Agenda — Hemet City Council, March 14, 2023 (part 10 of 10)

13.B

Page 1511 of 1602 ends

Technical white paper Page 3

EXECUTIVE SUMMARY
Your organization needs to have confidence that your infrastructure components, including your HPE Nimble Storage dHCI solution, can meet and maintain your organization’s security policies. Such policies might be guided by available industry standards or requirements set forth by your industry or government, or simply by the knowledge your team has gained from years of experience.

Many organizations think of security as an issue associated only with computer networking. In reality, however, security involves all aspects of the IT infrastructure—from the very smallest component of a machine up through the collection of computing devices in the data center, their connectivity, and the way all of these components are managed. Developers and manufacturers must uphold product security as an organization-wide commitment—to develop products and services that will prevent this diverse environment from being compromised.

Products from Hewlett Packard Enterprise are required to be capable of operating in secure environments without allowing information to be compromised by limitations in product capabilities, quality, or operation. Such requirements have driven HPE products to achieve superior product quality and capabilities.

Hewlett Packard Enterprise offers industry-leading service capabilities that encompass the requirements for security. It provides on-premises monitoring coupled with multi-device rollup of information to the HPE InfoSight portal for customer-configurable analysis of an enterprise. HPE InfoSight was designed to deliver as much capability to the customer as they want (or in the case of “dark” sites, as little as they want).

Hewlett Packard Enterprise also understands that organizations cannot have unbridled access to their environment. All machinery is configured by using a least-privilege level of access, and all access is controlled by the customer. Therefore, customers determine which service personnel can have access to their machinery and when that access can occur.

Figure 1 provides a high-level guide to the typical shared responsibility model used by most private and public cloud providers.

Hewlett Packard Enterprise provides the on-premises management tools that you need to integrate with your security information and event management (SIEM) or your security operations center (SOC). Features such as encryption at rest, role-based access control (RBAC}, and Active Directory (AD) integration make it easy to maintain your required security posture and data sovereignty.

FIGURE 1. Typical model of shared responsibility for cloud providers Target audience
The target audience for this document includes corporate security personnel, risk planners, and IT administrative personnel who will be working with the HPE Nimble Storage dHCI solution.

This paper helps management understand the quality drivers for product development. It provides security personnel and risk planners information about the standards that were used to develop the product, and it offers administrative personnel a detailed overview of how the HPE Nimble Storage dHCI solution is accessed and how it can share access and configuration information with management tools.

Readers should be familiar with concepts associated with computer management, networking, security, and data storage arrays, as well as with the needs and requirements of their organization and its infrastructure.

Page 324 of 402 ends

13.B

Page 1512 of 1602 ends

Technical white paper Page 4

Document purpose
This paper offers an overview of how Hewlett Packard Enterprise has developed the HPE Nimble Storage dHCI solution and its associated products to meet your security needs. It is not intended to replace product manuals but rather to offer an overview of how the solution provides a secure platform on which sensitive data can be stored.

The paper takes a building block approach, from concept to actual use of the HPE Nimble Storage dHCI solution. It covers several major areas:
• HPE policies related to product development and information privacy • Administrative and operational users of the solution and their roles • Types of information exchanged with Hewlett Packard Enterprise • Methods and services that provide access to the solution • Architecture of the solution with respect to security The paper focuses on using the solution GUI, which is provided by the HPE Nimble Storage vCenter plugin, as the primary method for managing the solution. After reading it, you should have a good understanding of how the solution’s security capabilities are enabled. If you have additional questions or observations related to the paper, contact your Hewlett Packard Enterprise representative.

HPE NIMBLE STORAGE DHCI SOLUTION ARCHITECTURE OVERVIEW
The HPE Nimble Storage dHCI solution is an intelligent platform that has the flexibility of converged architecture and the simplicity of hyperconverged infrastructure (HCI). It disaggregates compute and storage and integrates hyperconverged control to give enterprises simple infrastructure management on a flexible architecture. Built with the powerful HPE ProLiant server, and the self-managing flash storage of HPE Nimble Storage arrays, this platform provides the flexibility to scale compute and storage independently for unpredictable growth and the data resiliency and performance needed for business-critical apps.

Powered by HPE InfoSight, this platform is intelligently simple, outstandingly resilient, and efficiently scalable. The solution is robust and fault-tolerant, and it is designed to deliver high performance and high availability. Extensive lab testing was conducted to validate that it meets those criteria. Customers can purchase and deploy their specified configuration with confidence in the quality of both the solution and the support they will receive from Hewlett Packard Enterprise.

The solution is intended for small or midsize businesses, large enterprises, and IT service providers who are looking for—and who understand the value of—the combination of consolidation, efficiency, and consistency that it offers.

The solution includes the following components:
• Storage: New HPE Nimble Storage all-flash or adaptive flash storage (for iSCSI only) • Computing resources: HPE ProLiant servers in one of the following models:
–  HPE ProLiant DL380 Gen10
–  HPE ProLiant DL360 Gen10
–  HPE ProLiant DL325 Gen10
–  HPE ProLiant DL325 Gen10 Plus
–  HPE ProLiant DL385 Gen10
–  HPE ProLiant DL385 Gen10 Plus
–  HPE ProLiant DL560 Gen10
–  HPE ProLiant DL580 Gen10
• Hypervisor: VMware vSphere® Hypervisor (VMware ESXi™) • Network switches: For information about switch requirements, see the Validated Configuration Matrix in the HPE InfoSight portal.

The following sections highlight the security aspect of each component.

Page 325 of 402 ends

13.B

Page 1513 of 1602 ends

Technical white paper Page 5

HPE NIMBLE STORAGE ARRAYS
The HPE Nimble Storage OS architecture is structured around a Linux®-based OS. The kernel itself is isolated from users. The command structure uses a sophisticated CLI architecture to manage the HPE Nimble Storage array. Each command in the CLI is a captive command, which maintains a barrier from the internal structure of Linux.

Network port usage
The first stage of the communication interaction with the HPE Nimble Storage array involves the network ports that are used by the HPE Nimble Storage OS (NimbleOS). NimbleOS uses several network ports by default and several optional network ports based on the services that are running on the array.

Table 1 shows the characteristics of these ports.

TABLE 1. Characteristics of network ports used by NimbleOS Port Protocol(s) Source Destination Service
22 TCP/UDP End user HPE Nimble Storage array SSH server listener 80 TCP/UDP/HTTP End user HPE Nimble Storage array Permanent forward to port 443 123 UDP HPE Nimble Storage array NTP server NTP peer
161 UDP HPE Nimble Storage array SNMP server SNMP agent listener 162 UDP HPE Nimble Storage array SNMP server SNMP trap originator 427 TCP/UDP HPE Nimble Storage array dHCI compute node SLP (used during deployment) 443 TCP/HTTP End user HPE Nimble Storage array HPE Nimble Storage web UI 8443 TCP HPE Nimble Storage array VMware vCenter Server® VASA vVol TLS listener

Strong password protection
HPE Nimble Storage arrays use a time-based password system for all privileged accounts. Time-based passwords are unique to each service user account and to each HPE Nimble Storage array. They change every hour and can be generated only in the HPE Support Center for authorized HPE employees and contractors. While the system is operating in time-based mode, passwords cannot be changed manually because they are changed automatically each hour.

NOTE
Choosing time-based passwords does not require you to change your HPE support processes.

Remote device access and customer access service
Diagnostics for HPE Nimble Storage Analytics (DNA) is a remote connectivity solution that enables connection to devices on customer networks, such as the HPE Nimble Storage array, for remote service delivery, support automation, real-time monitoring, and quality feedback.

DNA provides secure connectivity between Hewlett Packard Enterprise and the HPE Nimble Storage dHCI solution by using forward and reverse proxy technology.

For more information about this service, see HPE InfoSight Security for HPE Storage - Secure Predictive Analytics in the Cloud.

HPE Nimble Storage SmartSecure encryption
The HPE Nimble Storage SmartSecure feature enables you to encrypt and shred data on a per-application basis. It saves storage capacity and operations time, and it requires no custom drives, dedicated firmware, or licensing.

You can enable HPE Nimble Storage SmartSecure in the HPE Nimble Storage dHCI solution by simply activating the feature for the volumes that need it. It uses existing drives, and it has minimal impact on performance. The encryption works seamlessly with other HPE Nimble Storage features such as snapshots, replication, and zero-copy cloning; it can also be implemented across SSDs and HDDs within the array and on external shelves.

Page 326 of 402 ends

13.B

Page 1514 of 1602 ends

Technical white paper Page 6

Encryption at rest (EAR) is enabled at the group or volume level. For more information about this feature, see HPE Nimble Storage SmartSecure Encryption Technical White Paper.

SmartSecure Encryption key management
NimbleOS 5.3 introduces deeper encryption functionality to integrate into an enterprise key management server for enhanced protection, security, and mutual trust.

Customers can provide full lifecycle management of data encryption keys in an interoperable, unified security solution that uses the open Key Management Interoperability Protocol (KMIP) standard. With that standard, HPE Nimble Storage arrays can integrate into enterprise key management servers that comply with the OASIS KMIP standards. For example, they can work with market leaders such as Vormetric, Thales, Micro Focus, RSA, Safenet, and many others.

Accessing HPE Nimble Storage arrays
This section describes various ways to access HPE Nimble Storage arrays in the context of the HPE Nimble Storage dHCI solution and explains the standard services that can be coupled to an array to provide information about its configuration.

The HPE Nimble Storage array provides easy access through its GUI. It can also be accessed through the CLI or programmatically through application programming interfaces (APIs). In addition, you can grant access to other services in the environment if, for example, you want them to be able to change objects on the array or view information about the array’s operation.

HPE Nimble Storage arrays can be accessed through any of the following interfaces:
• The array GUI
• The CLI, including a Secure Shell (SSH) interface
• APIs
• Syslog
• Simple Network Management Protocol (SNMP)
• The VMware vStorage APIs for Storage Awareness (VASA) set of APIs NOTE
While you are using the HPE Nimble Storage dHCI solution, you should have little or no need to interact with the HPE Nimble Storage array GUI. You can accomplish most of the common tasks through the HPE Nimble Storage dHCI vCenter plugin.

HPE Nimble Storage array GUI
The Management Console includes the following key features:
• Login access to the main console can be configured based on HPE Nimble Storage user accounts and roles. • The general screens are used to monitor and manage the dashboard, activities, schedules, and settings. • The manage screens are used to manage data storage, data protection, data access, and performance policies. • The hardware screen is used to monitor and manage the storage array hardware. • The monitor screen is used to monitor various components of the solution. • The events screen is used to monitor logs and alerts. • The administration screen is used to monitor and manage the array itself.

HPE Nimble Storage array CLI
You can access the HPE Nimble Storage CLI from supported host systems through SSH or through the physical console port on the array.

HPE Nimble Storage array API
The HPE Nimble Storage array API uses the HTTPS protocol to enable programmatic management of the array and provides client access to web services at specified HTTPS locations. Clients communicate with the API server by using HTTPS methods and data structures represented with JSON.

For more information about using APIs, see the REST API Reference Version guide.

Page 327 of 402 ends

13.B

Page 1515 of 1602 ends

Technical white paper Page 7

VASA
VASA Provider implements APIs to manage VMware vSphere® Virtual Volumes™ (vVols) and to apply storage profiles defined in the VMware vCenter Server software. NimbleOS contains a VASA Provider that supports vVols with HPE Nimble Storage arrays. Before you can use the VASA Provider, you must register it with the VMware Server™.

VASA relies on several fundamental services in your environment, including the following:
• vCenter Server
• Directory services, such as Microsoft Active Directory (AD) or LDAP • DNS
The VASA provider is registered automatically when you use the HPE Nimble Storage dHCI vCenter plugin to create a vVol datastore.

HPE PROLIANT SERVERS
HPE security features are designed to meet challenges such as attacks on firmware by continually improving the hardware and firmware security of HPE ProLiant Gen10 platforms and related hardware environments—reinforcing them so that every link in the chain of security provides effective security protections.

In its security design, Hewlett Packard Enterprise focused on increasing the level of security in the three critical pillars of the security environment—protection, detection, and recovery—so you can be confident that your server hardware infrastructure is secure from threats and that any potential vulnerabilities will be addressed quickly.

The HPE ProLiant Gen10 servers with the iLO 5 and its silicon root of trust follow a server boot process that authenticates from the hardware itself and undergoes a series of trusted handshakes before fully initializing the UEFI and NimbleOS. The silicon root of trust enables the detection of previously undetectable compromised firmware or malware. The advanced capabilities of iLO 5 enable daily automatic scanning of firmware and automatic recovery to authentic good states. Combining the Gen10 security features with selected server options enables you to design a resilient and hardened industry-standard server infrastructure.

This guide does not discuss all features available for HPE Gen10 servers. For more information, see the HPE Gen10 Security Reference Guide.

Network port usage
Table 2 describes the network ports that are used by the HPE ProLiant server.

TABLE 2. Characteristics of network ports used by HPE ProLiant server Port Protocol(s) Source Destination Service
22 TCP/UDP End user iLO iLO SSH
443 TCP/HTTP End user iLO iLO web UI
17990 TCP End user iLO iLO remote console
443 TCP/HTTP HPE Nimble Storage array iLO API

HPE SWITCHES
HPE switches are optional components of the solution. No specific HPE factory processes are needed for HPE switches that are used with the HPE Nimble Storage dHCI solution.

Network port usage
Connectivity to the HPE switches is used only during setup by the end-user (or by the HPE Nimble Storage array if network automation is used).

Table 3 lists the network port characteristics that are required by HPE switches.

Page 328 of 402 ends

13.B

Page 1516 of 1602 ends

Technical white paper Page 8

TABLE 3. Characteristics of network ports required by HPE switches Port Protocol(s) Source Destination Service
22 TCP/UDP End user Switches SSH
443 TCP/HTTP End user Switches Switch web UI
22 TCP/UDP HPE Nimble Storage array Switches SSH (needed only for network automation) 443 TCP/HTTP HPE Nimble Storage array Switches Switch web UI data collection (needed only for network automation)

NOTE
Hewlett Packard Enterprise strongly recommends that you shut down any unused ports and put them in a dead VLAN that is neither reachable nor routable. This precaution prevents anyone from plugging devices into the switches that might affect your environment.

