NOTICE INVITING TENDER FOR THE TURNKEY PROJECT OF …tenders/uploads/AMC-FIREWALL-FINAL-2016.pdf ·...

Page 1 of 35

HARISH-CHANDRA RESEARCH INSTITUTE (Department of Atomic Energy, Government of India)

Chhatnag Road, Jhunsi, Allahabad-211 019 Phone: 0532-2274395

NOTICE INVITING TENDER FOR THE TURNKEY PROJECT OF

ANNUAL OPERATION, MAINTENANCE AND SERVICE CONTRACT FOR RUNNING THE IT / COMPUTER INFRASTRUCTURAL AND

FIREWALL SERVICES AND ITS ASSOCIATED SOFTWARE AND HARDWARE OF THE INSTITUTE

ON OPEN SOURCE / OPENBSD AND LINUX ALONG WITH THE POSTING OF HIGHLY TRAINED AND EXPERIENCED ON-SITE RESIDENT ENGINEER

AT HARISH-CHANDRA RESEARCH INSTITUTE, JHUNSI, ALLAHABAD

TWO BID SYSTEM

NIT No HRI/9/2016 Date: 31-5-2016

Sealed Tenders are invited on behalf of the Director, Harish-Chandra Research Institute, Allahabad from the Registered Firm / OEM / Authorised dealer / System Integrator for the Turnkey Project of Annual Operation, Maintenance and Service Contract for running the IT / Computer Infrastructural and Firewall Services and its associated Software and Hardware of the Institute on Open Source / OpenBSD and Linux along with the posting of highly trained and experienced on-site Resident Engineer at Harish-Chandra Research Institute, Allahabad. Tender documents are available on the HRI web site (http://www.hri.res.in/tenders/). Prospective bidders may download the tender document from 6-6-2016 from the HRI’ s Website www.hri.res.in/tenders/ and submit their offers latest by 3 PM on 15-7-2016 to the Registrar, Harish-Chandra Research Institute, Chhatnag Road, Jhunsi, Allahabad – 211019 along with the Demand Draft for the tender cost of Rs. 300/- (non-refundable) drawn in favour of Registrar, Harish-Chandra Research Institute, Allahabad. For any clarification please contact Systems Manager, HRI at 0532-2274395 or at [email protected] The tender document consists of the following two parts:-

Part-1(A to C) “TERMS & CONDITIONS” & “TECHNICAL BID” of the tender Part-2 “FINANCIAL BID” of the tender

The main information is as follows:-

TITLE Notice Inviting Tender for the Turnkey Project of Annual Operation, Maintenance and Service Contract for running the IT / Computer Infrastructural and Firewall Services and its associated Software and Hardware of the Institute on Open Source / OpenBSD and Linux along with the posting of highly trained and experienced on-site Resident Engineer

BID REFERENCE No HRI/9/2016 dated 31-5-2016

LAST DATE AND TIME FOR SUBMISSION OF BIDS 15-7-2016 UPTO 1500 HRS

DATE AND TIME OF OPENING OF TECHNICAL BIDS 15-7-2016 At 1530 HRS

PLACE OF OPENING OF BIDS Harish-Chandra Research Institute Chhatnag Road, Jhunsi, Allahabad – 211019

ADDRESS FOR COMMUNICATION Computer Centre Harish-Chandra Research Institute, Chhatnag Road, Jhunsi, Allahabad – 211019

For any communication regarding this tender, kindly mention Bid Reference No (HRI/9/2016) on the main envelop of the correspondence

BID SECURITY (EMD) Rs. 20,000.00

It will be the responsibility of the bidders to check website http://www.hri.res.in for any amendment through corrigendum in the tender document. In case of any amendment, bidders will have to incorporate the amendments in their bid accordingly.

This Document Contains – 35 Pages

Page 2 of 35



Please superscribe the Title (Turnkey Project of Annual Operation, Maintenance and Service Contract for running the IT / Computer Infrastructural and Firewall Services and its associated Software and Hardware of the Institute on Open Source / OpenBSD and Linux along with the posting of highly trained and experienced on-site Resident

Engineer), NIT number (HRI/9/2016) and date of opening of the Technical Bids (15-7-2016) on the sealed cover to avoid the Bid being declared invalid. The Tender, complete in all respects should be submitted up to 1500HRS on 15-7-2016 which shall be opened on the same day at 1530HRS in presence of parties present at the time of opening of Tender. The sealed envelope of the bidders containing Part-1 "Terms & Conditions" and "Technical bid” shall be opened on 15-7-2016 at 1530 HRS. One representative of each vendor may participate at the time of opening the bids. The Part -2 “Financial Bid” of only those parties who qualify in Part -1 will be opened on a later date. The date of opening will be informed to each qualified party separately. The bidders may depute their representative, duly authorized in writing, to attend the opening of bids on the due date and time. Rate and important commercial / technical clauses quoted by the all the Bidders will read out in the presence of the representatives of all the Bidders. This event will not be postponed due to non-presence of your representative. The Earnest Money Deposit indicated should be enclosed alongwith the terms & conditions duly signed and stamped in the form of Account payee Demand Draft / Pay Order / Bank Draft / Bank Guarantee issued by any nationalized bank / Scheduled bank. Format of bank guarantee is annexed. Account payee Demand Draft / Pay Order / Bank Draft should be in favour of “Registrar, Harish-Chandra Research Institute, payable at Allahabad” in a separate sealed envelope. No exemption in earnest money shall be given. All tenders submitted without requisite amount of earnest money shall be rejected and their financial bids shall not be opened.

