low-latency Network security, even while incorporating unprecedented features and technology Proposed Firewalls must be manufactured in USA, and Export from USA to KSA directly. Dedicated High Availability ports to provide full hardware redundancy in an active/passive or active/active configurations. The proposed firewalls must allow policy rule creation for application identification, user identification, threat prevention, Uniform Resource Locator (URL) filtering, traffic management Quality of Service (QoS) per policy and scheduling in a single unified rule and not in multiple data-entry locations in the management console. The proposed firewalls must have the hardened Operating System (OS) and built as a firewall appliance (i.e. not on generic server hardware) The proposed firewalls must be administered locally on the appliance even if centralized management is used. The proposed firewalls must support multiple logically separated virtual systems or contexts on a physical firewall. The proposed firewall must integrate with external dynamic list of IP addresses, domains, or URLs hosted on an external web server. Administrators can configure the firewall to periodically import an external dynamic list and block or allow traffic based on its contents. The firewall must provide more visibility into the contents of the external dynamic list and the list entries currently used in policy. External dynamic lists must give administrators the flexibility to choose list entries to exclude before using a list to enforce policy. The firewall must support authentication measures to use external dynamic lists more securely. The proposed firewalls must support virtual wire and tap mode within the appliance. The proposed firewalls must support in-box logging and reporting mechanism to generate comprehensive reports like “but not limited to” (User Activity Reports, Top Applications, Top Attackers, Top victims, Applications running in port 80…) The proposed firewall must store reports on HDD and have the ability to schedule PDF report generation and send it over email The proposed firewalls must synchronize all sessions, decryption certificates, all GP security associations, all threat and application signatures, all configuration changes and Forwarding Information Base (FIB) tables for HA The proposed firewall must be able to trigger an action or initiate a workflow on an external HTTP-based service when a log is generated on the firewall. This will be used to better integrate between the firewall and IT infrastructure. The firewall must be able to send an HTTP-based API request directly to a third-party service to trigger an action based on the attributes in a firewall log. The proposed firewalls must warn the end-user with a customizable page when the application is blocked. The proposed firewalls must support Network traffic classification, which identifies applications across all ports irrespective of port/protocol/evasive tactics. The proposed firewalls must have multiple mechanisms for classifying applications and application identification technology based upon Intrusion Prevention System (IPS) or deep packet inspection. The proposed firewalls must include a searchable list of currently identified applications with explanation and links to external sites for further clarification. Proposed Firewall Solution must support File blocking feature to alert or block on upload and/or download any file type, this feature must be enabled without any additional license. It must be optimized for layer 7 application level content processing and have special processing unit to handle signature matching and processing in a single pass parallel processing architecture. The proposed firewall must provide malicious IP address feeds that can be used to secure our Networkwork from known malicious hosts on the InterNetwork. The firewall must provide two feeds: - Known malicious IP addresses —Contains IP addresses that the firewall vendor has verified as malicious. - High risk IP addresses —Contains malicious IP addresses from threat advisories issued by trusted third-party organizations. The proposed firewall must support Data filtering feature that works with third- party, endpoint DLP solutions that populate file properties to indicate sensitive content, enabling the firewall to enforce DLP policy. The proposed firewalls must support file identification and control by signature and not file extensions. The proposed firewalls must unpack zipped file for packet inspection. The proposed Modern Malware Prevention solution must support files exchanged over Web, Email, and file sharing traffic. The proposed firewall must support credential phishing (theft) prevention to identify and prevent in-progress phishing attacks by controlling