HPE FACTORY PROCESS FOR VMWARE VSPHERE IMAGE
Every compute node used in the HPE Nimble Storage dHCI solution requires a particular set of configurations in order to be considered a valid dHCI compute node. Those requirements are preinstalled and preconfigured at the HPE factory. dHCI compute node workload profile
The workload profiles feature is an HPE Intelligent System Tuning (IST) feature that enables you to tune the resources in your HPE ProLiant server by choosing a preconfigured workload profile. The server automatically configures the BIOS settings to match the selected workload.

The HPE factory configures the workload profile of each dHCI compute node to Virtualization – Max Performance. This workload profile setting is the recommended setting for HPE Nimble Storage dHCI solution, and it should not be changed. If you must change it, you can expect the HPE Nimble Storage dHCI vCenter Plugin to display the error message shown in Figure 2.

FIGURE 2. Error message caused by changing workload profile HPE ESXi image
Hewlett Packard Enterprise provides HPE custom ESXi images (often referred to as just “custom images”) that integrate support for advanced HPE ProLiant features into the standard ESXi code to deliver a seamless deployment experience. HPE custom ESXi images simplify the process of configuring and deploying the ESXi hypervisor. Certain HPE ProLiant servers require the use of a custom image to run the ESXi hypervisor.

NOTE
The HPE custom ESXi image is installed by default on every dHCI compute node. It is a required component, and it cannot be removed or replaced by a standard VMware ESXi image.

Page 329 of 402 ends

13.B

Page 1517 of 1602 ends

Technical white paper Page 9

HPE Storage Connection Manager
HPE Storage Connection Manager manages connections from the host to volumes on HPE Nimble Storage systems. To simplify the configuration of multiple connections and multipath input/output (MPIO), NimbleOS requires only one IP address (the iSCSI discovery IP address) to be advertised, instead of requiring the full set of iSCSI network interfaces to be advertised at the time of discovery The connection manager supports both vVols and regular HPE Nimble Storage volumes.

The path selection plugin (PSP) is a component of the connection manager. PSP uses a round-robin policy based on IOPS to switch between paths to the protocol endpoint (PE) for all I/O directed to vVols. This behavior is the same as that used for regular HPE Nimble Storage volumes in a single array group.

The connection manager manages connections to iSCSI PE LUNs in the following way:
• If a pool consists of multiple arrays in an HPE Nimble Storage group, the connection manager PSP chooses the optimal array paths for I/O to each vVol.
• If any paths to member arrays in the pool are not discovered, PSP automatically rescans the SCSI path. • For iSCSI, connections to all data interfaces are created automatically by the host itself. • If an array data interface IP address is changed, PSP automatically removes the iSCSI sessions that are connected to old data IP addresses and creates connections with the new data IP address.

NOTE
HPE Storage Connection Manager is installed by default on every dHCI compute node. It is a required component and cannot be removed. vSphere customization
During the vSphere customization phase at the HPE factory, each dHCI compute node is set up in the following ways:
• SSH is enabled.
• The default root password is set to Prostack123!
NOTE
Do not change the default root password before starting HPE Nimble Storage dHCI deployment. During deployment, it is possible to change the default root password.

HPE NIMBLE STORAGE DHCI SOLUTION
This section describes the components that are involved in determining access to the HPE Nimble Storage dHCI solution.

Network port usage
The HPE Nimble Storage dHCI solution requires access to multiple components and services in the environment. Figure 3 highlights the connectivity that is required for deploying and managing the solution.

Page 330 of 402 ends

13.B

Page 1518 of 1602 ends

Technical white paper Page 10

FIGURE 3. Required connectivity for deploying the HPE Nimble Storage dHCI solution Table 4 lists the connections that are required between the components of the HPE Nimble Storage dHCI solution and describes the characteristics of the network ports that are used in the solution.

TABLE 4. Characteristics of required connections between solution components Port Protocol(s) Source Destination Service
22 TCP/UDP End user HPE Nimble Storage array SSH
80 TCP/UDP/HTTP End user HPE Nimble Storage array Permanent forward to port 443 123 UDP HPE Nimble Storage array NTP server NTP peer
161 UDP HPE Nimble Storage array SNMP server SNMP agent listener (optional) 162 UDP HPE Nimble Storage array SNMP server SNMP trap originator (optional) 427 TCP/UDP HPE Nimble Storage array ESXi SLP
22 TCP/UDP HPE Nimble Storage array ESXi SSH
443 HTTPS HPE Nimble Storage array Update.nimblestorage.com Web server for update download 443 TCP/HTTPS HPE Nimble Storage array ESXi ESXi API
443 TCP/HTTPS HPE Nimble Storage array vCenter Server vCenter API data collection 443 TCP/HTTPS End user HPE Nimble Storage array HPE Nimble Storage web UI 8443 TCP/HTTPS HPE Nimble Storage array vCenter Server VASA vVol TLS listener 8443 TCP/HTTPS vCenter Server HPE Nimble Storage array VASA vVol TLS listener

Page 331 of 402 ends

13.B

Page 1519 of 1602 ends

Technical white paper Page 11

8443 TCP/HTTPS HPE Nimble Storage array ESXi VASA vVol TLS listener 8443 TCP/HTTPS ESXi HPE Nimble Storage array VASA vVol TLS listener 22 TCP/UDP End user iLO iLO SSH
443 TCP/HTTP End user iLO iLO web UI
17990 TCP End user iLO iLO remote console
443 HTTPS HPE Nimble Storage array iLO iLO API data collection 22 TCP/UDP End user Switches SSH
443 TCP/HTTP End user Switches Switch web UI
22 TCP/UDP HPE Nimble Storage array Switches SSH (needed only for network automation) 443 TCP/HTTP HPE Nimble Storage array Switches Switch web UI (needed only for network automation and periodic data collection)

In addition to the listed connections, the ESXi host must be able to reach the vCenter Server and vice-versa. For more information, see VMware Knowledge Base article 1012382: TCP and UDP Ports required to access VMware vCenter Server, VMware ESXi and ESX® hosts, and other network components.

Network automation
Starting with OS release 6.0.x, the HPE Nimble Storage dHCI solution introduces a feature to automate the configuration of the Ethernet switches through SSH and secure APIs.

NOTE
At the time of writing this document, only HPE Aruba 8325 and HPE Aruba 8360 are supported.

You will be asked to set a password for a user that will be created by dHCI for network automation. The user account name is dhci_admin_arraiserial. This user will have administrator privileges, and the user’s identity cannot be changed after deployment.

After deployment is complete, you can change the user password for this specific account by using the HPE Nimble Storage dHCI vCenter plugin.

The credentials are stored on the HPE Nimble Storage array and are encrypted.

SSH
The HPE Nimble Storage dHCI solution requires SSH to always be enabled on each dHCI compute node at the vSphere level.

SSH cannot be disabled on the dHCI compute node because it is required for the following features to work:
• Add new node
• Update features
• Configuration checks
• Network automation
SLP
The Service Location Protocol (SLP) is used by devices to announce services on a local network. SLP is enabled by default with ESXi.

As Figure 4 shows, the HPE Nimble Storage dHCI solution uses SLP to discover new dHCI compute nodes during deployment or during add node tasks, an option that is available in the HPE Nimble Storage dHCI vCenter plugin.

Page 332 of 402 ends

13.B

Page 1520 of 1602 ends

Technical white paper Page 12

FIGURE 4. SLP connections to the management VLAN
SLP can be stopped on each dHCI compute node after deployment is complete.

If you cannot use SLP in your environment, you can add nodes manually during deployment or add them from the HPE Nimble Storage dHCI vCenter plugin.

For more information, see HPE Nimble Storage dHCI and VMware vSphere Deployment Guide - New HPE Nimble Storage dHCI array with existing Server and an existing vSphere cluster or HPE Nimble Storage dHCI and VMware vSphere Deployment Guide - New Servers Deployment.
vCenter user
During deployment of HPE Nimble Storage dHCI solution, a vCenter user is needed to register the HPE Nimble Storage dHCI vCenter plugin and create the vSphere cluster. This user must have the administrator role and must have administrator-level privileges on the vCenter.

The credentials are stored on the HPE Nimble Storage array and are encrypted.

ESXi root user
During deployment of the HPE Nimble Storage dHCI solution, you will be asked to change the root password for all ESXi hosts.

HPE Nimble Storage dHCI requires access as root on each ESXi host. After the setup, the root password can be changed on each host by using the HPE Nimble Storage dHCI vCenter plugin.

The credentials are stored on the HPE Nimble Storage array and are encrypted. iLO prostack_admin user
During deployment of HPE Nimble Storage dHCI solution, you will be asked to set a password for an iLO user that will be created by the solution. The iLO user account name is prostack_admin. This user will have administrator privileges, and the user’s identity cannot be changed after deployment.

The iLO password for this specific account can be changed after deployment by using the HPE Nimble Storage dHCI vCenter plugin.

The credentials are stored on the HPE Nimble Storage array and are encrypted.

Single-click update feature
The HPE Nimble Storage dHCI solution provides a single-click update feature to simplify the lifecycle management of the HPE Nimble Storage array, the HPE ProLiant Server firmware, the HPE ESXi image, and the connection manager. This feature takes care of downloading all the components required for an update.

The HPE Nimble Storage array must be able to reach update.nimblestorage.com over port 443 to download the software.

To download the required software, the HPE Nimble Storage dHCI solution creates a mutual trust authentication that uses a full two-way TLS with update.nimblestorage.com, as shown in Figure 5.

Page 333 of 402 ends

13.B

Page 1521 of 1602 ends

Technical white paper Page 13

FIGURE 5. Mutual trust arrangement
HPE InfoSight
HPE InfoSight provides cloud-based predictive analytics for the HPE Nimble Storage dHCI solution as well as for HPE Nimble Storage arrays, HPE 3PAR StoreServ, HPE StoreOnce, and HPE SimpliVity. HPE InfoSight has visibility up through the technology stack into the network, the hosts, and the virtual infrastructure.

HPE InfoSight has powerful audit, wellness, and ethical hacking capabilities that can help keep your infrastructure secure. For example, HPE InfoSight routinely and automatically polls the following conditions:
• Whether the array is using the default admin password • Whether management IP addresses are exposed on the internet NOTE
Customers are responsible for their logical network access, but human error exists. The HPE Support team notifies you if your management IP addresses are exposed. To date, Hewlett Packard Enterprise has protected over 500 TB of data from exposure.

For more information about this service, see HPE InfoSight Security for HPE Storage: Secure Predictive Analytics in the Cloud.

In the context of the HPE Nimble Storage dHCI solution, the HPE Nimble Storage array collects data from HPE ProLiant, vCenter, and switches (if network automation is used), aggregates it, and sends it to HPE InfoSight. Figure 6 shows an overview of the process.

Page 334 of 402 ends

13.B

Page 1522 of 1602 ends

Technical white paper Page 14

FIGURE 6. Movement of data in the solution
Accessing the HPE Nimble Storage dHCI solution through the HPE Nimble Storage vCenter plugin The HPE Nimble Storage vCenter plugin is the management tool for HPE Nimble Storage dHCI. It is implemented as a vCenter plugin and is automatically registered as part of the dHCI solution, so no additional configuration or deployment is required.

Microsoft Active Directory integration
The HPE Nimble Storage array can be integrated into an AD domain after deployment. For more information, see the appropriate HPE Nimble Storage Administration Guide for your version of NimbleOS.

Role-based access control with dHCI
The HPE Nimble Storage dHCI solution requires RBAC privileges, including privileges used by the HPE Nimble Storage dHCI vCenter plugin and additional VMware® privileges. The HPE Nimble Storage dHCI solution automatically installs the VMware privileges it needs.

Table 5 lists the privileges that are available with the HPE Nimble Storage dHCI solution.

TABLE 5. HPE Nimble Storage dHCI solution privileges
Privilege name Description
View Server User can see the server inventory from the HPE Nimble Storage dHCI vCenter plugin.

Add Server User can add a new server by using the HPE Nimble Storage dHCI vCenter plugin.

Remove Server User can remove a server from the cluster by using the HPE Nimble Storage dHCI vCenter plugin.

Update Password User can update the ESXi root password, the iLO dHCI password, and the network switch dHCI password.

Identify User can turn the LED indicator on and off for servers.

Software Update User can initiate the HPE Nimble Storage dHCI solution update feature.

Page 335 of 402 ends

13.B

Page 1523 of 1602 ends

Technical white paper Page 15

VMWARE VSPHERE AND HPE PROLIANT SECURITY
The guides described in this section document the security requirements for the VMware vSphere® platform and the HPE ProLiant servers that are used in the solution.

VMware vSphere Security Configuration Guide
VMware provides a security configuration guide that describes best practices to harden your vSphere solution. The VMware vSphere Security Configuration Guide can be used and implemented with an HPE Nimble Storage dHCI solution with a single exception: SSH cannot be disabled on ESXi hosts that are used with the HPE Nimble Storage dHCI solution.

For more information, see the VMware vSphere Security Configuration Guide.

HPE ProLiant Gen10 Security Reference Guide
HPE ProLiant provides a security configuration guide that contains best practices to harden HPE ProLiant Gen10 servers. This guide can be used and implemented with an HPE Nimble Storage dHCI solution without any issues.

For more information, see the HPE Gen10 Security Reference Guide.

SUMMARY
The infrastructure components of your organization—such as data storage arrays, servers, and Ethernet switches—must support its security policies because security involves all aspects of the IT infrastructure. You can be assured that Hewlett Packard Enterprise requires all HPE products in your infrastructure to operate in secure environments without allowing information to be compromised and that this requirement drives these products’ superior quality and capabilities.

The HPE Nimble Storage dHCI solution and its associated products are designed to meet your security needs. Available service capabilities include on-premises monitoring and roll-up of information to the HPE InfoSight portal for analysis. With HPE products, you determine the type and amount of information reported and who can access it, so the security of your information is always under your control.

Page 336 of 402 ends

13.B

Page 1524 of 1602 ends

Technical white paper
Make the right purchase decision.

Contact our presales specialists.

Get updates

© Copyright 2021 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.

Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Active Directory and Microsoft are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. VMware ESXi, VMware ESX, VMware vCenter Server, VMware vSphere, VMware vSphere Hypervisor, VMware Server, VMware vCenter, VMware vSphere Virtual Volumes, and VMware are registered trademarks or trademarks of VMware, Inc. and its subsidiaries in the United States and other jurisdictions. All third-party marks are property of their respective owners. a00114712ENW, May 2021, Rev 1

Resources, contacts, or additional links
HPE InfoSight Security for HPE Storage - Secure Predictive Analytics in the Cloud https://infosight.hpe.com/InfoSight/media/cms/active/public/tmg_HPE_InfoSight_Security_- _Secure_Predictive_Analytics_in_the_Cloud_doc_version_family.pdf HPE Nimble Storage dHCI and VMware vSphere Deployment Guide - New HPE Nimble Storage dHCI array with existing Server and an existing vSphere cluster
https://infosight.hpe.com/InfoSight/media/cms/active/public/HPE_Nimble_Storage_dHCI_and_VMware_vSphere_Deployment_Guide_- _Brownfield_Deployment.pdf
HPE Nimble Storage dHCI and VMware vSphere Deployment Guide - New Servers Deployment https://infosight.hpe.com/InfoSight/media/cms/active/public/HPE_Nimble_Storage_dHCI_and_VMware_vSphere_6.7_Deployment_Guide_- _Greenfield_Deployment.pdf
HPE Nimble Storage SmartSecure Encryption Technical White Paper https://infosight.hpe.com/InfoSight/media/cms/active/public/tmg_HPE_Nimble_Storage_SmartSecure_Encryption_Technical_White_Paper_do c_version_family.pdf
REST API Reference Version Guide
https://infosight.hpe.com/InfoSight/media/cms/active/public/pubs_REST_API_Reference_NOS_53x.whz/tvi1592937804287.html HPE Gen10 Security Reference Guide
https://support.hpe.com/hpesc/public/docDisplay?docId=a00018320en_us

VMware vSphere Security Configuration Guide
https://www.vmware.com/security/hardening-guides.html

LEARN MORE AT
hpe.com/storage

Page 337 of 402 ends

13.B

Page 1525 of 1602 ends

Check if the document is available
in the language of your choice.

PROTECTING DATA FROM

RANSOMWARE WITH

HPE STOREONCE CATALYST
Ransomware cannot affect what it cannot see

CONTENTS
Executive summary .............................................................................................................................................................................................................................................................................................................. 2 Audience .................................................................................................................................................................................................................................................................................................................................. 2 Background ................................................................................................................................................................................................................................................................................................................................. 2 HPE StoreOnce Catalyst features and benefits ......................................................................................................................................................................................................................................... 3 Data is isolated and protected............................................................................................................................................................................................................................................................................. 3 Command and data sessions ................................................................................................................................................................................................................................................................................ 3 Interprocess communication ................................................................................................................................................................................................................................................................................. 4 Backup methodologies ..................................................................................................................................................................................................................................................................................................... 4 Backup applications ............................................................................................................................................................................................................................................................................................................. 4 Immunize backup repositories against viruses .................................................................................................................................................................................................................................... 4 HPE StoreOnce Catalyst array integration with HPE Recovery Manager Central and backup applications ..................................................................................... 5 HPE Recovery Manager Central ........................................................................................................................................................................................................................................................................ 5 Backup Applications ..................................................................................................................................................................................................................................................................................................... 5 Ransomware protection in the cloud with HPE Cloud Volumes Backup ............................................................................................................................................................................ 5 Conclusion .................................................................................................................................................................................................................................................................................................................................... 6 Call to action ............................................................................................................................................................................................................................................................................................................................... 6 Technical white paper

Page 338 of 402 ends

13.B

Page 1526 of 1602 ends

Technical white paper Page 2

EXECUTIVE SUMMARY
Ransomware has been on the rise. Although it has existed since 1989, criminal organizations started developing and distributing ransomware as an attack vector since 2013. Over the years, these attacks have been perfected to target a very vulnerable set of systems and protocols. Any company that has been impacted by malware should seriously consider the possibility that ransomware is also hidden within their environments.

In 2020, the threat landscape evolved to use COVID-19 for successfully depositing ransomware in networks. Changes in preventive and detective controls to accommodate flexible working practices as well as constraints on IT security teams during lockdowns have contributed to the vulnerability of the workplace.

When it comes to ransomware, the primary weakness in any storage system is within the user authentication process. This white paper covers common authentication methods and how they are compromised. Impacts to the data stored within various types of storage are summarized, including file-sharing technology, along with object and block devices as related to the issue of ransomware. This paper also provides technical detail on how ransomware impacts the traditional storage mechanisms employed by most businesses, as well as how Hewlett Packard Enterprise (HPE) StoreOnce Catalyst can help protect your enterprise data from ransomware and other forms of malware.

Audience
This paper is intended for information assurance and data protection technologists who are executive staff or IT operations staff responsible for the protection of enterprise data. It is assumed that subjects such as networking, storage area networks, data shares, encryption, malware, and backup are understood, as are the protocols they use. For those not already familiar with ransomware and the associated risks, refer to the HPE technical white paper Ransomware: Ensuring Protection from a Growing Threat.

BACKGROUND
The use of ransomware attacks is more prevalent today simply because it is a relatively low-touch attack method for criminals, and it works.

Criminal groups are pivoting to COVID-19-themed lures in order to exploit end users’ concerns over the pandemic and the safety of their loved ones. Remote working significantly increases the risk of a successful ransomware attack due to a combination of weaker controls on home IT and a higher likelihood of users clicking on COVID-19-themed ransomware lure emails. Ransomware has real consequences for victims who, if affected, will find themselves requiring data recovery, paying the ransom due to a lack of preparedness (or lack of secure backups), or accepting the loss of their data altogether. Some sources estimate the revenue generated from ransomware attacks in 2020 alone at $20 billion.1 The cost for victims is obviously much greater than the ransom itself. There are significant costs associated with downtime, loss of productivity, and a potentially permanent loss of customers when they are not served appropriately. Furthermore, making significant changes to the enterprise infrastructure and processes to prevent future compromises can be costly considering the time, resources, and money required.

Traditionally, organizations are leveraging a variety of methods to retain and make redundant copies of data. For example, snapshots and replication of network attached storage (NAS), Network File System (NFS) data shares, and Common Internet File System (CIFS) data shares are used to connect, map, and provide data services, all of which are susceptible to ransomware encryption malware.

Online and nearline file-based storage commonly leverages the cross-platform Server Message Block (SMB) protocol to map network drives and read/write remote files in Windows environments (Samba for Linux®/UNIX®). The longevity and backward compatibility of SMB make it widely adopted for general-purpose file storage; although it functions very well for this purpose, it also carries inherent risk in the case of ransomware and should not be relied upon as a mission-critical data repository. SMB can be utilized as a cost-effective and efficient means of temporarily storing data for small businesses or work groups in an enterprise, but eventually all critical data needs to be stored securely.

The primary weakness in securing SMB is in the authentication process. Commonly NT LAN Manager (NTLM) is used in smaller shops and work groups, and Kerberos is used in larger enterprises where a separate authentication server is deployed for this purpose. SMB authentication is the process of confirming a valid user and system combination (system logon credentials) for which rigorous policies should be in place. Different machines on a network then exchange authentication information using NTLM or Kerberos in a challenge-and-response process as needed.

SMB can be made vulnerable in either authentication scenario using pass-the-hash attacks. Authentication using a hash of the user’s system password or a Kerberos ticket during the SMB connect exchange with the server is stored in the memory of every system accessed until powered down (assuming volatile memory) in Single Sign-On (SSO) environments. Attackers can grab this hash by playing man in the middle through packet captures or after compromising either the client or server where the hash resides in memory from a memory dump.

After the NTLM hash is captured, it is easily used by an attacker. NTLMv1 should not be used at all per Microsoft because it uses an MD4 hash with 56-bit encryption chunks that almost any computer can easily crack. NTLMv2 is better because it has MD5 encryption that should prevent cracking the hash, but this still does not protect a connection from the man-in-the-middle approach where a hostile server intercepts and forwards the uncracked but still valid credentials during the authentication process. This is why strict data classification and authentication policies are so vital for helping to protect an organization and minimize the number of users with access to critical data.

1 PurpleSec: 2021 Ransomware Statistics, Data, & Trends

Page 339 of 402 ends

13.B

Page 1527 of 1602 ends

Technical white paper Page 3

The same is true for object and block storage devices that do not incorporate immutable data technologies. Applications and block devices that use immutable data storage technologies might prevent ransomware from affecting some portion of your data, but there are too many variations to detail here. The integration of immutable block technologies with other common enterprise systems and software should be completely investigated before relying on them as a preventative measure against ransomware. Block devices with or without immutable technologies are susceptible to the same authentication issues described here for SMB and Samba. The immutable technology might be able to provide access to unaffected original block data even when the majority of revised data is affected; however, how much and how efficiently data can be recovered can present a challenge especially for large enterprises.

After a storage system integrated with Active Directory has been compromised, it is wide open to an attack that is difficult to identify because legitimate processes and credentials are used to take advantage of the compromised systems. Usually the only way to recognize this means of attack is when things start to go wrong. Obviously, this is far too late.

HPE STOREONCE CATALYST FEATURES AND BENEFITS
The HPE StoreOnce purpose-built backup appliance and HPE StoreOnce Catalyst bring a wealth of benefits to an organization in the way of space-efficient backup, deduplication, data lifecycle management, and information assurance. However, the single most important feature of HPE StoreOnce Catalyst is its ability to completely isolate data from being tampered with unintentionally.

Data is isolated and protected
HPE StoreOnce is a purpose-built backup appliance (or virtual machine) that includes HPE StoreOnce Catalyst stores to effectively isolate critical data where attackers cannot have impact on it without resorting to direct physical interactions that ultimately would result in the destruction of some or all of the hardware itself. Even when physical destruction is achieved at a single location, whether from malware or a natural disaster, the more advanced implementation of HPE StoreOnce Catalyst stores (distributed implementation) would effectively protect mission-critical data by effectively isolating it from traditional lines of communication and command sets leveraged by ransomware attackers.

HPE has hidden the Catalyst store from attackers in plain sight but behind an application programming interface (API) that both enhances and simplifies the process of backing up and deduplicating data while making it practically impossible for ransomware to attack it directly.

HPE StoreOnce Catalyst stores do not preven t the rest of the enterprise from being compromised by malware, but they will protect the mission-critical data stored from being either targeted or affected. Ransomware cannot encrypt what it cannot see, and because the Catalyst store does not use standar d operating system command instructions for its operations, malware cannot become active while inside. HPE StoreOnce Catalyst efficiently backs up and restores data using a tamperproof method. HPE StoreOnce Catalyst, initially designed for use as a disk -based solution and now extended to the cloud, is capable of leveraging deduplication, compression, encryption, and data isolation for backup and archiving processes. HPE StoreOnce Catalyst prevents ransomware from accessing data on the HPE StoreOnce appliance ensuring data integrity.

Command and data sessions
The Catalyst architecture is accessed through an API command set that is directly integrated into a backup application media agent, which includes the HPE StoreOnce Catalyst client library. This library is effectively an API that uses a proprietary set of commands to send and retrieve data from the Catalyst store using command and data sessions, as shown in Figure 1.

FIGURE 1. Command and data session communication
Backup
servers
Backup application media agent
HPE StoreOnce Catalyst client library
HPE StoreOnce
backup system HPE StoreOnce Catalyst server
Catalyst store
Catalyst items
Catalyst store
Catalyst items
Command
sessions
Data
sessions

Page 340 of 402 ends

13.B

Page 1528 of 1602 ends

Technical white paper Page 4

These command and data sessions are comparable to the SMB (or Samba) connections in a traditional datastore using NAS and similar technologies. The key difference with the HPE StoreOnce Catalyst store is that it does not rely on the same authentication methodology or most importantly the same set of instructions stemming from the operating system that these other technologies do. HPE StoreOnce Catalyst can be considered a kind of demilitarized zone where malware is concerned.

It is this separation from the operating system instruction set that isolates and protects the HPE StoreOnce Catalyst store and its items from a ransomware attack. The systems that the Catalyst media agent reside upon are still vulnerable to attack without further hardening, and the malware itself could be potentially sent across the network to the Catalyst store; however, the Catalyst store itself is completely protected from being encrypted by the malware due to the separation of it from any usable command sets (targeted operating systems such as Windows and Linux). All communication to and from the HPE StoreOnce Catalyst store is sent through the Catalyst client library (API) and its associated command and data sessions that create the pipes between systems using HPE technology specific to this task.

The command and data sessions run over standard TCP/IP Ethernet or Fibre Channel connections depending on the HPE StoreOnce model.

These sessions use remote procedure call (RPC) through the API, which causes subroutines to run in different memory address spaces on each system associated with the solution. The memory segregation further isolates the process by adding additional protective layers between the data and the malware before it gets to the Catalyst store, taking the layered security methodology all the way to the end point.

This is also conducive to cross-platform data movements where instruction sets are likely not the same (for example, Windows to Linux).

Interprocess communication
The item of importance where ransomware is concerned is that all communication between the backup server and the HPE StoreOnce Catalyst store is handled using interprocess communication (IPC), which is a mechanism within the context of RPC used to enable communication between a client and a server regardless of where the parts are physically located (remotely, same system, and so on). This communication is not dependent on the local operating system command set to perform its duties. This secures the data, not the device, and enables data mobility in a way that brings the data closer to the systems where compute happens, increasing efficiency and potentially decreasing costs while eliminating risk. How HPE implements deduplication on HPE StoreOnce appliances is not directly relevant to the security aspect of the Catalyst solution aside from employing encryption algorithms to reduce the data set size, but additional information can be found in other documentation referenced in the Resources section of this white paper.

BACKUP METHODOLOGIES
Data isolation effectively protects the data, but efficient data management requires the use of one or more technologies depending on the services and efficiency requirements of an organization. One consideration should be the implementation of solid backup methodologies as indicated by the United States Computer Emergency Readiness Team (US-CERT) in its report Data Backup Options . The 3-2-1-1 rule refers
to the practice of creating at least three copies of data (one primary copy and two backups). Two copies are stored on at least two different types of media (for example, disk and tape) with at least one copy stored off-site and one copy offline.