……….sd………. (Ravindra Singh) Registrar

Page 3 of 35



NIT No HRI/9/2016 Date: 31-5-2016

Sealed Tenders are invited on behalf of the Director, Harish-Chandra Research Institute, Allahabad from the Registered Firm / OEM / Authorised dealer / System Integrator for the Turnkey Project of Annual Operation, Maintenance and Service Contract for running the IT / Computer Infrastructural and Firewall Services and its associated Software and Hardware of the Institute on Open Source / OpenBSD and Linux along with the posting of highly trained and experienced on-site Resident Engineer at Harish-Chandra Research Institute, Allahabad. Tender documents are available on the HRI web site (http://www.hri.res.in/tenders/). Prospective bidders may download the tender document from 6-6-2016 from the HRI’s Website www.hri.res.in/tenders/ and submit their offers latest by 3 PM on 15-7-2016 to the Registrar, Harish-Chandra Research Institute, Chhatnag Road, Jhunsi, Allahabad – 211019 along with the Demand Draft for the tender cost of Rs. 300/- (non-refundable) drawn in favour of Registrar, Harish-Chandra Research Institute, Allahabad. No separate corrigendum will be published in the newspapers. Therefore, interested bidders need to visit the HRI web site on a regular basis for updates. For EMD amount and other details of the tender, refer the tender document published on the HRI website. For any clarification please contact Systems Manager, HRI at 0532-2274395 or at [email protected].

………..Sd……………

Registrar, HRI, Allahabad

Page 4 of 35



PART – 1(A)

TERMS & CONDITIONS

FOR THE TURNKEY PROJECT OF

ANNUAL OPERATION, MAINTENANCE AND SERVICE CONTRACT FOR RUNNING THE IT / COMPUTER INFRASTRUCTURAL AND

FIREWALL SERVICES AND ITS ASSOCIATED SOFTWARE AND HARDWARE OF THE INSTITUTE

ON OPEN SOURCE / OPENBSD AND LINUX ALONG WITH THE POSTING OF HIGHLY TRAINED AND EXPERIENCED ON-SITE RESIDENT ENGINEER

AT HARISH-CHANDRA RESEARCH INSTITUTE, JHUNSI, ALLAHABAD

1. Last date and time for depositing the Bids:- 1500HRS 15-7-2016 The sealed Bids should be deposited/reach by the due date and time. The responsibility to ensure this lies with the Bidder. 2. Manner of depositing the Bids:- Sealed Bids should be either dropped in the Tender Box marked as Registrar Harish Chandra Research Institute or sent by registered post at the address given below so as to reach by the due date and time. Late / Delayed tenders will not be considered. Printed conditions of the vendor submitted with the tender will not be binding on Harish Chandra Research Institute. No responsibility will be taken for postal delay or non-delivery / non-receipt of Bid documents. Bids sent by FAX or e-mail will not be considered. Please superscribe the above mentioned Title, NIT number and date of opening of the Bids on the sealed cover to avoid the Bid being declared invalid.

Address: Registrar, Harish Chandra Research Institute Deptt of Atomic Energy, Government of India Chhatnag Road, Jhunsi, Allahabad-211019

3. Time and date for opening of Bids:- 1530 HRS 15-7-2016 (If due to any exigency, the due date for opening of the Bids is declared a closed holiday, the Bids will be opened on the next working day at the same time or on any other day/time, as intimated by the Buyer). 4. Location of the Tender Box:- Harish Chandra Research Institute Room No 106 Chhatnag Road Jhunsi, Allahabad (UP) Only those Bids that are found in the tender box will be opened. Bids dropped in the wrong Tender Box will be rendered invalid. 5. Place of opening of the Bids:- Conference Hall or any other place of Harish Chandra Research Institute. Place will be intimated by the Reception staff of the institute. The Bidders may depute their representatives, duly authorized in writing, to

Page 5 of 35



attend the opening of Bids on the due date and time. Rates and important commercial/technical clauses quoted by all Bidders will be read out in the presence of the representatives of all the Bidders. This event will not be postponed due to non-presence of your representative. 6. Two Bid System:- Only the Technical Bid would be opened on 15-7-2016 Time 1530 HRS. Date of opening of Commercial Bid will be intimated after acceptance of the Technical Bids. Commercial Bids of only those firms will be opened, whose Technical Bids are found compliance / suitable after Technical Evaluation is done by the Institute. 7. Forwarding of Bids:- Bids should be forwarded by Bidders under their original memo / letter pad inter alia furnishing details like TIN number, VAT/CST number, etc and complete postal & e-mail address of their office. 8. Clarification regarding contents of the NIT:- A prospective bidder who requires clarification regarding the contents of the bidding documents shall notify to the Buyer in writing about the clarifications sought not later than 14 (fourteen) days prior to the date of opening of the Bids. Copies of the query and clarification by the purchaser will be sent to all prospective bidders who have received the bidding documents. 9. Modification and Withdrawal of Bids:- A bidder may modify or withdraw his bid after submission provided that the written notice of modification or withdrawal is received by the Buyer prior to deadline prescribed for submission of bids. A withdrawal notice may be sent by fax but it should be followed by a signed confirmation copy to be sent by post and such signed confirmation should reach the purchaser not later than the deadline for submission of bids. No bid shall be modified after the deadline for submission of bids. No bid may be withdrawn in the interval between the deadline for submission of bids and expiration of the period of bid validity specified. 10. Clarification regarding contents of the Bids: During evaluation and comparison of bids, the Buyer may, at its discretion, ask the bidder for clarification of his bid. The request for clarification will be given in writing and no change in prices or substance of the bid will be sought, offered or permitted. No post-bid clarification on the initiative of the bidder will be entertained. 11. Rejection of Bids: Canvassing by the Bidder in any form, unsolicited letter and post-tender correction may invoke summary rejection with forfeiture of EMD. Conditional tenders will be rejected. 12. Validity of Bids: The Bids should remain valid till 120 days from the last date of submission of the Bids. 13. Bid Security/Earnest Money Deposit (EMD):-

13.1 Bidders are required to submit Earnest Money Deposit (EMD) for amount of Rs 20,000/- (Rupees Twenty Thousand only) along with their bids. The EMD may be submitted in the form of Account payee Demand Draft / Pay Order / Bank Draft / Bank Guarantee issued by any nationalized bank / Scheduled bank. Format of bank guarantee is annexed with this NIT. Account payee Demand

Page 6 of 35



Draft / Pay Order / Bank Draft should be in favour of “Registrar, Harish-Chandra Research Institute, payable at Allahabad” in a separate sealed envelope. No exemption in earnest money shall be given. All tenders submitted without requisite amount of earnest money shall be rejected and their financial bids shall not be opened. EMD is to remain valid for a period of forty-five days beyond the final bid validity period. EMD of the unsuccessful bidders will be returned to them at the earliest after expiry of the final bid validity and latest on or before the 30th day after the award of the contract. The Bid Security of the successful bidder would be returned, without any interest whatsoever, after the receipt of Performance Security from them as called for in the Purchase Order / contract. The EMD will be forfeited if the bidder withdraws or amends, impairs or derogates from the tender in any respect within the validity period of their tender

13.2 As per rule 157(a) of GFR, bidders who are registered with the Central Purchase Organization, National Small Industries Corporation (NSIC) or the concerned Ministry or Department are exempted from submission of EMD as per provisions of their registration.

