Critique our internet / web filtering tender spec

[limawhiskey]

I'm inviting you guys to critique the draft specification for the tender of our internet service. Currently we're with the LA but I think we can get better value for money going to the market. This is the first major tender I have been involved in so I want to get it right! Any tips welcome.

 

Current spec:

---

• Install complete and tested by 31 August 2017 and switch over during the October 2017 half term closure period (expected 23rd to 27th October)
  
  • It is vital that the service is in place by the 27th October as no extension to existing provision is possible once notice has been given
    

   

  [*]3 year and 5 year terms considered

  [*]200 Mbps uncontended bandwidth on 1 Gbps bearer connection

  • Please include price to upgrade to 300 Mbps during the contract term expressed as an incremental monthly cost
    

   

  [*]Web filtering provision by user group

  [*]Firewall must be configurable by in house IT team.

  • intrusion prevention, antivirus, antispam and antimalware are desirable features.
    

   

  [*]Back-up line via ADSL – failover should allow only staff traffic

  [*]Extensive experience within the school sector - supply two reference sites.

 

---

So... what have I missed out? Have I been too specific on anything? Could it be clearer?

 

Other points I have been considering:

 

Number of public IP addresses assigned for our use.

/30 – one useable addresses

/29 – block of five usable addresses

/28 – block of 13 usable

 

Should we specify this? I haven't managed a public facing IP address space before but I'm wondering whether we should specify a block of addresses to allow for simpler management of services published to the internet in future. At the moment we only need remote desktop and web server.

 

Service reliability – should we specify e.g. 99.95% uptime? Alternatively this could be a scoring criteria.

 

Thanks

Edited October 18, 2016 by limawhiskey

[zag]

Looks good to me, although you may want to look at the speeds, I think they go from 100mbit to 250mbit in one jump with some providers.

 

We didn't really tender ours, just got 3 prices for an internet line and filtering solution.

 

Went with BT 100mbit for the line and smoothwall for the filtering, both bought separately.

 

Being free from the LEA is the best thing you will ever do, it gives you so much more control

 

EDIT: There is no real need for an ADSL backup line if your getting 99% uptime garantee. We've been with BT for 4 years now and the most it ever went down was 10mins.

EDIT2: You will do well to get that many IP addresses, they are quite stingy these days giving them out. We have 8 I think here.

Edited October 18, 2016 by zag

[pcstru]

[*]Please include price to upgrade to 300 Mbps during the contract term expressed as an incremental monthly cost

You might just want to ensure that such an upgrade can be done within the contract and does not require beginning another 1,3 or 5 year term.

 

Back-up line via ADSL – failover should allow only staff traffic

Ensure this is on an SLA and regularly tested. We tested ours when commissioning but it failed sometime in the 14 months between then and when it was actually needed.

[SchoolsBroadband]

Other things I'd recommend you ask for / consider are

 

Do you want the firewalling / filtering service to be managed / unmanaged?

Do you want an engineer to attend site to install / handover all different services or not?

Do you want to use someone else's hosted firewalls / content filtering devices which should give you hardware resilience? i.e. active / passive, active / active

Are you looking to be able to filter pupils / staff onsite and offsite?

If taking a managed service what's the SLA on support? Are you charged for changes or is it unlimited support?

Are you charged for software upgrades to filtering / firewall?

Do you get full reporting on a per user basis? (needed for prevent duty etc)

Does the ISP charge for things like SMTP server, reverse DNS entries, support IPv6.

 

We've installed thousands of schools Internet, filtering and security solutions so once you've written your tender do let me know and we'd be happy to quote.

 

Thanks

 

Dave

[Opendium_Steve]

So... what have I missed out? Have I been too specific on anything? Could it be clearer?

 

Looks good to me. You may get better prices if you get separate quotes for the web filter and internet connection, but that's obviously more faff for you. Maybe consider specifying any specific internal stuff that the web filter is expected to handle, such as BYOD, whether or not you require real time content inspection, HTTPS interception, etc.

 

Number of public IP addresses assigned for our use.

/30 – one useable addresses

/29 – block of five usable addresses

/28 – block of 13 usable

 

Should we specify this? I haven't managed a public facing IP address space before but I'm wondering whether we should specify a block of addresses to allow for simpler management of services published to the internet in future. At the moment we only need remote desktop and web server.

 

RIPE rules require that you justify the use of any IPv4 addresses, so you may want to include a list of external-facing services you want to run.

 

Also consider requiring IPv6 support from both the internet connection and web filter - its certainly not impossible that you'll be wanting to support v6 within the contract period.

 

Service reliability – should we specify e.g. 99.95% uptime? Alternatively this could be a scoring criteria.

 

I'm not terribly convinced by uptime predictions - no service provider can guarantee uptime, the most they can do is give you some (usually pitiful) compensation if they fail to meet an uptime target.

[gshaw]

Does web filtering filter by category list only or does it have real-time scanning?

Does the web filtering comply with the new guidelines for Safeguarding and PREVENT?