BACKUP APPLICATIONS
Several software vendors have integrated HPE StoreOnce Catalyst technology into their data protection applications, providing advanced backup, data management, and automation capabilities. Using the 3-2-1-1 backup methodology as recommended by US-CERT is still very applicable as a process control even when HPE StoreOnce Catalyst isolates the data. The 3-2-1-1 method helps to ensure data is protected from a variety of potential problems, including human error and natural disasters. One unique and very useful third-party capability is Veeam Mount Server, which enables the ability to immediately mount backed up virtual machine files for instant VM recovery and unparalleled RTO efficiency when combined with HPE StoreOnce Catalyst. VMs recovered in this fashion are mounted Read-Only by default, further protecting the environment should any malicious software remain within the backup data.

Immunize backup repositories against viruses
The best backup solution is useless if ransomware can access your backup repositories. Figure 2 illustrates how HPE StoreOnce Catalyst provides protection for backup repositories. Backup applications integrated with HPE StoreOnce Catalyst stores primarily enhance the ability to manage the lifecycle of backup data through policies and scheduling.

Page 341 of 402 ends

13.B

Page 1529 of 1602 ends

Technical white paper Page 5

FIGURE 2. HPE StoreOnce Catalyst protects data because the repository is only visible through the Catalyst API

HPE STOREONCE CATALYST ARRAY INTEGRATION WITH HPE RECOVERY MANAGER

CENTRAL AND BACKUP APPLICATIONS
HPE Recovery Manager Central
HPE Recovery Manager Central (RMC) is tailored to many enterprise software applications to enable the ability to create snapshots, replicate volumes, and back up storage while providing stringent recovery point objective (RPO) and r ecovery time objective (RTO) service-level agreements (SLAs) in conjunction with HPE Primera and HPE Nimble Storage 2 arrays. All-flash enabled applications running on HPE 3PAR StoreServ or HPE Primera arrays can take advantage of crash consistent backups and snapshots to ensure that the right data is available for recovery at the right time. The HPE StoreOnce Catalyst store serves as an ideal final destination for any information on the array that is considered mission -critical enough to protect from ransomware. When used in conjunction with HPE RMC, the HPE StoreOnce Catalyst store is fully integrated for a seamless and efficient data protection experience. Additional information about these products can be found in the Resources section or through speaking with an HPE Presales professional.

Backup Applications
Many backup software products such as Commvault CommServe and Veeam Backup & Replication are integrated with HPE StoreOnce Catalyst leading to faster backups and recovery. A greater number of backup images can be stored on disk, providi ng more recovery points and faster restores from backups. HPE StoreOnce variable -length deduplication provides a fine -grained deduplication capability that increases the overall storage efficiency of backups and reduces costs. HPE StoreOnce allows you to d eduplicate across the backup jobs, further improving deduplication efficiency. Commvault CommServe and Veeam Backup & Replication software integration inc ludes reliable security and ransomware protection that fends off increasing risks of cyberthreats now and into the future, delivering unprecedented resiliency for companies of any size. HPE StoreOnce Catalyst effectively isolates critical data so attackers ca nnot access it without resorting to direct physical interactions. Even in instances a single locati on is physically compromised, HPE StoreOnce Catalyst stores continue to protect mission- critical data by effectively isolating the data from traditional lines of communication and command sets leveraged by ransomware attackers.

RANSOMWARE PROTECTION IN THE CLOUD WITH HPE CLOUD VOLUMES BACKUP A modern data protection plan should extend to the cloud for scalability. The cloud offers flexible capacity and supreme agil ity without requiring additional capital investment. Cloud services scale up or down to meet unpredictable demands, and because data is managed off-site, your IT staff is freed up from additional data center tasks.

HPE Cloud Volumes Backup delivers a simple, efficient, and flexible way for users to backup data in the cloud. This enterpris e backup service enables the customer to backup seamlessly to the cloud— directly from any storage using any backup ISV —without changing existing data protection workflows. Start backing up to the cloud in less than 5 minutes with automated backup policies in ju st a few clicks and recover with ease. HPE Cloud Volumes Backup is secure by design and safeguards against any threat with encrypted backups that are invisible to ransomware attacks. Using the proven HPE Catalyst API, it makes backup images invisible and inacc essible to ransomware, ensuring data integrity and enabling restores in the event of an attack. You can restore workloads on -premises or easily leverage public cloud for multiple use cases, such as test/dev, reporting, and analytics, helping you to transform your backup data into a business asset.

2 HPE Nimble Storage RMC integration is planned.

Page 342 of 402 ends

13.B

Page 1530 of 1602 ends

Technical white paper Page 6

CONCLUSION
Data protection has slowly morphed into a never-ending series of disk-based replications and snapshots, which serve to recover specific files quickly. However, the move away from more redundant and secure methods such as tape and off-site archives has left a large security gap for cybercriminals to distribute ransomware. Many organizations can now unfortunately attest that simply backing up data by making copies is not sufficient. If an operating system can see your data, so can ransomware. In traditional backups, knowing what data has been affected and when plays a crucial role in determining which backup repositories can be used to recover post-attack. The 3-2-1-1 rule that data protection specialists have relied on must always be remembered: Preserve three copies of your data on at least two different media types with one stored offline, and one stored offsite at another physical location or in the cloud.

The best method for protecting enterprise data is a c ombination of well documented and communicated policies, effective implementation of critical security controls (particularly access controls) , and HPE StoreOnce Catalyst, which is the critical data protection component in safeguarding data from ransomware in a backup or data archiving solution. HPE StoreOnce Catalyst deployed as the backup target for mission -critical data ensures the ability to recover data from either a specific RTO or a configuration RPO. Most importantly, it shields data from ransomware and other forms of malware that target specific operating systems. HPE StoreOnce Catalyst stores effectively isolate data and protect it from unintende d manipulation and, in the case of ransomware specifically, encryption.

Some companies have tried to hide ransomware incidents, only to have the media report the data breaches later for customers, shareholders, and board members to see. You can find the right hardware and software solution by combining the fully integrated, industry-leading disk technology of HPE Primera and HPE Recovery Manager Central with the HPE StoreOnce Catalyst store technology. The procedures and policies of the US-CERT recommended backup methodology of 3-2-1 ensure true enterprise-level information assurance. Remember that ransomware cannot infect what it cannot see. Be sure your data is securely isolated from cybercriminals with HPE StoreOnce Catalyst stores, and shift from data protection to information assurance.

CALL TO ACTION
Download the 60-day free trial of HPE StoreOnce VSA and try Catalyst stores in your own test and development environment. There are virtual machine versions for VMware ESXi™, Microsoft Hyper-V, and Kernel-based Virtual Machine (KVM).

Resources
HPE Recovery Manager Central
hpe.com/us/en/storage/rmc-backup.html
US-CERT Data Backup Options
us-cert.gov/sites/default/files/publications/data_backup_options.pdf HPE StoreOnce 3100, 3520, 3540, 5100, and 5500 User Guide support.hpe.com/hpesc/public/docDisplay?docId=a00062048en_us&docLocale=en_US Veeam and HPE StoreOnce Catalyst
psnow.ext.hpe.com/doc/4aa6-4336enw
Veritas NetBackup and HPE StoreOnce Catalyst
support.hpe.com/hpsc/doc/public/display?sp4ts.oid=5196525&docId=emr_na-c03616587&docLocale=en_US Center for Internet Security Critical Security Controls cisecurity.org/controls/
NIST Special Publication 1800-11A
Data Integrity—Recovering from Ransomware and Other Destructive Events nccoe.nist.gov/sites/default/files/library/sp1800/di-nist-sp1800-11a-draft.pdf SANS Critical Security Controls poster
sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf Managing HPE Nimble Storage snapshots, replication, and backup to HPE StoreOnce with Veeam psnow.ext.hpe.com/doc/a00030378enw

Page 343 of 402 ends

13.B

Page 1531 of 1602 ends

Technical white paper
Make the right purchase decision.

Contact our presales specialists.

Get updates
© Copyright 2018–2022 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services ar e set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Active Directory, Hyper-V, Microsoft, and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

UNIX is a registered trademark of The Open Group. VMware ESXi is a registered trademark or trademark of VMware, Inc. and its subsidiaries in the United States and other jurisdictions. All third-p arty marks are property of their respective owners. a00042003ENW, March 2022, S-Rev. 3

LEARN MORE AT
hpe.com/us/en/storage/storeonce

Page 344 of 402 ends

13.B

Page 1532 of 1602 ends

1 DATASHEET

AT A GLANCE
VMware Site Recovery Manager™, the
industry-leading disaster recovery (DR)
software, can be consumed as a perpetual
license or as a service through VMware Site
Recovery™ for VMware Cloud™ on AWS.

Site Recovery Manager automates and
orchestrates failover and failback, ensuring
minimal downtime in case of a disaster.

Built-in nondisruptive testing ensures your
recovery time objectives (RTOs) are met.

Site Recovery Manager integrates with a
vast ecosystem of underlying replication
technologies, providing maximum flexibility.

VMware vSphere® Replication™ provides
VM-based replication, supporting a large
variety of underlying storage solutions with
recovery point objectives (RPOs) ranging
from 5 minutes to 24 hours.

KEY BENEFITS
• Perform frequent, nondisruptive testing,
even during business hours, to ensure
predictable recovery objectives
• Reduce recovery time to minutes with
reliability using automated orchestration
workflows
• Achieve zero-downtime application
mobility by orchestrating the live migration
of VMs at scale across sites
• Return to regular operations with ease
using the original recovery plan through
automated failback
• Protect thousands of VMs with centralized
recovery plans, and eliminate manual
runbooks
• Protect investments and tailor RPOs using
supported replication
Simplify DR management with the only VMware-integrated solution that runs on any storage platform
VMware Site Recovery Manager automation software integrates with an underlying replication technology to provide policy-based management, minimize downtime in case of disasters via automated orchestration of recovery plans, and conduct nondisruptive testing of your DR plans. It is designed for virtual machines (VMs) and scalable to manage all applications in a VMware vSphere environment. To deliver flexibility and choice, it integrates natively with VMware vSphere Replication and VMware vSphere Virtual Volumes™ integrated storage arrays, and also supports a broad range of array-based replication solutions available from all major VMware storage partners.

Site Recovery Manager natively leverages the benefits of vSphere and can also take advantage of VMware Cloud Foundation™, integrating with other VMware solutions such as VMware NSX® (network virtualization) and VMware vSAN™ (hyperconverged infrastructure).

By allowing users to test and automate the migration process of applications between sites at scale with minimal or no downtime, Site Recovery Manager fulfills the needs for a variety of use cases, such as disaster recovery, disaster avoidance, planned data center migrations, site-level load balancing and application maintenance testing. Site Recovery Manager ensures fast and highly predictable recovery times, simplifies management through automation and minimizes the total cost of ownership, making it the industry-leading solution to enable application availability and mobility across sites in private cloud environments.

FIGURE 1: Site Recovery Manager automates the failover and migration of VMs to a secondary site. vSphere Replication provides hypervisor-based VM replication. It protects VMs from partial or complete site failures by replicating the VMs, regardless of the underlying storage array, from a primary site to a secondary site, between two clusters in a single site, and from multiple source sites to a single target site. vSphere Replication is VMware Site Recovery
Manager and VMware
vSphere Replication
VMware
vCenter Server®
VMware vSphere vSphere Replication
Storage Replication
Site Recovery
Manager
VMware
vCenter Server
VMware vSphere
Site Recovery
Manager

Page 345 of 402 ends

13.B

Page 1533 of 1602 ends

DATASHEET | 2
VMware Site Recovery Manager and VMware vSphere Replication configured on a per-VM basis, allowing fine control over which VMs are replicated.

After the initial replication, only changes to the VMs are replicated to minimize network bandwidth consumption.

Site Recovery Manager and vSphere Replication power VMware Site Recovery, a new DR-as-a-service (DRaaS) offering for VMware Cloud on AWS, that simplifies deployment, provides reliable DR capabilities and reduces overall costs.

Site Recovery Manager key benefits and capabilities
Fast and reliable recovery
Site Recovery Manager automates every aspect of executing a recovery plan to accelerate recovery and eliminate the risks involved with manual processes:
• Automated orchestration workflows – Perform a DR failover or a planned migration, and failback recovered VMs to the original site, all executing the same recovery plan with a single click.
• Automated recovery of network and security settings – Eliminate the need to re-configure IP addresses on recovered VMs via integration with NSX. Security policies are also preserved, further reducing configurations post-recovery. • Nondisruptive recovery testing – Perform automated failover testing as frequently as needed in an isolated network to avoid impact to production applications, and ensure regulatory compliance through detailed reports.

Zero-downtime application mobility
Site Recovery Manager can enable live migration of applications at scale between two sites when using a certified stretched solution:
• Orchestrated cross-vCenter vMotion – Use recovery plans to orchestrate cross- vCenter® vMotion® operations at scale when using stretched storage. Perform zero-downtime disaster avoidance and data center migrations. • Stretched storage support – Deliver benefits to users:
– For Site Recovery Manager users, it improves recovery time and enables zero- downtime, zero-data-loss application mobility through orchestrated vMotion. – For stretched storage users, it adds the benefits of nondisruptive testing and orchestrated VM recovery.
• Integration with a broad range of replication solutions – Flexibly tailor your organization’s topologies and RPOs.

For more information, see the VMware Compatibility Guide.

Simplified DR management
From initial setup to ongoing management, Site Recovery Manager delivers simple and policy-based operations thanks to automation and integration with VMware Cloud Foundation technology:
• Centralized recovery plans – Create and manage recovery plans for thousands of VMs directly from the intuitive vSphere Web Client powered by a new HTML5 user interface.
• Policy-based management – Utilize storage profile protection groups to identify protected datastores, automate the process of protecting and unprotecting VMs, and adding and removing datastores from protection groups. • Self-service provisioning – Allow application tenants to provision DR protection using blueprints in VMware vRealize® Automation™.

Page 346 of 402 ends

13.B

Page 1534 of 1602 ends

All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. and its subsidiaries in the United States and other jurisdictions.

All other marks and names mentioned herein may be trademarks of their respective companies. Item No: 463615-aq-ds-site-rcvy-mgr-vsphr-rep 2/20

FOR MORE INFORMATION OR TO

PURCHASE VMWARE PRODUCTS
Call 877-4-VMWARE (outside
North America, +1-650-427-5000),
visit vmware.com/products or search
online for an authorized reseller. For
detailed product specifications and
system requirements, refer to the
vSphere documentation.

