a) Inviting body for tenders: Name of the contracting authority: Landesamt für Geobasisinformation Sachsen; Department/Division: Central Procurement Office/Department 1; Street, House Number: Olbrichtplatz 3; Postal Code: 01099; City: Dresden; Country: Germany; Email: vergabestelle@geosn.sachen.de; Phone Number: +49 35182821109; Internet Address: www.landesvermessung.sachsen.de; Body awarding the contract: see above; Body to which tenders or applications for participation are to be submitted: see above b) Type of procurement: Public tender c) Form in which applications for participation or tenders are to be submitted: Tenders can only be submitted electronically; Address to which tenders are to be electronically transmitted: www.evergabe.de d) Type and scope of service: The Landesamt für Geobasisinformation und Vermessung Sachsen (GeoSN) operates a Load Balancer cluster from the manufacturer F5. This cluster is needed for specialist applications such as ALKIS, DMS, and access to the GeoSN network via Citrix. The Load Balancer cluster consists of two physical nodes, each hosting three virtual load balancers. The hardware platform for these load balancers will enter Extended Support on January 1, 2027. From this point onwards, the load balancer operating system will no longer be maintained for this hardware platform; consequently, no security and performance updates or bug fixes will be provided by the manufacturer. GeoSN therefore intends to replace the existing Load Balancer cluster (F5) with a new Application Delivery Controller (ADC) in the form of a hardware appliance. A Load Balancer cluster as an Application Delivery Controller (ADC) in the form of a hardware appliance is to be delivered, which will replace the currently operational Load Balancer cluster. This includes system service with a minimum contract duration (MVD) of 60 months. A migration plan is also to be developed for this purpose. The components necessary for replacing the previously used Load Balancer cluster are to be delivered, set up and tested in the two server rooms of GeoSN. The configuration and rule set are to be created and the system is to be put into full operation. GeoSN administrators are to be instructed in the management of the new components. The replacement will take place during ongoing production operation. Changes that cause an outage can generally only be carried out within a maintenance window defined by GeoSN. Downtime must be kept as short as possible. 4.3 Requirements for the Load Balancer Cluster to be delivered 4.3.1 Hardware Two identical ADCs are to be offered, each meeting at least the following requirements: • 19'' rack housing, incl. mounting rails for 19" racks • Configuration as a redundant pair over a distance of at least 100 m • Dedicated management access (RJ45) • At least two SFP+ interfaces • At least eight 1Gb RJ45 ports • Redundant power supply (230V) • The system must be able to host the platform for at least 3 virtual instances or equivalent dedicated hardware and be upgradeable to at least 8 instances. • It must be possible to assign hardware resources to contexts. • Throughput of at least 20 GBit/s • At least 20,000 transactions per second with 2K keys • At least 500,000 Layer 7 requests per second • Hardware compression rate: min. 35 GbpS • Trade-in including decommissioning and dismantling of old systems A list of components is to be attached to the offer in an informal format. Technical requirements The specified technical requirements are to be understood as minimum requirements. The bidder is free to offer higher-quality specifications for individual items in accordance with technical advancements. Higher-quality parameters will not influence the selection of the most economically advantageous tender. 4.3.2 Software • Role Based Access Control with connection options to LDAP and Microsoft Active Directory • Web-based administration of all functions via HTTP/HTTPS • Uninterrupted operation (updates/patches during operation, configuration changes without service restart, session handover to HA partner, replacement without service interruption) • Forwarding decision (pool selection, redirect, forward, reject, drop, log etc.) based on the complete payload of a packet. • IPv4 and IPv6 support without restriction through the use of IPv6. • URL Rewriting • Mechanisms for relieving backend servers, e.g., through session reuse • Offloading of encryption with the possibility to re-encrypt to the backend • Encryption and decryption with TLS 1.2 and TLS 1.3 • Support for RSA keys with 2048 and 4096 bits as well as ECC certificates (ECDSA) • Reverse proxy for HTTP/HTTPS and HTTP/2 protocols, ideally HTTP/3 (QUIC) • LACP port channels • Web Application Firewall (WAF) • Bandwidth limitation of individual virtual servers (VIPs) • Support for a proxy cascade with central logging (Syslog) • Hardware-assisted protection against SYN flood attacks • Management via SNMP • Logging via Syslog • Support for Inband Passive Health Monitoring for monitoring client requests • Monitoring of the following services: ICMP, TCP Echo, HTTP/HTTPS, Oracle, PostgreSQL, SMB, UDP • Web-based access (HTTPS, Browser) to Citrix XenApp and XenDesktop sites for external users with domain authentication • Access to Citrix components should be via the ICA protocol (Citrix must be supported as ICA Relay, authentication against 2 domains and load balancing.) • For ICA communication, full manufacturer support for the deployed ICA proxy functionality must be guaranteed. • Support and provision of central certificate management including API connection. • Documentation Bill of Materials (SBOM) 4.3.3 Migration At least 25 virtual IP...