13.3 The units registered under Single Point Registration Scheme of NSIC are also exempted from tender document price.

13.4 In addition to the above, no other benefit/preference shall be provided. In case of a bidder who avails the above facility becomes defaulter in any form mentioned in the tender which could have led to forfeiting of the EMD, his case will be referred to the agency from where he is registered and availing the above benefits, for necessary action including claim of the demurrages/other claims under the provisions of the tender.

14. Eligibility Criteria: Interested parties who fulfill the following criteria are only eligible for submitting the bids:-

14.1 The vendor should have proven track records and should be at least 5 year old company. Attach documents in support of 5 year old company. Attach satisfactory work certificate of similar work as mentioned in the Part-1 (C) of the tender from other organizations.

14.2 The vendor should have worked in open-source domain / OpenBSD and Linux environment. Attach documentary evidence.

14.3 The vendor should have added patches/modules to existing popular open-

source modules.

14.4 The vendor should have served the Research Labs, Research Institutes, Academic institutions, universities and other institutions under State Government / Government of India. Vendor should attach at least one work order for similar work under Open-Source / OpenBSD / Linux environment.

Page 7 of 35



14.5 The vendor should have enough highly trained and experienced

manpower to work on Open-source / OpenBSD and Linux platform and other open source software. The manpower should have proper degree qualification and should have at least 3 year experience working on Open-source / OpenBSD and Linux environment. Give undertaking for having 3 year experienced manpower on open-source / OpenBSD and Linux. The manpower must have basic knowledge of open source, OpenBSD and Linux operating systems.

14.6 The vendor will be bound to reinstall, reconfigure and re-commission

one or all the services at any given point throughout the entire contract period as per time-to-time requirements to run the services smoothly on the hardware covered under this contract and on any other hardware / server provided by HRI at any given point. The vendor should give undertaking that they will do all the work listed anywhere in the tender document.

14.7 One fully qualified trained and experienced Resident Engineer with

adequate qualification of B.Tech / MCA and with minimum three year experience on OpenBSD and Linux should be posted onsite at HRI between 9 AM and 6 PM, 5 days a week, Monday to Friday and on call basis round the clock (day/night) for the entire period of contract and service support for maintaining the services and fine tuning the services mentioned under PART -1 (C) “services and scope of work/proposed scope of work” as and when required. Engineer’s technical capability/competency of handling the technical requirements under the contract will be evaluated at the time of deployment and time-to-time in future by Computer Centre, HRI and if found unsuitable anytime, HRI may ask for the substitution of the Resident Engineer having more competency. Party can change the Resident Engineer only after taking the permission from HRI and by posting the substitute Resident Engineer with equal or better competence, qualification and experience. Since posting of qualified and experienced Resident Engineer is an important component of the Turnkey Project Contract for maintaining the services without fail, hence the Engineer should be qualified as per the above requirements and suitably paid as per the market rate by the vendor. Give undertaking of posting such competent Resident Engineer.

14.8 Registered with Sales Tax / with TIN No. Must have registered

shop/office/show room. Please attach relevant documentary proofs.

Note: 1. Vendor who does not comply properly for the above eligibility criteria and does not submit the required certificates / documents will not be considered.

2. Vendor should give compliance of all the above points in a separate sheet and attach that along with the tender document.

Page 8 of 35



3. Posting of Resident Engineer without fulfilling the above mentioned Residents Engineer’s criteria may lead to the cancellation of the bid or contract and the firm may be debarred from participating in future.

15. The following Turnkey Project Contract clause will form part of the contract placed on successful Bidder:-

(a) The Service provider would provide comprehensive Turnkey Project

Contract initially for a period of Three years and the contract may be extended on mutually agreed terms for one/two/three more years or more. The contract may be

terminated by either side anytime by serving one month notice subject to satisfactory performance of the firm. The Turnkey Project Contract services would be provided in two distinct ways:

(i) Preventive Maintenance Service: The Turnkey Project Contractor will provide a minimum of four Preventive Maintenance Service visits during a year to the institute to carry out functional checkups and minor adjustments/ tuning as may be required. For this they have to inform HRI one week in advance. This is in addition to the clause of posting one highly trained and experienced on-site Resident Engineer as per the eligibility clause No. 14.7.

(ii) Breakdown maintenance Service: In case of any breakdown of the equipment/system, on receiving a call from the Institute, the Contractor is to provide maintenance service to take the equipment/system serviceable.

(b) Response time: The response time of the Contractor should not exceed 12 hours from the time the breakdown intimation is provided by the Institute. (c) Serviceability of 99% per year is to be ensured. This amounts to total maximum downtime of 07 days per year. Also unserviceability should not exceed 01 days at one time. Required spares to attain this serviceability may be stored at site by the firm at his own cost. Total down time would be calculated at the end of the year. If downtime exceeds permitted downtime, LD would be applicable for the delayed period. (d) Maximum repair turnaround time for equipment/system would be 02 days. However, the spares should be maintained in a serviceable condition to avoid complete breakdown of the equipment/system. (e) Technical Documentation: All necessary changes in the documentation (Technical and Operators manual) for changes carried out on hardware and software of the equipment will be provided.

Page 9 of 35



(f) During the Turnkey Project Contract period, the firm shall carry out all necessary servicing/repairs to the equipment/system under Turnkey Project

Contract at the Harish Chandra Research Institute. Prior permission of the authority of the institute would be required in case certain components/sub systems are to be shifted out of location. (g) The Institute reserves its right to terminate the maintenance contract at any time without assigning any reason after giving a notice of 01 month. The firm will not be entitled to claim any compensation against such termination. However, while terminating the contract, if any payment is due to the firm for maintenance services already performed in terms of the contract, the same would be paid to it as per the contract terms.