LEARN MORE
Visit the Site Recovery Manager
product page
Visit the Site Recovery product page
vSphere Replication key benefits and capabilities
Minimal disaster impact – Get RPOs as low as five minutes.

Maximum flexibility – Gain compatibility with vSAN and a broad ecosystem of storage arrays.

Simplified management – Manage directly using vSphere Web Client or VMware vRealize Orchestrator™.

How to buy
Site Recovery Manager is available in two editions to help protect your environment according to your business needs. For more information, read the purchasing options.

Both editions of Site Recovery Manager are licensed per protected VM.

SITE RECOVERY

MANAGER STANDARD

SITE RECOVERY

MANAGER

ENTERPRISE
Licensing Up to 75 protected VMs
per site
No licensing limitation on
the number of protected
VMs
Features NSX integration
Orchestrated cross-
vCenter vMotion
Stretched storage support
Storage policy-based
management
FIGURE 2: Site Recovery Manager editions.

For VMware Site Recovery for VMware Cloud on AWS purchase options, please visit the VMware Site Recovery product page.
vSphere Replication is included in vSphere Essentials Plus and higher.

Page 347 of 402 ends

13.B

Page 1535 of 1602 ends

Zerto 7.0 Platform Overview DATASHEET

IT RESILIENCE
Zerto first introduced hypervisor-based replication in 2011 and revolutionized disaster recovery for VMWare and Microsoft Hyper-V environments. Taking it into the Cloud, Zerto added support for Microsoft Azure, IBM Cloud and Amazon Web Services (AWS). Expanding its vision, Zerto now converges disaster recovery, backup and cloud mobility into a single IT Resilience Platform ™. This allows you to replace multiple legacy solutions with a single, simple and scalable platform that delivers a continuous, always-on customer experience. Simplified workload mobility protects, recovers and moves applications freely across hybrid and multi-cloud environments with over 6,000 customers globally now relying on Zerto’s platform.

Zerto IT Resilience Platform ™
Zerto’s IT Resilience Platform converges disaster recovery, backup, and workload mobility whether on-premises or to, from and between hybrid and multi-cloud environments. Built on a foundation of continuous data protection (CDP) with built-in orchestration and automation capabilities, the platform provides you with simplicity, enterprise scale, and agile data protection to save time, resources and costs. Analytics, with intelligent dashboards and live reports, gives you complete visibility across multi-site and multi-cloud environments and instills confidence that business service levels and compliance requirements are met.

Continuous Data Protection (CDP)
• Continuous Data Replication – Zerto delivers recovery point objectives (RPOs) of seconds by replicating every change that is generated in near real-time. Performed at the platform level, this enables continuous capability by removing any production impact.

Zerto 7.0 Platform Overview
Zerto IT Resilience Platform
Converged
Backup
Multi-Cloud
Hybrid Cloud
Disaster
Recovery
Orchestration
Migration
Analytics
Lower IT Costs, Complexity & TCO
Orchestration & Automation
Non-DisruptiveWorkload MobilityMulti-Cloud
Continuous Data Protection
Journal-Based Recovery
Long-Term RetentionApplication Consistency Grouping
Continuous Data Replication
Analytics & Control
Zerto IT Resilience Platform
TM

Page 348 of 402 ends

13.B

Page 1536 of 1602 ends

Zerto 7.0 Platform Overview DATASHEET
• Journal-Based Recovery – All replicated changes are stored in a journal for up to 30 days providing incredible recovery granularity through checkpoints inserted every few seconds. This reduces data loss to just seconds by enabling recovery of files, VMs, applications or entire sites, either to the latest point-in-time or, for example, when the virtual machine (VM) is attacked by a virus or ransomware, to a point-in-time before the attack.
• Application Consistency – Today’s applications are rarely run on a single VM, but instead most applications have multiple VM dependencies.

Traditional methods of protecting VMs individually result in significant challenges to recovering complete applications quickly. Zerto resolves this by using our Virtual Protection Group (VPG) capability. VPGs allow you to protect multiple VMs together in a consistent fashion, ensuring every point in time that is inserted into the Zerto Journal is from the same point in time for all VMs within the VPG. This allows consistent recovery of an entire application, and all its VM dependencies, to a consistent point in time. • Long-Term Retention – Compliance standards often require you to keep, and ultimately recover data, for longer than 30-days. Long-term retention utilizes your existing journal to store data from any point in time for days, weeks, months or even years with no production impact.
• Scalability – Zerto simplifies scaling the infrastructure to support disaster recovery. As a new virtual host is added, simply install a new virtual appliance. Although Zerto scales to support very large environments, it provides the same granularity for environments of all sizes, with the same capabilities and no production impact.

Orchestration & Automation
Built in orchestration and automation enables faster management of workloads at scale with minimal touch, allowing IT resources to shift their focus toward innovation and services that help your business run more efficiently. • Zerto’s platform supports your multi-cloud and hybrid cloud strategy, including VMware, Hyper-V, Azure, IBM Cloud, AWS and hundreds of Cloud Service Providers (CSPs). • All recovery settings are configured up-front, such as boot order and re-IP failover, well before any disaster or other event occurs, thus greatly simplifying the recovery process. In fact, it’s so simple, any member of your IT team could perform it in just 3 clicks.
• You can configure different settings for test failovers, ensuring that test failovers/moves can be run at any time with zero impact on production or protection.

Analytics & Control
Zerto Analytics, included in the IT Resilience Platform, provides one single, comprehensive view of your entire multi-site, multi-cloud environment.

Built-in intelligent dashboards provide real-time and historical analysis of the health and protection status of your applications and data. Metrics such as average RPO, network performance, and storage consumption, help you spot trends, identify anomalies, and troubleshoot issues. The powerful resource planning capability continuously monitors and analyses compute, storage and network resources across on-premises environments and public, private and hybrid clouds to give you confidence of your resource requirement needs. ‘What-if’ scenario modelling delivers accurate planning of future storage, compute and network resources. Zerto Analytics helps you make better informed decisions and plans, to achieve an efficient, IT resilient mode of operation.

Rich Kocielko
Sr. Storage and Backup Administrator,
Lippert Components
As we grow, it’s important we
remain up and running to ensure our
employees can serve our customers.

Zerto allows us to meet the RPO/
RTOs we need to keep up with our
customers’ needs.

Sr. Systems Engineer
Leavitt Group
I have been utilizing the Zerto
Analytics dashboard a lot more lately.

It’s saved me a bunch of time in
verifying VPG health on Mondays.

Page 349 of 402 ends

13.B

Page 1537 of 1602 ends

Zerto 7.0 Platform Overview DATASHEET
Capabilities of the Zerto IT Resilience Platform™
Disaster Recovery
Built from the ground up to be the simplest,
yet most powerful solution for virtualized
infrastructures, Zerto addresses all your
replication, recovery orchestration and
automation needs in one single software
platform. The platform allows you to recover
one, all or a subset of virtualized applications
from anywhere to anywhere, maximizing the
benefits of virtualization and cloud.

Through native integration into all supported platforms, Zerto not only allows replication and recovery between any storage arrays, but it also protects across and between multiple hypervisors and public cloud platforms. This market leading technology delivers the best of breed business continuity and disaster recovery solution irrespective of underlying hypervisor, public cloud or storage.

Backup
Zerto has revolutionized backup. Its continuous data replication and journaling technology allow you to achieve RPOs of seconds using journal checkpoints, even up to 30 days ago, instead of the traditional 24-hour recovery time frame. Recover files, applications, VMs, or even entire datacenters by merely pressing a virtual “rewind” button.

Most granular-level recovery use cases—such as file deletions, database corruption, or ransomware—only entail short-term retention and Zerto’s 30-day journal can be utilized for those requirements. However, you may also have compliance requirements to store data for longer retention periods going back years. This is where Zerto’s Elastic Journal concept delivers value.

The Zerto Elastic Journal brings together both short and long-term retention for data protection. Using unified data protection workflows, powered by intelligent index and search, it enables quick recovery of data—regardless of whether it’s from a few seconds or a few years ago. Data gets copied from the short-term retention journal into the long-term retention repositories according to your requirements. As the short-term journal is already stored on the target side, moving data to long-term retention repositories has no impact on production, so copies can be taken as often as needed, eliminating the concept of “backup windows. ” Michael Sallie
Senior Systems Engineer of Yanfeng
Automotive Interiors
The ability to manage our DR and
backup through a single platform will
be a game-changer. DR and backup
are each time-intensive and are
redundant tasks for our IT team. With
the convergence of the two, we’ll see
much less of our team’s time spent
managing them separately, freeing
them up to work on other important IT
needs. We also anticipate significant
efficiency increases through the
ability to replicate once for both DR
and backup, not only saving time but
saving costs.

Intelligent Index & Search
Elastic Journal
Data Protection Workflows
Compliance
Granular –
86% Use
Cases
Long Term Retention Short-term Retention

Page 350 of 402 ends

13.B

Page 1538 of 1602 ends

About Zerto
Zerto helps customers accelerate IT transformation by eliminating the risk and complexity of modernization and cloud adoption. By replacing multiple legacy solutions with a single IT Resilience Platform, Zerto is changing the way disaster recovery, data protection and cloud are managed. With enterprise scale, Zerto’s software platform delivers continuous availability for an always-on customer experience while simplifying workload mobility to protect, recover and move applications freely across hybrid and multi-clouds. www.zerto.com Copyright 2019 Zerto. All information may be subject to change.

IS-12382
Cloud and Workload Mobility
Zerto’s IT Resilience Platform removes limitations that have traditionally made migrations lengthy and challenging.

By delivering an agnostic approach to replication, hardware, hypervisor, and cloud, vendor lock-in is removed. This enables true workload mobility across any platform without the need for manual conversions or implementations.

The Zerto journaling technology allows for testing and validation prior to any live migration, providing you with peace of mind. With continuous data protection, the traditional migration window can be reduced from days to just a few minutes, with no impact on the production environment.

Infrastructure Refresh
Migrate to New Infrastructure in Minutes
Public Cloud Migrations
Migrate to and from Public Clouds
On Premises Migrations
Any Storage, Multi-Hypervisor, Cross Hypervisor
Zerto CSP Migrations
Migrations to and from any Zerto CSP
Mergers & Acquisitions
Simplify M&A Infrastructure Consolidation
Multi-Cloud Migrations
Migrate Between Public Clouds
Zerto’s IT Resilience Platform provides replication, orchestration, and automation together in one comprehensive interface, eliminating the need for additional tools. This makes Zerto the industry standard for fast, seamless and cost-effective data center migrations.

Don’t Just Protect Your Business. Make It Resilient.

READ THE ARCHITECTURE GUIDE FOR THE IT RESILIENCE PLATFORM

Page 351 of 402 ends

13.B

Page 1539 of 1602 ends

Response to City of Hemet Request for Proposal
for HCI Solution and Services
from Hewlett Packard Enterprise Company

May 26, 2022

Page 352 of 402 ends

13.B

Page 1540 of 1602 ends

HPE Proposal Document Page-2

Non-Disclosure
The information in the portions of this proposal or quotation marked as “confidential” constitute trade secrets or information that is confidential or proprietary to Hewlett Packard Enterprise Company (HPE). It is furnished in confidence with the understanding that it will only be used or disclosed for evaluation purposes, unless otherwise required by law or permitted by HPE. If a contract is awarded based on this proposal or quotation, the Customer may use and disclose this information to the extent required by law. The restriction does not limit the Customer's right to use or disclose this information if obtained from another source without restriction.

If HPE's proposal is submitted in both electronic and hard copy formats and the contents differ, only the hard copy will constitute the valid HPE proposal. If no hard copy is submitted and if the content differs between the PDF version and any other electronic format, only the PDF version will constitute the valid HPE proposal.

Page 353 of 402 ends

13.B

Page 1541 of 1602 ends

HPE Proposal Document Page-3

Table of Contents
Cover Letter ........................................................................................................................ 4 Section I Purpose of Request for Proposal and General Terms and Conditions .............. 5 Section II Schedule of Events ........................................................................................ 10 Section III Proposer Qualifications .............................................................................. 11 Section IV Scope of Work ........................................................................................... 12 Section V Evaluation and Award Criteria ................................................................... 25 Section VI Proposal Instructions and Format .............................................................. 27

6.5 PROPOSAL CONTENT .................................................................................... 28 Section VII Cost Sheet Submittal Form Appendix A - Agreement Sample .................. 32 Attachments ..................................................................................................................... 34

Page 354 of 402 ends

13.B

Page 1542 of 1602 ends

HPE Proposal Document Page-4

Cover Letter

May 26, 2022

City of Hemet
Attn: City Manager
Candace Sunds, Procurement Administrator
[email protected]
445 E. Florida Avenue
Hemet, CA 92543

Dear Ms. Sunds:

In response to your Request for Proposal for Hyperconverged Infrastructure Solution and Services , Hewlett Packard Enterprise (HPE) is providing the City of Hemet with a solution that we think best meets your goals and future compute needs.

Always in collaboration and in partnership with the City of Hemet, methodical transition from big iron to speed, workload security and agility, HPE and our comprehensive partner ecosystem has been the City’s go to innovation enablement partner for many years.

Thank you so much for your partnership, collaboration, and your business. We are very much looking forward to continuing this innovative journey together. Over our history together, HPE and the City of Hemet have taken each use case, app, and workload placement with security protocol and policies top of mind. Each decision is made in concert with business, financial, technical, and functional considerati ons driving the highest workload density possible.

The City is taking the right approach to not go at this alone. You have a trusted business partner in HPE with the force and breath of our leading World Class portfolio in all major industries.

Respectfully, thank you so much for the opportunity to work in collaboration with this amazing team. What is essential to managing workloads, no matter where they live, requires best in class resources and expertise to Move, Innovate and Operate in a Hybrid IT (Information Technology) environment inclusive of Public/Private Cloud and SaaS (Software as a Service) from a people, process, technology, and economics perspective all interlaced with critical Security protocol and procedures.

As the City of Hemet has trusted Hewlett Packard Enterprise with their technology needs, it has not come without the test of our competitors. What has weathered constant change and what has kept HPE as your trusted partner has always been due to collaboration with City Leadership and the great people of the City of Hemet.