sites to which users can submit corporate credentials based on the site’s URL category. This feature must integrate with User-ID (group mapping or user mapping, depending on which method you choose to detect credentials) to enable the firewall to detect when users are attempting to submit their corporate username and or username and password and block the submission The proposed firewalls must support user-identification allowing AD, LDAP, RADIUS groups, or users to access a particular application, while denying others. The proposed firewalls must support logs populated with end user activity reports for site monitoring within the local firewall. The proposed firewalls must populate and correlate all logs with user identity (traffic, IPS, URL, data, etc) without any additional products or modules in real- time. The proposed firewalls must be able to identify, decrypt and evaluate SSL/SSH traffic in an outbound and inbound connection. The proposed firewalls must be able to decrypt in tap, transparent, layer 2 and layer 3 modes. The proposed firewall must support forwarding copy of SSL Decrypted traffic to external device The proposed firewalls must support policy based Networkwork Address Translation (NAT) and Port Address Translation (PAT) and able to operate in routing/NAT mode. The proposed firewalls must support Denial of Service (DoS) and fragmented packet Transmission Control Protocol (TCP) reassembly, brute force attack, “SYN cookie”, “IP spoofing” and malformed packet protection. The proposed firewalls must support 802.1Q Virtual Local Area Network works (VLANs) tagging (in tap, transparent, layer 2 and layer 3). The proposed firewalls shall support dual IPv4 and IPv6 stacks application control and threat inspection support in The proposed firewall must support Virtual Wire deployment (Transparent with no MAC address distribution) The proposed firewall must support L2, L3 Interfaces at the same time using single virtual system The proposed firewall must support TAP mode. The proposed firewalls must support standards based link aggregation (IEEE 802.3ad) to achieve higher bandwidth. The proposed firewalls must support logical EtherNetwork sub-interfaces tagged and untagged. The proposed firewalls must support static, Routing Information Protocol version 2 (RIPv2), Open Shortest Path First (OSPF) and Border Gateway Protocol version 4 (BGPv4) routing protocols. The proposed firewalls must support policy based forwarding based on zone, source or destination address, source or destination port, application and Active Directory (AD)/ Lightweight Directory Access Protocol (LDAP) Remote Authentication Dial-In User Service (RADIUS) user or user groups. The proposed firewalls must support Domain Name System (DNS) proxy and Dynamic Host Configuration Protocol for IPv6 (DHCPv6) relay The proposed firewalls must support IPv6 routing for virtual routers. The proposed firewall solution must be capable of detecting link and path failure in addition to device failure Threat Prevention throughput (appmix) is 320 Mbps IPsec VPN throughput is 540 Mbps New sessions per second is 4,300 Maximum number of sessions is 64,000 The product should have (1 Base Virtual System) The product should Contain "RJ45 10/100/1000 (8)" data interfaces The product should Contain RJ45 10/100/1000 out-of-band management (1), RJ-45 console (1), USB (1), Micro USB console (1) with Power cord for United Kingdom with IEC-60320 C13 and BS 1363 UK13 cord ends, 10A, 250V max, 6ft	عدد
2	تقنية معلومات	30	رخص الحماية من الفيروسات والتهديدات من الشركة المصنعة لمدة 3 سنوات Threat prevention subscription 3-year prepaid, PA-220	رخص الحماية من الفيروسات والتهديدات من الشركة المصنعة لمدة 3 سنوات Threat prevention subscription 3-year prepaid, PA-220	عدد
3	تقنية معلومات	30	رخصة الدعم الفني من الشركة المصنعة لمدة 3 سنوات Premium support 3-year prepaid, PA-220	الدعم الفني من الشركة المصنعة لمدة 3 سنوات Premium support 3-year prepaid, PA-220	عدد
4	تقنية معلومات	10	جهاز الجدار الناري PA-820 من الشركة المصنعة مع كابل الجدار الناري	The proposed firewall must be ML enabled and must use in-line machine learning models to help prevent previously unknown attacks inline on the firewall itself. The proposed firewall must provide up to 95% of unknown file and web-based threats instantly on the box itself and automate policy recommendations. The proposed firewall must be able to receive Threat and Signature Updates in Realtime where the updates should be received no longer than 9 seconds. Proposed Firewall must be recognized as leader in Gartner Enterprise Network Firewall Report for 2019, 2018, 2017,2016, 2015, 2014 and 2013 consecutively. The proposed firewalls must have one mode of operation, and any other firewall solutions that have two, or more of operation modes