16. For further information/clarification in this respect and for any technical clarification regarding Services, Applications & Hardware covered under the Turnkey Project Contract, please contact Systems Manager, HRI during the working hours (Email: [email protected] Telephone No 0532-2274395). It will be the responsibility of the bidders to check website http://www.hri.res.in for any amendment through corrigendum in the NIT. In case of any amendment, bidders will have to incorporate the amendments in their bid accordingly. 17. No increase in rates will be allowed during the Turnkey Project Contract Period due to any reason, after opening the bids. 18. Liquidated Damages: In the event of the firm’s failure to provide services mentioned in the Work Order the institute may, at his discretion, withhold any payment until the completion of the contract. The Institute may also deduct from the firm as agreed, liquidated damages to the sum of 0.5% of the Work Order price of the delayed/undelivered stores for every week of delay or part of a week, subject to the maximum value of the Liquidated Damages being not higher than 10% of the value of delayed stores. 19. Arbitration: All disputes or differences arising out of or in connection with the Contract shall be settled by bilateral discussions. Any dispute, disagreement or question arising out of or relating to the Contract or relating to construction or performance, which cannot be settled amicably, may be resolved through arbitration. The standard clause of arbitration is as per Institute regulations. 20. Performance Guarantee: The Bidder will be required to furnish a Performance Guarantee by way of Demand Draft / FDR / Bank Guarantee through Nationalized bank / Scheduled bank public sector bank or a private sector bank authorized to conduct government business (ICICI Bank Ltd., Axis Bank Ltd or HDFC Bank Ltd.) for a sum equal to 10% of Work Order value within 30 days of receipt of the confirmed order. Performance Bank Guarantee should be valid up to 90 days beyond the Turnkey Project

Contract period mentioned in the contract. Format of Performance bank guarantee is annexed with this NIT.

Page 10 of 35



21. HARISH-CHANDRA RESEARCH INSTITUTE reserves the right to reject any items supplied against the purchase order, if found not satisfactory at the time of supply. The rejected items, if any, shall have to be taken back and replaced by good quality items forthwith at the cost of the supplier. No payment will be made for the rejected item(s). 22. The prices quoted should be inclusive of all taxes etc and no hidden cost may be given. If quotes received with hidden cost, quotes will be rejected. The total amount should be clearly mentioned. 23. The IT / Computer infrastructural and firewall services of the institute can be inspected and evaluated by the bidders on any working day between 03:00pm to 05:00pm before opening of bids. 24. Payment Terms & Condition: The payment to the contractor will be made on Quarterly basis at the end of each Quarter (03 Months) period against invoice with PAN number, raised by the contractor and based on past performance. The maintenance charges quoted by the agency shall be on yearly basis inclusive of all taxes and levies applicable. No escalation of prices shall be permitted on any ground during the contract period. 25. Replacement of Parts: Replacement of parts in case of failure under the Turnkey Project Contract for running the IT/Computer infrastructural and firewall services of the institute are free of cost. Spares required for maintenance will be the part of the Turnkey Project Contract and no charges will be paid by this Institute 26. Working Hours: The maintenance work shall normally be done during working hours of the Institute. However, in case of emergency maintenance may have to be done beyond office hours and even on holidays prior arrangement through proper communication should be worked out in all cases by the firm. 27. The Lowest Bid will be decided upon the lowest price quoted by technically qualified L1 firm / bidder. Work Order may be placed to technically suitable qualified L1 firm / bidder on the basis of evaluation done at this institute.

28. The Institute reserves the right to reject any or all quotations without assigning any reason therefore. 29. This NIT will be binding to the successful vendor as contract documents. Work Order will be issued to successful vendor with applicability of all terms & conditions of this NIT. 30. Decision of the Director of the Institute will be final and binding for all concerned. 31. All disputes subject to Allahabad jurisdiction. ……….sd………

(Ravindra Singh) Registrar

Page 11 of 35



------------------------------------------------------------------------------------------------------------------

DECLARATION BY THE VENDOR It is hereby declared that I/We the undersigned, have read and examined all the terms and conditions etc. of the NIT document for which I/We have signed and submitted the bid under proper lawful Power of Attorney. It is also certified that all the terms and conditions of the tender document are fully acceptable to me/us and I/We will abide by the conditions from serial no. 1 to 31. This is also certified that I/We/our principal manufacturing firm have no objection in signing the purchase contract if the opportunity for the supply of the items against this tender is given to me/us. Date: Signature: Address: Name:

Designation: On behalf of: (Company Seal)

Page 12 of 35



PART – 1(B)

TECHNICAL BID FOR

THE TURNKEY PROJECT OF ANNUAL OPERATION, MAINTENANCE AND SERVICE CONTRACT FOR

RUNNING THE IT / COMPUTER INFRASTRUCTURAL AND FIREWALL SERVICES AND ITS ASSOCIATED SOFTWARE AND HARDWARE

OF THE INSTITUTE ON OPEN SOURCE / OPENBSD AND LINUX ALONG WITH THE POSTING OF

HIGHLY TRAINED AND EXPERIENCED ON-SITE RESIDENT ENGINEER AT

HARISH-CHANDRA RESEARCH INSTITUTE, JHUNSI, ALLAHABAD

1. Name of the Company 2. Full address of company alongwith

Telephone no. Fax no. E-mail address :

3. Local address of company for communication, if any

4. Are you a OEM / Service Provider ( please attach relevant document)

5.(a) Annual turnover in last 3 financial years in Lacs. (Please attach documentary proofs) (i) Year 2012-2013 (ii) Year 2013-2014 (iii) Year 2014-2015

5.(b) Trade Tax / Sales Tax Registration No. with Place with TIN No (Certificate copy to be enclosed)

5.(c) Attach copy of PAN No / TAN No with place

5.(d) Copy of Work Orders/Bill of providing similar services to reputed organizations (Attach certificate).