Hewlett Packard Enterprise and the City of Hemet: Always on, Always Fast, Automated and on Demand, Hybrid by Design with Global AI (Artificial Intelligence) Intelligence.

Thank you for your consideration of our proposal. Please note that the pricing we have provided is indicative of the solution proposed. We look forward to continued discussions of our proposed solutions with you to answering any questions you may have.

Sincerely,
Stacy Woode
Stacy Woode
HPE Sr Enterprise Account Manager
1-512-599-0588
[email protected]

Page 355 of 402 ends

13.B

Page 1543 of 1602 ends

HPE Proposal Document Page-5

Section I Purpose of Request for Proposal and
General Terms and Conditions

1.0 PURPOSE OF REQUEST FOR PROPOSAL (“RFP”)
The City of Hemet is currently seeking proposals for the procurement of a hyperconverged solution and professional services for installation. The City of Hemet is issuing this Request for Proposals (RFP) to invite qualified firms to submit a proposal for design, equipment, software, and services required for the migration from an existing Blade Server VMware environment to a new hyperconverged infrastructure (“HCI”). The HCI design will provide flexibility, resiliency, enhanced security and future expandability of the City’s and Police Department network infrastructure. The HCI installation will include configuration and implementation services for the proposed solution.

Vendors must bundle the proposed designed product, Post-implementation Support, Vendor approved training, technical labor, warranty, and customer support information. The proposed solution will include an itemized list delineating material and labor included in the proposed solution.

Ideally, Vendors will be able to demonstrate previous successful experience of their proposed solution with other municipalities similar in size to the City of Hemet.

1.1 DEFINITIONS

1.1.1 City” – refers to the City of Hemet.

1.1.2 “PD” – refers to the City of Hemet Police Department.

1.1.3 “RFP” – refers to this Request for Proposals and related documents.

1.1.4 “Vendor” – a firm who can provide the solution and services described in this RFP and who is considering submitting a proposal.

1.1.5 “Awarded Vendor” – the firm whom the City selects for the award of this contract. The Awarded Vendor’s proposal will be the one that the City deems to offer the greatest value to the City.

1.1.6 “IDF” – Intermediate distribution frame, a cable rack that interconnects and manages the telecommunications wiring between an MDF and workstation devices

1.1.7 “MDF” – Main distribution frame, a cable rack that interconnects and manages the telecommunications wiring between itself and any number of IDFs. Unlike an IDF, which connects internal lines to the MDF, the MDF connects private or public lines coming into a building with the internal network.

1.1.8 “HCI” – the Hyperconverged Infrastructure Solution

1.1.9 “DR” – disaster recovery

1.2 PRE-PROPOSAL CONFERENCE
An optional pre-proposal virtual meeting has been scheduled for March 23, 2022 @ 1pm.

1.3 QUESTIONS REGARDING THE RFP
Any questions, interpretations, or clarifications, either administrative or technical, about this RFP must be requested in writing prior to the date indicated in Section II – Schedule of Events. All pertinent questions will be answered in writing and conveyed to all proposers via an addenda posted on City of Hemet Bid Page. Oral statements concerning the meaning or intent of the contents of this RFP by any person are unauthorized and invalid. All questions

Page 356 of 402 ends

13.B

Page 1544 of 1602 ends

HPE Proposal Document Page-6

either technical, commercial, or contractual in nature shall be directed to: City of Hemet Q & A Section of Bid Page

1.4 ERRORS AND OMISSIONS
If a proposer discovers any ambiguity, conflict, discrepancy, omission, or other error in the RFP or any of its attachments, he/she shall immediately notify the City of such error in writing and request modification or clarification of the document. Modifications will be made by addenda. Clarifications will be given by written notice to all parties who have been furnished with or who have requested an RFP, without divulging the source of the request. If a proposer fails to notify the City prior to the date fixed for submission of proposals of an error in the RFP known to him/her, or an error that reasonably should have been known to him/her, he/she shall bid at his/her own risk, and if he/she is awarded the contract, he/she shall not be entitled to additional compensation or time by reason of the error or its later correction.

1.5 ADDENDA
The City may modify this RFP, any of its key action dates, or any of its attachments, prior to the proposal submittal date. Addenda will be numbered consecutively as a suffix to the RFP reference number. It is the proposer’s responsibility to ensure they have incorporated all addenda. Failure to acknowledge and incorporate addenda will not relieve the proposer of the responsibility to meet all terms and conditions of the RFP and any subsequent addenda.

1.6 SUBMISSION OF PROPOSAL
Proposals will be accepted on or before the date and time indicated in Section II – Schedule of Events, and in accordance with Section VI - Proposal Instructions and Format.

1.7 ALTERNATIVE PROPOSALS
Alternate proposals that contain a material change, improve the functionality, and reduce costs, via value engineering or other changed requirements, will be considered. At no time will more than two (2) proposals be considered from a proposer.

1.8 PROPOSER’S COST
Costs for developing proposals are entirely the responsibility of the proposer and shall not be chargeable to the City.

1.9 EXCEPTIONS
If a proposer takes exception to any part of these specifications as written, or as amended by any addenda subsequently issued, or to the Agreement Sample attached as Appendix A (“Agreement”), they must do so in writing. Said exceptions must be submitted with the proposal. Failure to do so will be construed as acceptance of all items of the specification and the Agreement.

1.10 DELIVERY OF PROPOSALS
An electronic copy of the response must be submitted online via PlanetBids no later than the date and time indicated above as the proposal due date. Late submission of responses shall not be considered. Submittal of response by fax is not acceptable.

One paper copy of the proposals (sealed bid) must be submitted by mail and should be post- marked sufficiently in advance of the proposal due date to ensure delivery to the Procurement Administrator prior to the specified due date. The City assumes no responsibility for delay in delivery of the proposal by U.S. Mail or any other service. LATE PROPOSALS WILL NOT BE ACCEPTED.

1.11 PROPOSALS BECOME THE PROPERTY OF THE CITY
Proposals become the property of City and information contained therein shall become public property subject to disclosure laws after Notice of Intent to Award. The City reserves the right to make use of any information or ideas contained in the proposal.

Page 357 of 402 ends

13.B

Page 1545 of 1602 ends

HPE Proposal Document Page-7

1.12 CONFIDENTIAL MATERIAL
Proposer must notify the City in advance of any proprietary or confidential material contained in the proposal and provide justification for not making such material public. The City shall have sole discretion to disclose or not disclose such material subject to any protective order which proposer may obtain.

1.13 REJECTION OF PROPOSALS
The City may reject any or all proposals and may waive any immaterial deviation in a proposal. The City's waiver of an immaterial defect shall in no way modify the RFP documents or excuse the proposer from full compliance with the specifications if he/she is awarded the contract. Proposals referring to terms and conditions other than the City’s terms and conditions may be rejected as being non-responsive.

The City may conduct investigations as it deems necessary to determine the ability of the proposer to perform the work, and the proposer shall furnish to the City any and all information and data requested by the City for this purpose. The City reserves the right to reject any proposal if the evidence submitted by, or investigation of, such proposer fails to satisfy the City that such proposer is properly qualified to carry out the obligations of the contract and to complete the work specified.

1.14 CANCELLATION
This solicitation does not obligate the City to enter into an agreement with any proposer. The City retains the right to cancel this RFP at any time, at its discretion, for reasons including, but not limited to, the project being canceled, the City loses the required funding, or if it is deemed in the best interest of the City. No obligation, either expressed or implied, exists on the part of the City to make an award or to pay any cost incurred in the preparation or submission of a proposal.

1.15 INSURANCE REQUIREMENTS
The City requires a certificate of insurance prior to commencement of any work. An underwriter’s endorsement is also required with additional insured verbiage and the surety must be an admitted surety in the State of California. The insurance required is:

1.15.1 Commercial General Liability (“CGL”): Insurance written on an occurrence basis to protect proposer and the City against liability or claims of liability which may arise out of this order in the amount of one million dollars ($1,000,000) per occurrence. City shall be included as an Additional Insured on the Proposer’s policy (“blanket” Additional Insured endorsement is acceptable).and subject to an annual aggregate of two million dollars ($2,000,000).

There shall be no endorsement or modification of the CGL limiting the scope of coverage for either insured vs. insured claims or contractual liability. All defense costs shall be outside the limits of the policy.

1.15.2 Vehicle Automobile Insurance: Proposer shall also procure and shall maintain during the term of this order vehicle automobile liability insurance in an amount not less than one million dollars ($1,000,000) Per Accident for injuries, including accidental death, to any one person, and subject to the same minimum for each person, in an amount of not less than one million dollars ($1,000,000) for each accident, and property damage. insurance in an amount of not less than one million dollars ($1,000,000). City shall be included as an Additional Insured on the Properser’s policy (“blanket” Additional Insured endorsement is acceptable).

1.15.3 Workers’ Compensation Insurance: For all of proposer’s employees who are subject to this order, and to the extent required by applicable state or federal law, proposer shall keep in full force and effect a Workers' Compensation policy. That policy shall provide a minimum of one million dollars ($1,000,000) of employers' liability coverage, and proposer shall provide agree an endorsement that the insurer waives the right of

Page 358 of 402 ends

13.B

Page 1546 of 1602 ends

HPE Proposal Document Page-8

subrogation against the City and its respective elected officials, officers, employees, agents, and representatives. In the event a claim under the provisions of the California Workers' Compensation Act is filed against the City by a bona fide employee of proposer participating under this Agreement, proposer agrees to defend and indemnify the City from such claim.

1.16 DISPUTES/PROTESTS
The City encourages proposers to resolve issues regarding the project requirements or the procurement process through written correspondence and discussions during the period in which clarifying addenda may be issued. The City wishes to foster cooperative relationships and to reach a fair agreement in a timely manner.

Proposers filing a protest must do so within five (5) calendar days after Notice of Intent to Award. The protesting proposer shall submit a full and complete written statement detailing the facts in support of the protest. Protests must be sent by certified or registered mail or delivered in person to the Procurement Administrator, or his or her designee. The City will provide a decision on the matter. The decision must be in writing and sent by certified or registered mail, faxed, or delivered in person to the protesting proposer. The decision of the City is final.

Interpretation of the wording of this document shall be the responsibility of the City and that interpretation shall be final.

1.17 AWARD OF CONTRACT
Award, if any, will be to the proposer whose proposal best complies with all of the requirements of the RFP documents and any addenda. Evaluation methodology and basis for the award are described in Section V – Evaluation and Award Criteria.

1.18 TERM OF CONTRACT
Hardware Arrival: Hardware is part of this project and shall arrive on site no later than ninety (90) calendar days from award of bid.

Completion: The proposed project shall conclude all phases, including project sign-off no later than two hundred and seventy (270) calendar days from award of bid.

The vendor shall provide the City a complete project timeline in Gantt format prior to starting this project. Updates to this timeline shall be provided on a bi-weekly basis until successful project sign off. Project update meetings held bi-weekly shall be conducted via conference call with a follow up e-mail of all discussed items sent no more than 24 hours following the conclusion of each meeting.

1.19 CONTRACT DOCUMENTS
In the event of a conflict between documents, the following order of precedence shall apply:

1. City of Hemet Consultant Agreement

2. City of Hemet Request for Proposal

3. Proposer's Response

1.20 EXECUTION OF THE CONTRACT
The Agreement shall be signed by the proposer and returned, along with the required attachments, to the City within ten (10) working days of receipt of the Agreement. The period for execution may be changed by mutual agreement of the parties. Agreements are not effective until approved by the appropriate City official(s). Any work performed prior to receipt of a fully executed agreement shall be at proposer's own risk.

Page 359 of 402 ends

13.B

Page 1547 of 1602 ends

HPE Proposal Document Page-9

1.21 FAILURE TO EXECUTE THE AGREEMENT
Failure to execute the Agreement within the timeframe identified above shall be sufficient cause for voiding the award. Failure to comply with other requirements within the set time shall constitute failure to execute the Agreement. If the successful proposer refuses or fails to execute the Agreement, the City may award the contract to the next qualified highest ranked proposer.

1.22 NON-ENDORSEMENT
If a proposal is accepted, the proposer shall not issue any news releases or other statements pertaining to the award or servicing of the contract which state or imply the City’s endorsement of proposer’s services.

1.23 SAFETY MEASURES AND REQUIREMENTS
All work performed under this contract will be performed in such a manner as to provide maximum safety to the public and employees, and, where applicable, will comply with all safety provisions and regulations. The proposer is responsible for abiding by all of the California Division of Occupational Safety and Health (“CAL/OSHA”) requirements.

1.24 PERFORMANCE STANDARDS
Performance of work and acceptability of equipment or materials supplied pursuant to any the contract or award shall be in conformance with the specifications to the satisfaction of the City.

1.25 LOST AND DAMAGED SHIPMENTS (F.O.B. DESTINATION)
Risk of loss or damage to items prior to the time of their receipt and acceptance by the City is upon the proposer. The City has no obligation to accept damaged shipments and reserves the right to return, at the proposer’s expense, damaged merchandise even though the damage was not apparent or discovered until after receipt of the items.

Response:

Exceptions are indicated via redlines and underlines throughout this document. Please see Proposal Redlines to include Appendix A - Hyperconverged Solution and Services 2022 (Exceptions).pdf.

Please Note: The City of Hemet can utilize the existing pricing and terms that have been negotiated via the NASPO agreement through the STATE OF CALIFORNIA PARTICIPATING ADDENDUM NUMBER 7-21-70-40-11 which can be found at:
https://www.naspovaluepoint.org/portfolio/cloud-solutions-2016-2026/

Page 360 of 402 ends

13.B

Page 1548 of 1602 ends

HPE Proposal Document Page-10

Section II Schedule of Events
Event Date
Post RFP March 9, 2022
Pre-Proposal Virtual Meeting March 23, 2022, 1pm
Deadline for Questions March 31, 2022
Post Answers April 6, 2022
Proposals Due May 5, 2022
Proposal Evaluation May/June, 2022
Optional Interviews May, 2022
Tentative Award of Contract June 2022

*NOTE: The City may adjust the dates subsequent to receipt of the proposal without further notice.

Response:

HPE has read and acknowledges.