like (proxy, or flow modes) are going to be disqualified Proposed firewalls must support all functions are working in parallel when all features are enabled including Application identification (APP-ID), User identification (User-ID) and Threat Prevention (IPS, Anti-Virus, and Anti-Spyware) and URL Filtering. Proposed Firewalls must be built based on a unique Single Pass Parallel Processing (SP3) Architecture which enables high-throughput, low-latency Network security, even while incorporating unprecedented features and technology Proposed Firewalls must be manufactured in USA, and Export from USA to KSA directly. Dedicated High Availability ports to provide full hardware redundancy in an active/passive or active/active configurations. The proposed firewalls must allow policy rule creation for application identification, user identification, threat prevention, Uniform Resource Locator (URL) filtering, traffic management Quality of Service (QoS) per policy and scheduling in a single unified rule and not in multiple data-entry locations in the management console. The proposed firewalls must have the hardened Operating System (OS) and built as a firewall appliance (i.e. not on generic server hardware) The proposed firewalls must be administered locally on the appliance even if centralized management is used. The proposed firewalls must support multiple logically separated virtual systems or contexts on a physical firewall. The proposed firewall must integrate with external dynamic list of IP addresses, domains, or URLs hosted on an external web server. Administrators can configure the firewall to periodically import an external dynamic list and block or allow traffic based on its contents. The firewall must provide more visibility into the contents of the external dynamic list and the list entries currently used in policy. External dynamic lists must give administrators the flexibility to choose list entries to exclude before using a list to enforce policy. The firewall must support authentication measures to use external dynamic lists more securely. The proposed firewalls must support virtual wire and tap mode within the appliance. The proposed firewalls must support in-box logging and reporting mechanism to generate comprehensive reports like “but not limited to” (User Activity Reports, Top Applications, Top Attackers, Top victims, Applications running in port 80…) The proposed firewall must store reports on HDD and have the ability to schedule PDF report generation and send it over email The proposed firewalls must synchronize all sessions, decryption certificates, all GP security associations, all threat and application signatures, all configuration changes and Forwarding Information Base (FIB) tables for HA The proposed firewall must be able to trigger an action or initiate a workflow on an external HTTP-based service when a log is generated on the firewall. This will be used to better integrate between the firewall and IT infrastructure. The firewall must be able to send an HTTP-based API request directly to a third-party service to trigger an action based on the attributes in a firewall log. The proposed firewalls must warn the end-user with a customizable page when the application is blocked. The proposed firewalls must support Network traffic classification, which identifies applications across all ports irrespective of port/protocol/evasive tactics. The proposed firewalls must have multiple mechanisms for classifying applications and application identification technology based upon Intrusion Prevention System (IPS) or deep packet inspection. The proposed firewalls must include a searchable list of currently identified applications with explanation and links to external sites for further clarification. Proposed Firewall Solution must support File blocking feature to alert or block on upload and/or download any file type, this feature must be enabled without any additional license. It must be optimized for layer 7 application level content processing and have special processing unit to handle signature matching and processing in a single pass parallel processing architecture. The proposed firewall must provide malicious IP address feeds that can be used to secure our Networkwork from known malicious hosts on the InterNetwork. The firewall must provide two feeds: - Known malicious IP addresses —Contains IP addresses that the firewall vendor has verified as malicious. - High risk IP addresses —Contains malicious IP addresses from threat advisories issued by trusted third-party organizations. The proposed firewall must support Data filtering feature that works with third- party, endpoint DLP solutions that populate file properties to indicate sensitive content, enabling the firewall to enforce DLP policy. The