Page 13 of 35



PART – 1(C)

TECHNICAL BID (SPECIFICATION) FOR






Sl No Item Specification Compliance Yes/No

Please Mention deviation if any

(1) (2) (3) (4) (a) Services and scope of work for installing,

configuring, commissioning, testing and Annual Operation, Maintenance and Service Contract for running the IT / Computer Infrastructural and Firewall Services and its associated Software and Hardware of the Institute on Open Source / OpenBSD and Linux along with the posting of highly trained and experienced on-site Resident Engineer. (Hardware details are mentioned at Point No. 1. of the heading proposed Scope of Work (SoW) on Page No. 15)

Existing Setup:-

(i) There are four ISPs (ii) LAN is available within the campus (iii) Services run over Open-BSD and Linux (iv) A mixture of server grade hardware and/or

high end desktop machines are utilized for running the basic IT services like proxy, website www.hri.res.in (Intranet as well internet with Apache, mysql, php etc.), Webserver, Email, Webmail, SSH, DNS, DDNS, LDAP, NFS, DHCP, firewall, gateways and other computing facilities

(v) Entire IT setup is fully protected with firewall by running packet filter over Open-BSD

Page 14 of 35



Desired Setup: -

1. The Institute will like to continue all the four available ISPs. One more ISP could be taken in future

2. It is desired to balance the inbound as well as outbound traffic

3. All the firewall and major Services will run over Open-BSD. Only in exceptional case(s) where OpenBSD have any challenge for any specific application / service, Linux may be allowed.

4. The Institute would use the domain: hri.res.in as primary main domain for the institute. However, mri.ernet.in or other existing domains would also continue to be in use and may be dropped in future as per the need.

Page 15 of 35



The proposed scope of work (SoW) should involve the following:- 1. Hardware details under the Turnkey

Project Contract: 15 Nos of IBM (IU) X3550 Rack Server. Maintenance of the IBM rack severs (15 Nos) Configuration of each server : IBM (1U) X3550 M3, 2.4 GHz dual processor, 8 GB RAM, 600GB*2 SAS disks, dual power supply, fibre channel controller, integrated 4 * 1Gbps LAN, and 1 No. IBM 1754A2X Console switch analog 2x16 (LCM16) (Local 2x16 console manager), and 10 Nos IBM 43V6147 single cable USB conversion option

2. Commissioning of secured basic IT services like webserver, website of HRI www.hri.res.in (Internet and Intranet with Apache, mysql, php etc.), proxy servers, mail servers, webmail servers, firewall servers, firewall rules, DNS, DDNS, DHCP, DMZ creation, SSH server, backup server, cloud server and other supplementary and important services as per time-to-time need of the institute within the entire warranty period of the contract. The vendor should be able to configure any required service as per the need during the entire contract period.

3. Seamless & flawless migration of the entire live services without interrupting the services and without loss of personal mailbox, personal profiles, home directories and personal information in case any server is changed due to hardware upgradation or hardware failure during the contract period.

4. Complete documentation of the entire services, steps for tacking emergencies/breakdowns, resuming services, starting/stopping of the services etc.).

5. SMTP, SSH, SFTP, HTTP, HTTPS are

most important services and there should be a provision/mechanism for balancing of the outbound traffic

Page 16 of 35



6 All the services should be secured. For

example, sftp should be used for secured file access and/or transfers

7 Security for accessing the Local Area Network, Internet cloud access and servers in DMZ access needs to be defined

8 All the services need to be secured from

outside possible attacks. All the log, configuration files as well as mailboxes need to be backed-up in a pre-defined fixed time-period. Automatic scheduler is required to be run at every day. The backup should be kept at least for a cycle of minimum one year. Users’ mailboxes and users’ home directories should be incrementally backed-up through cron scheduler from one fileserver to another server for full redundancy of the file server. Full backup of the users’ mailboxes and home directories should also be backed-up onto a backup server a cycle of one year.

9 All the log of all the services should be

monitored and debugged.

10 There should be a GUI based system administration tool accessible from secured login for: - (i) User creation (ii) Monitoring of Internet access / blocking / white listing (iii) Internet access via network based / user based/ mac based (iv) System administration like starting / stopping / scheduling of various services (v) Source code of the GUI should be handed over to HRI

11 Postfix should be the back end MTA

Page 17 of 35



12 For the mail group purposes and

considering the fact that postfix would be used as the backend MTA, Mailman/Majordomo should be used for creation, management of the email group aliases. There should be a provision for creation and management of email group by the super user only.

13 Webmail access should be over SSL involving self-signed certificates

14 All the email client programs like mutt, elm,

pine, mail, mailx, webmail etc. should be configured to access the emails.

15 Squirrelmail or equivalent/better should be

used as the webmail with all the open-source components in consultation with computer centre HRI.

16 Spam protection should be taken care by

SpamAssasin or spamd or better technologies available in public domain or technologies with source code

17 Virus protection should be taken care by

Clam AV or still better technologies available in public domain or technologies with source code

18 BIND should be the NS both for resolving

or authoritative purposes

19 Custom scripts in conjunction with

dsimport should be used for converting NIS files/maps to ldif or LDAP formatted files

20 NIS may co-exist with LDAP Server and

users of NIS should ideally login to the NIS Server/NIS Client without any problems

21 LDAP Server should have phpldapadmin

or other equivalent open source application as the client to configure the LDAP Server

Page 18 of 35



22 All the services should be authenticated against LDAP Server as well as NIS Server. However, at any given moment of time only one authentication server could be treated as the default server for NIS and LDAP clients.

23 Proxy or Internet Access Server should be Squid with access control and squid guard.

24 Internet access should be without any

content filtration

25 OpenBSD based packet filter (PF) should

be the firewall for the network

26 All the ports except smtp=25, dns=53 and

http=80 should be dropped/closed. The blocking and opening of the ports may added or deleted anytime as per the IT security needs. There should be a provision in the firewall rules to block the malicious reported Public IPs

27 There should be a DMZ containing all the

servers like mail, webmail, webserver, website, DNS+DHCP, DDNS+DHCP, LDAP, NIS, NFS, Proxy, firewall, gateways.

28 All the mailbox data, ftp data, html data,

other user data should be split over individual hard disks of the servers. The individual disks should be configured with RAID for full redundancy.

29 The same data should be backed up at the

dedicated backup server through automated scripts running at predefined intervals. The data should correspond to the individual user’ directories at the dedicated backup server.