Does the firewall have Layer 7 application awareness?

Does the firewall provided have adequate throughput to run all modules at the max speed of your Internet line?

Does the firewall support redundant lines and automatic failover e.g. can you plug an ADSL line into it as a backup in case yours goes down?

[zag]

Also it might be worth looking at the price increases over previous years.

 

We got caught out with Smoothwall basically doubling their prices over the last 5 years

 

And their support has got a lot worse in that time too. Still a good product though.

[limawhiskey]

Thanks all for your input. The spec has become a bit longer but I am happier with it now:

 

---

Timeline

Install complete and tested by 31 August 2017 and switch over during the October 2017 half term closure period (expected 23rd to 27th October).

It is vital that the service is in place by the 27th October as no extension to existing provision is possible once notice has been given.

 

Contract length

3 year and 5 year terms considered.

 

Features

• Internet service:
  
  • 200 Mbps uncontended bandwidth on 1 Gbps bearer connection.
    
    • Please include price to upgrade to 300 Mbps during the contract term (without extension) expressed as an incremental monthly cost.
      

     

    [*]Public IP address block with sufficient usable addresses for:

    • Web servers
      
    • Remote desktop services
      
    • VPN services
      
    • Mail server
      
    • Remote hardware management
      
    • CCTV monitoring
      

     

    [*]SMTP relay

    [*]Back-up connection using ADSL:

    • Automatic failover with prioritisation e.g. allow only staff traffic
      
    • Active / passive, monitored connection including alerts for link failure (using firewall features or link balancer)
      

     

    [*]IPv6 support

   

  [*]Firewall features:

  • Essential:
    
    • Configurable by in house IT team with support from provider.
      
    • Software updates included during contract.
      

     

    [*]Desirable:

    • Intrusion prevention
      
    • Antivirus / antimalware
      
    • Antispam
      
    • Support for IPv6
      

   

  [*]Web filtering features

  • Essential
    
    • provision by user/group
      
    • reporting by user
      
    • HTTPS inspection
      

     

    [*]Desirable

    • real time inspection
      

   

  [*]General support

  • Engineer assistance with changeover.
    
  • Configuration changes included during contract term e.g. reverse DNS entries.
    
  • Troubleshooting support.
    
  • Software updates to firewall and web filter.
    
  • Clearly defined SLA.
    

   

  [*]Extensive experience within the school sector

  • Supply two reference sites
    

 

---

Edited October 19, 2016 by limawhiskey

[limawhiskey]

There is no real need for an ADSL backup line if your getting 99% uptime garantee. We've been with BT for 4 years now and the most it ever went down was 10mins.

I would agree but I have been asked to ensure we have a backup.

 

- - - Updated - - -

 

You might just want to ensure that such an upgrade can be done within the contract and does not require beginning another 1,3 or 5 year term.

Thanks, that was what I intended but I have made that more clear.

[limawhiskey]

Do you want the firewalling / filtering service to be managed / unmanaged?

I take it you mean software upgrades / troubleshooting, that sort of thing? I have tried to make that a bit clearer in the updated spec.

 

We've installed thousands of schools Internet, filtering and security solutions so once you've written your tender do let me know and we'd be happy to quote.

Thanks Dave, will do.

[limawhiskey]

RIPE rules require that you justify the use of any IPv4 addresses, so you may want to include a list of external-facing services you want to run.

Thanks. I have spec'ed a few services that we have, plus some I expect to have running on the new connection.

[SchoolsBroadband]

a few more things

 

Do you want ADSL backup to be on a completely separate router for extra redundancy?

Do you want a higher care level on a single router? i.e. man to site within 4 hours in case of router failure?

Do you want 2 factor authentication for VPN and / or other remote services?

 

I'm sure I'll think of more

 

Dave

[simpsonj]

My advice would be to get it installed and switched over the summer holiday, even if it means you're paying for the old service and the new service at the same time. If there's any mistake/illness/communication error that means the switch can't happen over the October half term, you'll be without internet, whereas if it falls through over the summer, you've still got the October half term to fall back on.

 

Otherwise it looks good, though be sure what groups you want the web filter to pick up on, I'm assuming Active Directory groups, but just make it clear how you want it to work.

[Wave9_Lee]

Hi there,

 

One thing I would say is that whilst it's good to be clear about what you need/want in a tender document, it's also sensible not to be too prescriptive in some areas - i.e. by doing so you might exclude some bidders or solutions that would provide a great solution, but don't quite tick that niche box that you've inadvertently specified.

 

I disagree with the 'don't need back-up' comments, yes leased line and EoFttC have good availability, but if there's a fibre cut in the vicinity, the service could be down for a considerable time, despite what your SLA says - a back up is like insurance, people who never claim resent paying it, but those that needed it are always thankful.

 

We can send you a comprehensive evaluation document that might help with your thinking and ensure you have covered off all the key areas if you would like - drop me a PM

 

We'd obviously be happy to submit a bid if asked,

 

cheers

 

Lee