proposed firewalls must support file identification and control by signature and not file extensions. The proposed firewalls must unpack zipped file for packet inspection. The proposed Modern Malware Prevention solution must support files exchanged over Web, Email, and file sharing traffic. The proposed firewall must support credential phishing (theft) prevention to identify and prevent in-progress phishing attacks by controlling sites to which users can submit corporate credentials based on the site’s URL category. This feature must integrate with User-ID (group mapping or user mapping, depending on which method you choose to detect credentials) to enable the firewall to detect when users are attempting to submit their corporate username and or username and password and block the submission The proposed firewalls must support user-identification allowing AD, LDAP, RADIUS groups, or users to access a particular application, while denying others. The proposed firewalls must support logs populated with end user activity reports for site monitoring within the local firewall. The proposed firewalls must populate and correlate all logs with user identity (traffic, IPS, URL, data, etc) without any additional products or modules in real- time. The proposed firewalls must be able to identify, decrypt and evaluate SSL/SSH traffic in an outbound and inbound connection. The proposed firewalls must be able to decrypt in tap, transparent, layer 2 and layer 3 modes. The proposed firewall must support forwarding copy of SSL Decrypted traffic to external device The proposed firewalls must support policy based Networkwork Address Translation (NAT) and Port Address Translation (PAT) and able to operate in routing/NAT mode. The proposed firewalls must support Denial of Service (DoS) and fragmented packet Transmission Control Protocol (TCP) reassembly, brute force attack, “SYN cookie”, “IP spoofing” and malformed packet protection. The proposed firewalls must support 802.1Q Virtual Local Area Network works (VLANs) tagging (in tap, transparent, layer 2 and layer 3). The proposed firewalls shall support dual IPv4 and IPv6 stacks application control and threat inspection support in The proposed firewall must support Virtual Wire deployment (Transparent with no MAC address distribution) The proposed firewall must support L2, L3 Interfaces at the same time using single virtual system The proposed firewall must support TAP mode. The proposed firewalls must support standards based link aggregation (IEEE 802.3ad) to achieve higher bandwidth. The proposed firewalls must support logical EtherNetwork sub-interfaces tagged and untagged. The proposed firewalls must support static, Routing Information Protocol version 2 (RIPv2), Open Shortest Path First (OSPF) and Border Gateway Protocol version 4 (BGPv4) routing protocols. The proposed firewalls must support policy based forwarding based on zone, source or destination address, source or destination port, application and Active Directory (AD)/ Lightweight Directory Access Protocol (LDAP) Remote Authentication Dial-In User Service (RADIUS) user or user groups. The proposed firewalls must support Domain Name System (DNS) proxy and Dynamic Host Configuration Protocol for IPv6 (DHCPv6) relay The proposed firewalls must support IPv6 routing for virtual routers. The proposed firewall solution must be capable of detecting link and path failure in addition to device failure Firewall throughput (App-ID, appmix) is 1.6 Gbps Threat Prevention throughput (appmix) is 900 Mbps IPsec VPN throughput is 1.3 Gbps New sessions per second is 8,600 Maximum number of sessions is 128,000 The product should have (1 Base Virtual System) The product should Contain "RJ45 10/100/1000 (4), SFP (8)" data interfaces The product should Contain RJ45 10/100/1000 out-of-band management (1), 10/100/1000 high availability (2), RJ-45 console (1), USB (1), Micro USB console (1) with Power cord for United Kingdom with IEC-60320 C13 and BS 1363 UK13 cord ends, 10A, 250V max, 6ft	عدد
5	تقنية معلومات	10	Threat prevention subscription 3-year prepaid, PA-820رخص الحماية من الفيروسات والتهديدات من الشركة المصنعة لمدة 3 سنوات	Threat prevention subscription 3-year prepaid, PA-820رخص الحماية من الفيروسات والتهديدات من الشركة المصنعة لمدة 3 سنوات	عدد
6	تقنية معلومات	10	رخصة الدعم الفني من الشركة المصنعة لمدة 3 سنوات Premium support 3-year prepaid, PA-820	الدعم الفني من الشركة المصنعة لمدة 3 سنوات Premium support 3-year prepaid, PA-820	عدد
7	تقنية معلومات	20	محولات توصيل الياف ضوئية SFP form factor, SX 1Gb optical transceiver, 550m reach on OM2 MMF, duplex LC, IEEE 802.3z 1000BASE-SX compliant	محولات توصيل الياف ضوئية SFP form factor, SX 1Gb optical transceiver, 550m reach on OM2 MMF, duplex LC, IEEE 802.3z 1000BASE-SX compliant	عدد