30 There should be password-checker for

users. It should ensure for strong combination of the alpha-numeric characters through webmail integrated php plug-in

Page 19 of 35



31 All ldap/NIS users with the same user name/password are simply discarded

32 All the ldap/NIS users should be checked in every week for the identical username/password

33 Phishing is protected through custom

developed SMTP headers and integrated with Postfix

34 DHCP Server should be integrated with

DNS Resolver. Internet and LAN Management server should be used for distributing the users spread in residential network, institute network and the server room network

35 Existing file server with dedicated

SAN/NAS should be continued. It will be the responsibility of the vendor to maintain the existing File Server and sync it with the newly configured system.

36 There will be four gateways called GW1,

GW2, GW3 & GW4 corresponding to four different ISPs

37 There should be a provision to connect

one more ISP either by creating another gateway or connect it with the existing gateway.

38 Each gateway would be connected to two

ISPs

39 For command prompt SSH access there

would be an Access Server with pre-defined LDAP/NIS users and through public Key based access (only port 22 would be allowed). Access Server would have four Ethernet cards and would be connected to two ISPs. This Access Server will be used for remote login from the external network to access the file system.

40 Packet filter should be the firewall on all

the four gateways.

Page 20 of 35



41 Intrusion Detection System and Intrusion Prevention System Should be configured for all inbound and outbound traffic

42 There would be a DMZ containing all the servers like mail, web, dns, ldap, NIS, NFS, DHCP etc.

43 Following would be the servers under

DMZ:

(i) Two Servers in which mail with spamd, SpamAssasin

(ii) Two Servers in which web server and website www.hri.res.in using apache, mysql, mysqladmin and PHP on OpenBSD.

(iii) Two Servers with External and Internal DNS.

(iv) Two Servers with LDAP Server (read, write).

(v) Two Servers with Squid as the Proxy server with DHCP, DNS Resolver and Bandwidth Management.

(vi) One server for the incremental backup of the users’ mailboxes and users’ home directories.

(vii) One server for full backup of the users’ mailboxes and users’ home directories for a cycle of one year.

(viii)One server for cloud with user quota and authenticated login implementation.

44 There will be four glued parent name

server records at the WHOIS for hri.res.in

45 All the four glued parent name server

records would map to GW1, GW2, GW3 and GW4.

46 The gateways should forward to the DNS

Servers.

47 For inbound mail delivery, MX would be served as GW1 Preference = 0, GW2 preference = 0, GW3 preference = 0 and GW4 preference = 0.

48 The DNS should publish the SMTP to the

Mail Servers.

Page 21 of 35



49 For the A record; the DNS Server would publish the record of Gateways, which would forward to HTTP connection to the web server.

50 Operating System for all the four gateways

and Access Server and Other Services would be Open-BSD/Open Source.

51 Separate servers should be used for each

function to the best explored possibility, viz. DNS, MX, WWW, LDAP, proxy, DHCP , Cloud etc.

52 Firewall should be configured separately in

all servers.

53 HRI intends to utilize the Wireless Access Points (APs) . Intension is to give the wireless connectivity from (wireless Access Points) controlled by Centralized/Controller based servers.

(i) APs would be allowed to provide only

the wireless connectivity. DHCP, private routing, filtering, nating would be controlled by centralized / Controller based servers.

(ii) All the connections like proxy, mail, SFTP, SSH and other services could be controlled by the servers.

(iii) Two high-end servers would be utilized for the purpose and both the servers would function as fail-over.

(iv) Entire functionalities like content filtration, MAC address authentication, user level policies, etc. would be accessible/manageable from the centralized servers.

54 Ifstated or other available open source command/application should be used over Open-BSD / Open-source to monitor the links amongst multiple links .

55 Combination of ifstated + pf would be

used for load-balancing (if required).

56 Implementation of quota system for users’ mailboxes and users’ home directories on NFS server / file system.

Page 22 of 35



57 Features of the Email Server: 1. Messaging Server

Feature Description Support for IMAP, HTTPS,

Web Mail SMTP, POP3, MIME/SMIME, digital certificates

Web Mail interface for access to all messages, address books( global, personal and group) via any web browser

Integrated address book with address book manager, import and export facility

Password based and self-certificate based login for Web Mail

Quota control based on mailbox size, no. and size of messages

Provision to set varying message size and attachment size

Notification for all messages ( Delivery and read receipt)

Full attachment support – send, receive and forward

Integrated IM/Chat Integration of Anti-spam and

Anti-virus

Unified reporting and detailed logging of messages and logins

Provision for generating Non delivery reports in case of domain not available, quota limit exceeded etc.

Tools for generating reports and statistics of mail traffic

Customizable and extensible user interface

Support for SMTP AUTH, TLS compatible with SSL

Support required for SAN based storage

Support for creation of multiple virtual domains and domain masquerading

Page 23 of 35



Support for standard email POP3 / IMAP3 clients for access the emails

SASL and SSL/TLS with 256 bit encryption

User Management Identity based user management from identity server using LDAP/NIS

File Attachment Support Facility to limit file types and file attachment size so as to limit Spam and mailbox cluttering.

Text formatting tools Availability of formatting tools

Mailing Group

Group mails for sending mails to groups. It should not permit group mails from external mail servers. Group addresses should be visible only inside the mail server. Majordomo / Mailman or equivalent open source software for mailing aliases / group creation.

Web mail Themes Support for two themes. Themes are customizable as per needs/ requirements

Spam folder In-built spam folder for receiving spam mails automatically

New mail alert A pop-up window appears, when a new mail arrives

User quota display in webmail

Actual byte/ KB/ MB/ GB) and also % of mail usage. Graphical display.

Page 24 of 35



Time based log off Feature of Automatic logging off from webmail when idle for a certain time

Vacation mail Automatic replies to the sender with customized message when not available on desk or on leave

Personal calendar Events could be added and accessed for day to day activities

Group Calendar Events could be added, shared and accessed within groups

Email footer Customized organizational details attached automatically with every outgoing mails

Electronic address card support

Customized Personal details in the form of names cards

Personal address book Address book with to, cc, and bcc feature, on click addition, automatic address book population

Address population Automatic address population

Sent mail confirmation Sending confirmation and automatic addition of new email addresses

Home page support for individual user

Customized home page for each user where users could put their personal files and other quick links

Page 25 of 35



Authenticated SMTP over POP3 and IMAP3

Authenticated SMTP over POP3 and IMAP3 be provided connecting mail clients as per requirement both within the Institute network and from outside the network if required.