Page 361 of 402 ends

13.B

Page 1549 of 1602 ends

HPE Proposal Document Page-11

Section III Proposer Qualifications

3.0 QUALIFICATIONS
In addition to meeting all other requirements of this RFP, all responding proposers shall furnish to the City of Hemet verifiable evidence that their firm and personnel, at a minimum, meet the following qualifications:

3.0.1 Proposer must have a business license from the City of Hemet prior to execution of the Agreement.

3.0.2 Proposer must have a W9 tax form on file with the City of Hemet prior to execution of the Agreement.

3.0.3 Proposer must have proof of liability insurance on file with the City of Hemet prior to the execution of the Agreement.

3.0.4 Proposer has completed at least three (3) similar projects of similar size within the last three (3) years.

3.0.5 The proposer shall have one or more engineer certified in the proposed hyperconverged solution and professional services. Vendor must provide details on certifications held or experience.

3.0.6 Vendor and all key personnel assigned to the project shall be regularly and continuously engaged in the business of providing HCI solution design, configuration, implementation services, and support for at least three years.

3.0.7 Vendor shall be authorized to sell and support the products and related services. Vendor must provide proof of certification that the bidder is authorized to supply product and perform services as specified under this RFP. Vendor must have architects and engineers certified at the highest level for the products proposed.

Response:

Exceptions are indicated via redlines and underlines throughout this document. Please see Proposal Redlines to include Appendix A - Hyperconverged Solution and Services 2022 (Exceptions).pdf.

Page 362 of 402 ends

13.B

Page 1550 of 1602 ends

HPE Proposal Document Page-12

Section IV Scope of Work

4.0. BACKGROUND

4.0.1 The City of Hemet is seeking proposals from qualified vendors for the procurement and implementation of hyperconverged solution for the replacement of existing blade servers and storage infrastructure. The City has hired ClientFirst Consulting Group, LLC to assist in the selection of the successful Vendor. ClientFirst Consulting Group is not a value- added reseller and will not be responding to this RFP.

4.0.2 The successful Vendor will supply both the City and Police Department (“PD”) with a HCI solution and required professional services to install, configure, and integrate the solution.

This implementation should simplify management of the City’s and PD’s IT infrastructure by introducing a modern, increased performance, high availability, scalable architecture, and resiliency that supports current and future data center requirements.

4.0.3 To reduce the overall complexity and interoperability of the proposed HCI solution, the City and PD is seeking a single vendor to provide all products and services. It is the expectation that the successful Vender will perform all duties required to implement a fully functional system including implementation of all hardware and software components.

Vendor proposal should include the full migration of existing virtual machines over to the new HCI environment.

4.0.4 Vendor must submit a complete proposal that satisfies all requirements as stated in this RFP and its addendums. This RFP also contains all major terms and conditions that the successful Vendor will be expected to accept.

4.1 SCOPE

4.1.1 The broad scope of work as detailed in this section refers to the hardware and system software that is procured through this procurement and used for implementing the Hyperconverged Infrastructure solution at City Hall and Police Department

4.1.2 The Vendor shall be responsible for design, supply, installation, configuration, testing and commissioning of the Hyperconverged Infrastructure solution.

4.1.3 The Vendor must prepare architecture design, optimize network to increase performance, documentation, project plan, and training as part of the implementation services.

4.1.4 The Vendor shall provide Project Management for the entire duration of the Project.

4.1.5 Installation and configuration of supplied hardware associated system software and system integration must be carried out by Vendor.

4.1.6 Vendor should propose highly scalable solution. Solutions with limited scalability are not acceptable. Solutions which are not in the marketplace through traditional channels for over one (1) year will not be considered.

4.1.7 Migration, Conversion, Resource, Change and Communication Management Plan. The Vendor needs to submit a detailed plan for implementation of the solution.

4.1.8 The solution implemented should have High-Availability capability to ensure that systems will be available without interruption.

4.2 EXISTING INFRASTRUCTURE

4.2.1 Current infrastructure is supported by a HP C7000 BladeSystem and 3PAR iSCSI SAN

4.2.2 Existing Network Topology

Page 363 of 402 ends

13.B

Page 1551 of 1602 ends

HPE Proposal Document Page-13

Diagram 1

4.2.3 City Hall and Police Department Blade Server and SAN connection overview.

Diagram 1 – City Hall

Page 364 of 402 ends

13.B

Page 1552 of 1602 ends

HPE Proposal Document Page-14

Diagram 2 – Police Department

Note: ESXi hosts use USB storage for local OS (VMware) operation. All remaining storage is located on the assigned SAN.

These tables represent current hardware configuration for both City Hall and PD.

Page 365 of 402 ends

13.B

Page 1553 of 1602 ends

HPE Proposal Document Page-15

City Hall Current Resource Configuration and Utilization ESXi Hosts # VMs CPU Usage % # vCPUs vRAM VM Used Memory Memory Usage % Host 1 11 2 25 69,632 6,528 66
Host 2 6 6 20 65,536 3,847 65
Host 3 8 3 27 80,896 10,235 75
Host 4 7 1 25 77,824 6,633 82
Host 5 9 4 32 88,064 4,952 83
Host 6 6 1 20 90,112 6,591 88
Host 7 9 4 24 73,728 5,525 79

PD Current Resource Configuration and Utilization
ESXi Hosts # VMs CPU Usage % # vCPUs vRAM VM Used Memory Memory Usage % Host 1 9 1 29 77,796 5,565 31
Host 2 7 6 51 124,928 2,230 46
Host 3 8 1 54 161,792 5,547 58
Host 4 8 1 45 131,072 4,706 48
Host 5 17 8 59 180,224 13,365 71
Host 6 16 23 54 142,336 20,379 57
Host 7 16 7 41 151,552 9,247 60

Note: Based on the above utilization, the proposed solution should provide at a minimum, 25% increase in resources and storage to accommodate future growth.

4.2.4 Server OS – Sever environment is a mixture of Windows 2008R2, 2012 and 2016 and Linux.

4.2.5 The City has an Enterprise Agreement with Microsoft.

4.2.6 vCenter used for virtual machine management

4.2.7 Current switch infrastructure is HP

4.2.8 Backup

4.2.8.1 City utilizes Veeam Backup.

4.2.8.2 Storage currently in use = 72TB.

4.2.9 Databases

4.2.9.1 Existing environments consist of SQL servers, versions 2008, 2008 R2 2012, 2016, 2017, and 2019.

4.2.10 Major Applications

4.2.10.1 The following on‐premises applications are SQL dependent:

4.2.10.1.1 Tyler Technology ‘Eden’ ERP

4.2.10.1.2 Laserfiche (document management)

Page 366 of 402 ends

13.B

Page 1554 of 1602 ends

HPE Proposal Document Page-16

4.2.10.1.3 Esri (ArcGIS)

4.2.10.1.4 CentralSquare/Superion ‘TRACKIT’ (Land Management, Permitting, Inspection, Code Enforcement)

4.2.10.1.5 Microsoft SCCM/MECM

4.2.10.1.6 Veeam

4.2.10.1.7 IA Pro (PD Internal Affairs)

4.2.11 LAN/WAN –Existing network environment is 10 Gb capable with the following available ports at City Hall and PD

4.2.11.1. City Hall Core (CH Nets)– (13) 10Gb SFP slots available

4.2.11.2. PD 5406 chassis (CH Nets) contains (2) 10Gb and (7) 10Gb SFP slots available on the 5412 (PD Nets).

Note: Should the proposed solution require dedicated 10Gb switching capability, the appropriate switching and port density shall be included in the required BOM.

4.2.11.3 City Hall and Police Department are connected by fiber.

4.2.11.4 Current link speed is 1Gb.

4.2.12 Internet

4.2.12.1. The City Hall Internet connection is 1Gbps with a 10Mbps secondary connection.

The Police Department has its own dedicated 1Gbps connection and uses City Hall’s 10Mbps connection as their secondary as well.

4.2.12.2. Both sites are configured with dual copper connections.

4.3 OBJECTIVE SCOPE OF CONVERGED INFRASTRUCTURE PROPOSAL

4.3.1 Proposed solution must be configured for both City Hall and PD.

4.3.1.1 Base solution should include a physical cluster for City Hall and a physical cluster for the Police Department.

4.3.1.1.1 Alternate solution would require a physical cluster for City Hall and virtual solution for PD.

4.3.1.2 Loss of primary site shall result in automatic transfer system services between physical clusters or from physical cluster to proposed Cloud solution (alternate option).

4.3.1.3 Site to site failover testing will be required for solution acceptance.

4.3.2 Redundant data storage arrays at each data center location providing 80TB of useable storage per cluster.

4.3.3 Fault tolerance and health monitoring capabilities

4.3.4 Hardware compression and deduplication features

4.3.5 Hardware-based end-to-end data encryption for data in use, in flight, and at rest

4.3.6 Backup solution for each cluster must contain 80TB’s of useable storage.

Page 367 of 402 ends

13.B

Page 1555 of 1602 ends

HPE Proposal Document Page-17

4.4 TECHNICAL REQUIREMENTS

4.4.1 Must be capable of supporting various hypervisors and cloud technologies. Please provide documentation of supported operating systems and cloud technologies.

4.4.2 Simplified deployment and administration features

4.4.3 The solution must provide N+1 resilience such that in the event of a component failure there will be no loss of performance and or no data loss.

4.4.4 The solution must allow data store to be migrated from any host to any other host in the configured environment.

4.4.5 The solution must be able to upgrade any system component; controller software, hypervisor, and firmware without the requirement of any external manufacturer provided support.

4.4.6 The solution must be able to demonstrate non-disruptive scaling down or up of the cluster to allow graceful decommissioning of older nodes or the addition of new nodes.

4.4.7 Proposed solution to include hypervisor and backup solution maintenance and support for 5 years.

4.4.8 To ensure the efficient use of storage, the solution must support data deduplication, compression on a per data store basis with the ability to disable the deduplication and/or compression at any time.

4.4.9 The IT operational team must have the ability to monitor the solution including platform resource usage and cluster health with proactive flagging of issues.

4.4.9.1 The solution must allow IT to view performance metrics across entire platform from a single user interface.

4.4.10 Support for ready integration with cloud data upload, backup, recovery, and/or Disaster Recovery (DR) services and capabilities

4.4.11 Vendors must specify and separately price a compatible disaster recovery solution.

Preference would be given to the reuse of existing infrastructure components, if possible, in the design of the disaster recovery solution.

4.4.12 The successful Vendor must provide the environmental and physical requirements for implementation of the solution including power, cooling, and space requirements.

4.4.13 Vendors must provide an option for ongoing support and maintenance.

4.5 SECURITY FEATURES

4.5.1 Data protection and encryption

4.5.1.1 Provide encryption of data-at-rest for sensitive information.

4.5.1.2. Provide encryption of data in transit.

4.5.2 Ensure necessary security feature are built in to the proposed HCI solution.

4.5.3 Provide distributed security for both on-premise and in the cloud

4.5.4 Ability to protect resources at the control, data, and management plane.

4.5.5 Support micro segmentation

4.5.6 Configurable role-based access control

4.5.7 Support single sign-on for administrators and end users.

Page 368 of 402 ends

13.B

Page 1556 of 1602 ends

HPE Proposal Document Page-18

4.5.8 Capable of supporting multi-Cloud security.

4.5.9 Built-in resiliency, including backup and disaster recovery (DR)

4.5.9.1 Cloud services and ability to spin up virtual machines.

4.6 AVAILABILITY

4.6.1 The solution must be configured in high availability mode and should ensure there are no single point of failure. Availability of the solution should be 99.999% uptime to be analyzed on quarterly basis.

4.6.2 The management platform must be configured to proactively detect the health issues and service degradation/interruptions and should be able to create event / alerts to administrators through Email or SMS.

4.7. HEALTH AND PERFORMANCE MONITORING FEATURES

4.7.1 The proposed solution must be managed centrally through a single Management Console.

4.8 POST-IMPLEMENTATION REQUIREMENTS

4.8.1 City requires a minimum of eight (8) hours on-site support following cutover.

4.9 TRAINING

4.9.1 Provide manufacturer certified training for two (2) City employee, to be trained to configure, operate, and maintain the proposed solution. The City may use these vouchers at any point in time over a time period of 24 months following completion of implementation.

4.9.2 Provide a list of electronic and printed documentation provided for implementation, operation, use, and administration of the whole solution.

4.9.3 In addition to formal training, the City requires the Vendor to provide on-site training of key concepts which are specific to the proposed solution. The Vendor must specify the type of training provided. A minimum of eight (8) hours of knowledge transfer training is required.

4.10 DECOMMISSIONING SERVICES

4.10.1 Physical removal of existing hardware will be performed by the selected vendor upon completion and sign-off of the project by the City. City will follow data destruction policy and be responsible for the removal and physical destruction of all system hard drives. Decommissioned equipment will be documented and stored at:
127 S Juanita St, Hemet, CA, 92543.

4.11 ADDITIONAL CAPABILITIES / FEATURE DESCRIPTIONS

4.11.1 Please describe any features or capabilities not delineated above that would be useful for understanding and evaluation of the total proposed solution. Note any items that have extra costs associated with them.

Page 369 of 402 ends

13.B

Page 1557 of 1602 ends

HPE Proposal Document Page-19

Response:

Please see Attachment 1 – Solution Overview.pdf.

4.12 SOLUTION REQUIREMENTS READ AND COMPLY

4.12.1 Please provide a narrative description of your product’s ability to comply with each item in this section as appropriate. Each description should refer to the section and item number being addressed.

4.12.2 To ensure proper review and evaluation, respondents are encouraged to include network diagrams, rack elevations, and any other supporting information to demonstrate a clear understanding of the requirements, the specifications for the proposed system, and that the proposed system is a complete turn‐key system.

4.12.3 The proposed solution must include a standardized and up-to-date hypervisor preinstalled.

Response:

Please see Attachment 1 – Solution Overview.pdf.

4.12.4 The proposed solution must integrate hardware, storage, hypervisor, management, data protection, and replication tools.

4.12.5 All hardware and software items specified within in this proposal must include a total of five (5) years of coverage. This includes licensing, support, and warranty.

4.12.5.1 For hardware, a five (5) year, 24/7 warranty with a four (4) hour delivery response.

4.12.6 The support coverage should account for hardware, hypervisor, and management software with a single escalation point for all incidents and problems.

4.12.7 The successful solution must demonstrate the ability to scale compute and/or storage capacity quickly and easily in response to future system or data growth.