Quota report for administrator using script

Administrator should receive automatic alerts when a user mail quota is about to reach the limit

Bulk user group creation using script

Administrator should be able to create users in bulk with the help of automated scripts

User Management Different login id and mail id for a single user (if required). For example login ID could be roll number or employee ID and mail ID could be name. Under normal circumstances login ids and mail ids should be kept same.

Page 26 of 35



User management and report generation

Facility to get reports regarding mail usage by users. Reports of users not using/ logging to the mail server for one week Continuously. Usage statistics for users using the mail server. Statistics for users sending virus/ spam mails

Calendaring Application Full user and group calendaring application

Temporary user account creation

Facility to create temporary user accounts for a defined period of 1 month/ 3 months/ 1 year period. The account will get automatically locked after the fixed period

Mail proxy Facility for mail Proxying. With this it should be possible to check multiple mail accounts on the server with single ID

Opt in group mailing/ discussion groups

Facility to create mail groups/ discussion groups.

Support for shared message stores like Notice Board or Bulletin Board.

Page 27 of 35



Support for access of all mailbox folders (Inbox, Calendar, Shared Folders, etc) through the browser by providing user friendly URLs

Integrated auto-replies

58 Features of the Internet / Intranet sharing solution

LAN Administration for HTTP access

� IP based access

� IP series based access

� Password based access

� Time based access

� MAC based access

� Group based access

� Restriction based access

� Restriction free access

� Vacation based access

� Network based access

59. System Administration Tool:

(i) Dedicated GUI based System

Administration tool available with secure login on an individual machine.

(ii) User creation by virtue of User ID or names.

(iii) Blocking of the users by virtue of user ID. (iv) Users support requests available over

System Administration Tool. (v) Users deletion over System Administration

Tool. (vi) Group deletion over System

Administration Tool. (vii) Detailed reporting of users activities. (viii)Detailed reporting of group activities.

Page 28 of 35



(ix) Top user reporting. (x) Top group reporting. (xi) Users & group reporting against top sites

visited, overall sites visited against minutes, hours, days and weeks.

(xii) Colorful graphical reporting. (xiii)Reports of the inactive users not logged in

for the last ‘n’ number of days. (xiv) Optional printing facilities for the detailed

reports. (xv) Bandwidth utilization graphical tools on all

the four gateways with daily / weekly / monthly / yearly graphical reports.

(xvi) Implementation of user print quota on Network Printers using open source software/packages as and when required by HRI.

60 Seamless & flawless migration of the

entire live services without interrupting the services and without loss of personal mailbox, personal profiles, home directories and personal information as and when required during the entire contract period.

61 Existing system is live with around five hundred users hooked to the system

62 Mailboxes, users’ home directories, sftp

data, html data and other data need to be migrated to the newer system without any loss of the data

63 Post migration of the data: the system

should be observed for a minimum of one week for new problems, complexities that might arise due to migration

64 Complete documentation of the entire

services, steps for tacking emergencies/breakdowns, resuming services, starting/stopping of the services etc.

Page 29 of 35



65 Full documentation in hard copy printed manual, over CD in electronic format should be delivered containing all the details of all the services, configuration files, operating system files etc.

66 Full documentation on network architecture, firewall rules, OS setup, IP scheme should be accompanied.

67. Additional Security Requirements:

67.1 Email Security:

a. All mails exchanged in the

organization’s domain should have

SPAM Control

b. All inward and outward emails should

be scanned for viruses, Trojans etc.

c. Authentication should be enforced on

mail servers for sending emails

d. Quota for sending outside emails

should be made

e. Webmail should be over SSL

67.2 Mail backup-up Policy:

A copy of Incoming and outgoing

emails should be maintained for a

minimum period of 3 months. One year

period is preferable.

67.3 Wireless (e.g. Wi-Fi) security if used

a. Default username and administrator

passwords should be changed.

b. Latest encryption feature should be

enabled.

c. Default SSID and disable SSID

broadcast should be changed.

d. MAC address filtering should be

enabled.

e. Power to Router/wireless access point

should be turned off when not in use

f. Wi-Fi networks should be registered

with Organization’s internal IT agency

g. Time based access should be available

so that non-active sessions should

expire immediately

Page 30 of 35



67.4 Servers on perimeter/DMZ

a. Separate servers should be used for

each function viz. DNS, MX, WWW etc.

b. All these servers should be hardened

and only minimum required ports

should be opened.

c. Firewall should be configured

separately in all servers.

67.5 Antivirus Measures:

a. Enterprise antivirus server should be

maintained to enable Desktops to

download the virus updates

b. It should be ensured that all Desktop

Systems use antivirus programs and

have measures enabled to update the

virus patterns as and when updates

become available

67.6 Software security Updates & Patch

Maintenance:

A system of updating critical software

and applying security patches on a

regular basis should be in place

67.7 Log Maintenance:

a. Logs of all email transfers, system

messages, web server access in the

domain should be backed up for a

minimum period of 3 months

b. The log files should be analyzed in a

systematic manner on a regular basis

in order to generate statistics and

detect any abnormal events.

67.8 Network Management:

a. It should have tools to monitor and

control the Network traffic status of LAN

b. It should monitor Internet traffic through

a suitable software in a systematic

manner

c. It should have ability/tools to selectively

control/monitor Internet access of users

d. Only authorized users are permissible

to access the resources of the network

Page 31 of 35



NOTE:

68 Parties should give the POINT-WISE detailed compliance of all the points mentioned in the tender.

69 One fully qualified Resident Engineer with adequate qualification of B.Tech/MCA and with minimum three year experience on OpenBSD and Linux should be posted onsite at HRI between 9 AM and 6 PM, 5 days a week, Monday to Friday and on call basis round the clock (day/night) for the entire period of contract and service support for maintaining the services and fine tuning the services mentioned under PART -1 (C) “services and scope of work” as and when required. Engineer’s technical capability/competency of handling the technical requirements under the contract will be evaluated at the time of deployment and time-to-time in future by Computer Centre, HRI and if found unsuitable anytime, HRI may ask for the substitution of the Resident Engineer having more competency. Party can change the Resident Engineer only after taking the permission from HRI and by posting the substitute Resident Engineer with equal or better competence, qualification and experience. Since posting of qualified and experienced Resident Engineer is an important component of the Turnkey Project Contract for maintaining the services without fail, hence the Engineer should be qualified as per the above requirements and suitably paid as per the market rate by the vendor. Give undertaking of posting such competent Resident Engineer.

70 All the above services and applications mentioned anywhere in this tender will be installed, configured, commissioned, tested and maintained on the servers and its associated hardware provided by HRI which are already in use or purchased anytime later.

71 Payment will be made on quarterly basis on the submission of the bills duly certified by the Systems Manager, HRI.

Page 32 of 35



Signature and seal of the bidder: ……………………………………………………..

72 Annual Maintenance Contract will be initially for three years and may be extended on mutually agreed terms for one/two/three more years or more. The contract may be terminated by either side anytime by serving one month notice.

Page 33 of 35



PART – 2

FINANCIAL BID FOR






FINANCIAL BID FORMAT

(Bidders should bid in the following format only.)

Note:

1. Percentage/Amount of taxes may increase or decrease as per the prevailing Government rules at the time of submitting the Turnkey Project Contract bills.

2. Turnkey Project Contract will be initially for three years on the quoted per year cost and may be extended on mutually agreed terms for one/two/three more years or more. The contract may be terminated by either side anytime by serving one month notice.

Signature and seal of the bidder: ……………………………………………………..

Sl No

Description Total Basic cost in Rs. of Turnkey

Project Contract for

One Year

% of Taxes

Amount of Taxes in

Rs.

Total cost for One year

(including all Taxes) in Rs.

1 2 3 4 5 Column 3 + Column 5 = Column 6

(a) Turnkey Project of Annual Operation, Maintenance

and Service Contract for running the IT / Computer

Infrastructural and Firewall Services and its

associated Software and Hardware of the Institute

on Open Source / OpenBSD and Linux along with

the posting of highly trained and experienced on-site

Resident Engineer.

All other specifications of the services and the

details of the Hardware under the Turnkey Project

Contract are mentioned in the Technical Bid Part-

1(A,B,C). Details of Hardware under the Turnkey

project Contract are mentioned at Point No. 1, Page

No. 15 of this tender document.

Page 34 of 35



EMD BANK GUARANTEE FORMAT

Whereas ……………………………………(hereinafter called the “Bidder”) has submitted their offer dated………………………………….for the supply of ………………………………………………………………………..(hereinafter called the “Bid”) against the Buyer’s NIT No … dated ……...KNOW ALL MEN by these presents that WE ……………………………of …………………………… having our registered office at……………………………………………………………………. …are bound unto ………………………………………………. (hereinafter called the “Buyer) in the sum of ………………………………………………………………………………………...for which payment will and truly to be made to the said Buyer, the Bank binds itself, its successors and assigns by these presents. Sealed with the Common Seal of the said Bank this……………day of…………….2016 The conditions of obligations are – (1) If the Bidder withdraws or amends, impairs or derogates from the Bid in any respect within the period of validity of this tender. (2) If the Bidder having been notified of the acceptance of his tender by the Buyer during the period of its validity.

(a) If the Bidder fails to furnish the Performance Security for the due performance of the contract. (b) Fails or refuses to accept/execute the contract.

We undertake to pay the Buyer up to the above amount upon receipt of its first written demand, without the Buyer having to substantiate its demand, provided that in its demand the Buyer will note that the amount claimed by it is due to it owing to the occurrence of one or both the two conditions, specifying the occurred condition or conditions. This guarantee will remain in force upto and including 45 days after the period of tender validity and any demand in respect thereof should reach the Bank not later than the above date. ……………………………. (Signature of the authorized officer of the Bank) Name and designation of the officer Seal, Name & address of the Bank and address of the Branch

Page 35 of 35



PERFORMANCE BANK GUARANTEE FORMAT

From: Bank _______________

To, The Director Harish Chandra Research Institute, Deptt of Atomic Energy, Government of India Chhatnag Road, Allahabad

Dear Sir,

1. Whereas you have entered into a contract vide NIT No_______ dated_________ (hereinafter referred to as the said Contract) with M/s___________________, hereinafter referred to as the “seller” for supply of goods as per Part-II of the said contract to the said seller and whereas the Seller has undertaken to produce a bank guarantee for( % ) of total Contract value amounting to _________ to secure its obligations to the Harish Chandra Research Institute. We the _______________ bank hereby expressly, irrevocably and unreservedly undertake and guarantee as principal obligors on behalf of the seller that, in the event that the President of India declares to us that the goods have not been supplied according to the Contractual obligations under the aforementioned contract, we will pay you, on demand and without demur, all and any sum up to a maximum of ____________Rupees _____________ only. Your written demand shall be conclusive evidence to us that such repayment is due under the terms of the said contract. We undertake to effect payment upon receipt of such written demand.

2. We shall not be discharged or released from this undertaking and guarantee by any arrangements, variations made between you and the Seller, indulgence to the Seller by you, or by any alterations in the obligations of the Seller or by any forbearance whether as to payment, time performance or otherwise.

3. In no case shall the amount of this guarantee be increased.

4. This guarantee shall remain valid for …… months until all the store, spares and documentation have been supplied according to the contractual obligations under the said contract.

5. Unless a demand or claim under this guarantee is made on us in writing or on before the aforesaid expiry date as provided in the above referred contract or unless this guarantee is extended by us, all your rights under this guarantee shall be forfeited and we shall be discharged from the liabilities hereunder.

6. This guarantee shall be a continuing guarantee and shall not be discharged by and change in the constitution of the Bank or in the constitution of M/s______________________________.

Date post:	01-Jan-2020
Category:	Documents
Upload:	others
View:	4 times
Download:	0 times

NOTICE INVITING TENDER FOR THE TURNKEY PROJECT OF …tenders/uploads/AMC-FIREWALL-FINAL-2016.pdf ·...

Documents