4.12.8 The solution will provide ease of expandability for resources assigned to virtualized systems running on the proposed platform.

4.12.9 The solution must be considered 99.999% reliable with no single point of failure, fully redundant, and hot-swappable components wherever possible.

4.12.10 The solution must be able to provide fully redundant multi-path capability to both storage and network paths.

4.12.11 The solution must be manageable from a secure web-based interface.

4.12.12 Any separate management devices required must be included in the solution.

4.12.13 The solution must be able to provide detailed reporting on current and historical utilization.

4.12.14 The management system must include comprehensive online and remote monitoring abilities with the solution including any necessary hardware or software.

4.12.15 The solution must generate email alerts for any critical hardware or software events that may occur.

4.12.16 The solution must include out-of-band management for the entire system.

4.12.17 The proposed solution will support 10GbE network connections.

Page 370 of 402 ends

13.B

Page 1558 of 1602 ends

HPE Proposal Document Page-20

4.12.18 The proposal must include all necessary hardware and software to provide an active/active configuration of all production systems between primary and secondary datacenter.

4.12.19 The solution must support non-disruptive updates and upgrades.

4.12.20 Vendors shall demonstrate the ability of the proposed solution to reduce and simplify the effort of system management and administrative tasks.

4.12.21 The City prefers an HCI solution with a fully integrated backup solution capable of supporting or providing the following:

4.12.21.1 Integrated solution capable of utilizing HCI storage.

4.12.21.2 Improve resiliency, while reducing backup complexity and simplifying management.

4.12.21.3 Improve data protection capabilities and disaster preparedness.

4.12.21.4 Solution must reduce the need redundant backup server equipment.

4.12.21.5 Capability to integrate with hybrid-cloud services.

4.12.21.5.1 Data archival

4.12.21.5.2 Instant recovery options

4.12.22 Proposals should include professional services to implement the solution, including forecasted delivery or travel costs. The Vendor shall describe its project management process with the proposal response.

4.12.23 The successful vendor will provide system administration overview and knowledge transfer to City of Hemet IT staff on the implemented solution.

4.13 GENERAL CONFIGURATION

4.13.1 The following outlines City and Vendor responsibilities for this procurement.

4.13.1.1 City’s Responsibilities

4.13.1.2 Provide overall design goals and objectives for the project

4.13.1.3 Provide the following design assets:

4.13.1.3.1 Existing configurations as applicable

4.13.1.3.2 IP address and Subnet information

4.13.1.3.3 Data Center and remote site VLAN definition and priorities

4.13.1.3.4 Rack space

4.13.1.3.5 Reliable power outlets

4.13.1.3.6 Network Diagrams

4.13.1.4 Sign off and approve all HCI design changes/recommendations

4.14 VENDOR RESPONSIBILITIES

4.14.1 New Hyperconverged (HCI) design and implementation.

4.14.2 Physical installation of the HCI solution.

4.14.2.1 Dress cables neatly in Velcro wraps

Page 371 of 402 ends

13.B

Page 1559 of 1602 ends

HPE Proposal Document Page-21

4.14.3 Develop detailed migration path of existing virtual machines into new environment.

4.14.4 Under this scope, selected vendor shall perform the following tasks:

4.14.5 Replacement Blade Server Project Overview

4.14.6 Kickoff

4.14.7 Project Overview

4.14.8 Planning Workshop

4.14.9 Business Requirements

4.14.10 Projected Timelines

4.14.10.1 The Vendor should provide a detailed project plan in terms of activity and phasing timelines (number of days) required for executing the project with the details of deliverables and milestones including the delivery of Server components. The Vendor shall designate a Project Manager who would be the single point of contact during the complete project implementation. It will be looked upon favorably if the Project Manager has previous experience working with small/medium municipalities.

4.14.11 Network Design Review Workshop/Discussion

4.14.11.1 Review and validate purchased hardware for City’s Bill of Materials

4.14.12 Migrate existing virtual machines from City Hall and PD to new HCI solution.

4.14.13 The Vendor shall be responsible for installing / configuring of all patches / updates / upgrades required for the offered solution without any extra cost to City during the warranty period.

4.14.14 It is the vendors responsibility to ensure that all connections utilize the appropriate network configuration (Trunks, VLANs, ACLs, IP addresses) to ensure proper connectivity and network segmentation.

4.14.15 The Vendor must analyze, review, and gather performance metrics and ensure the proposed system performs optimally.

4.14.16 Equipment labeling

4.14.17 Registering equipment with the manufacturer

4.14.18 Final as-built documentation and configuration information

4.14.19 All service requests for HCI equipment before final acceptance should be received, managed, executed, and tracked to closure by the Vendor and not through Authorized Service Provider.

4.14.20 The Vendor at no additional charge will coordinate returns with the manufacturer for any reason (i.e., damaged equipment, dead-on-arrival, etc.)

4.14.21 The Vendor is responsible for insurance of equipment until it is delivered and signed for by City personnel.

4.14.22 Unless otherwise specified in the specifications, all items on which a vendor submits a proposal shall be new, of the latest model or manufacture and shall be at least equal in quality to that specified in the bidding documents.

Page 372 of 402 ends

13.B

Page 1560 of 1602 ends

HPE Proposal Document Page-22

4.15 WORK LOCATIONS AND WORKING HOURS
City Hall located at 445 East Florida Avenue, Hemet, CA, 92543. Working hours for this project are Monday through Thursday, 8:00am through 5:00pm, excluding City holidays.

Hemet Police Department located at 450 East Latham Avenue, Hemet, CA, 92543. Working hours for this project are Monday through Thursday, 8:00am through 5:00pm, excluding City holidays.

4.16 WORK LOCATION SPECIAL REQUIREMENTS
The willing bidder’s technicians must always wear identification. Identification can consist of vendor branded apparel or an identification card attached to a lanyard or clip. The City may provide a ‘Visitor’ badge and lanyard, as needed. Unescorted access through City facilities is not allowed. Any local, state, or federal guidelines regarding COVID-19 shall be adhered to.

4.17 STAFF SPECIAL REQUIREMENTS (BACKGROUND CHECKS)
The winning bidder’s Staff performing on-site work will be required to submit to and pass a Live Scan background check. The City of Hemet will pay for this check, but it will be winning bidder’s responsibility to schedule this process with the Hemet Police Department. Live Scan results must be received by the City of Hemet prior to beginning onsite work.

4.18 CONTRACTOR SPECIAL REQUIREMENTS
As this work will be performed using production equipment, the contractor must be available and responsive to any issues that arise or are associated with this project, its equipment or configuration. The Contractor shall provide remote and on-site support services 7 days per week, 24 hours per day for the duration of this project.

4.19 PROJECT TIMELINE
Hardware Arrival: Hardware part of this project shall arrive on site no greater than ninety (90) calendar days from award of bid.

Completion: The proposed project shall conclude all phases, including project signoff no greater than two hundred and seventy (270) calendar days from award of bid.

The vendor shall provide the City a complete project timeline in Gantt format prior to starting this project. Updates to this timeline shall be provided on a bi-weekly basis until successful sign off of the project. Project update meetings held bi-weekly shall be conducted via conference call with a follow up e-mail of all discussed items sent no more than 24 hours following the conclusion of each meeting.

4.20 EQUIPMENT SPECIFICATIONS AND PRICING

4.20.1 Attach a detailed Bill of Material for all equipment proposed including make, model, SKU, list price and proposed price.

4.20.2 Provide pricing for the complete hyperconverged infrastructure (“HCI”) software and hardware installation along with virtual machine migration.

4.20.3 Vendor is expected to fix all prices at the proposed amounts for the duration of the contract.

4.20.4 The City reserves the right to increase or decrease the quantity of equipment to be purchased under this RFP. Any additional equipment purchased shall be priced at the proposed in the detailed bill of material provided by the Vendor as a part of their proposal.

4.20.5 Vendor is expected to fix all prices at the proposed amounts for the duration of the contract.

Page 373 of 402 ends

13.B

Page 1561 of 1602 ends

HPE Proposal Document Page-23

4.20.6 The City reserves the right to increase or decrease the quantity of equipment to be purchased under this RFP. Any additional equipment purchased shall be priced at the proposed in the detailed bill of material provided by the Vendor as a part of their proposal.

4.21 LICENSING, SUPPORT AND WARRANTY SPECIFICATIONS
All hardware and software items specified within in this proposal must include a total of five (5) years of coverage. This includes licensing, support, and warranty.

For hardware, a five (5) year, 24/7 warranty with a four (4) hour delivery response.

All software and hardware licensing, support and warranty coverage shall co-terminate at the same time. All licensing, support and warranty part of this RFP must be fully registered to the City of Hemet.

4.22 PROFESSIONAL SERVICES
A critical component of this project are the professional services necessary for its successful completion. These services include installation, migration, documentation, knowledge transfer and decommissioning of existing systems.

4.23 INSTALLATION SERVICES
Hardware: As part of the Vendors "Turn-Key" HCI solution, the City requires installation of the hardware approved in the proposed solution. This includes installation and configuration of all items.

Hardware will be drop shipped to the City of Hemet. Upon delivery, the City of Hemet will secure the equipment in a location to be determined.

The vendor is responsible for all configuration, testing and troubleshooting of allowed/denied network traffic.

All copper connections for configuration, monitoring, remote management, and out-of-band use must utilize CAT6 patch cords.

Vendor proposal shall include all required copper or fiber cables required for the implementation of the proposed solution. Vendor can assume a length of 40ft for each location.

4.24 MIGRATION SERVICES
As a replacement system, migration of existing virtual machines and service is vital to the success of this project. These virtual machines shall be migrated to the new HCI solution with minimal impact and downtime to the City.

4.25 DOCUMENTATION SERVICES
All aspects of the project must be documented and provided to the City of Hemet upon completion of the project. Final sign off on the project will not be provided until documentation has been transferred, reviewed and accepted.

Project documentation shall be provided in both digital copy and hard copy. The City requires physical delivery of 6 (six) binders (3-ring or spiral bound) containing duplicate hard copies of all project documentation. Included with each hard copy shall be a USB drive (6 total) containing digital copies of all of documentation provided in hard copy.

Project documentation shall include the minimum following items:
• Provide Topology Documentation (Visio format)
• A list of all IP addresses, usernames and passwords associated with this project for remote

Page 374 of 402 ends

13.B

Page 1562 of 1602 ends

HPE Proposal Document Page-24

or out-of-band access
• A list of manufacturer support contacts for all hardware and software • A list of all hardware serial numbers and associated contracts they fall under • A list of all software serial numbers and associated contracts they fall under

4.26 PROJECT MANAGEMENT
The vendor will provide a single point of contact throughout the entire duration of the project.

4.27 KNOWLEDGE TRANSFER
In addition to project documentation services, the City of Hemet also requests knowledge transfer take place.

This transfer of knowledge, in addition to formal documentation, allows staff the ability to discuss the day-to-day operations of the new system along with the ability to ask direct, one- on-one questions with the engineers and technicians who assembled it.

Due to COVID-19 restrictions, this knowledge transfer shall be done remotely with City of Hemet staff via video teleconference and screen sharing technology. The length of knowledge transfer is dependent upon the complexity of the proposed solution. The City of Hemet recommends 8 hours of knowledge transfer be provided.

Page 375 of 402 ends

13.B

Page 1563 of 1602 ends

HPE Proposal Document Page-25

Section V Evaluation and Award Criteria

5.0 BASIS OF AWARD
Award will be made to the Proposer whose proposal demonstrates to be the most qualified, responsive, and advantageous to the City. The City shall not be obligated to accept the lowest cost proposal but will make an award deemed the “Best Value” and in the best interests of the City after all factors have been evaluated.

The City reserves the right to reject any or all proposals or any part thereof, to waive any informalities in the proposal and minor irregularities, technical defects, or clerical errors, to make an award on the basis of suitability, quality of service(s) to be supplies, their conformity with the specifications and for the purposes for which they are required, and their non- confinement to cost. False, incomplete, or non-responsive statements in connection with the proposal may be deemed sufficient cause for rejection. The City shall be the sole judge in making such determination.

The City reserves the right to cancel or discontinue with the proposal process and reject any or all proposals in the event it determines that there is no longer a requirement for the furnishing of such items, materials, equipment, services, and/or funding is no longer available for this proposal, or it is otherwise in the City's best interest to cancel the proposal process.

Proposals will be reviewed and evaluated by an evaluation committee comprised of City personnel. Selection will not be made on cost alone but will be based upon the most responsive proposal and Best Value to the City. The award will be made in the best interest of the City.

The Evaluation Committee will consider only those proposals which have been considered responsive to the proposal. Any proposal which fails to meet the requirements of the proposal will be considered non-responsive and may be rejected. Responsiveness includes attention to detail in following the proposal format. The Evaluation Committee may also contact and evaluate the Bidder’s and the Subcontractors references; contact any Bidder to clarify any response; contact any current users of a Bidder’s services; solicit information from any available source concerning any aspect of a proposal; and seek and review any other information deemed pertinent to the evaluation process. The Evaluation Committee shall not be obligated to accept the lowest priced proposal but shall recommend such proposal that is the most qualified, responsive, and cost-effective proposal and in the best interest of the City.

5.1 EVALUATION CRITERIA
Evaluation and award will be based on factors that are not limited to acquisition cost. These factors may include, but are not limited to:

5.1.1 Experience - Consideration will be given based upon the firm’s experience in specifying, providing, installing, and configuration of hyperconverged infrastructure.

Customer references may be contacted and evaluated as part of this section.

5.1.2 Personnel - Additionally, consideration will be given based on the professional, technical, and educational qualifications of personnel that will be assigned to the project based on the resumes provided. Proposer should demonstrate that all key personnel have been successfully involved with projects of similar scope and magnitude.

5.1.3 Completeness of Proposal - This category will consider the overall quality and completeness of vendor response. Demonstrating ability to understand the purpose, scope, and objective of the project.

Page 376 of 402 ends

13.B

Page 1564 of 1602 ends

HPE Proposal Document Page-26

5.1.4 Total Cost of Ownership - The City considers cost-effectiveness to be an extremely high priority

5.1.4.1 After each proposal has been reviewed and scored, the City may invite one (1) or more finalists to interview with the selection committee. The City will then negotiate a contract with the Vendor whose proposal and resources are deemed to offer the best value to the City. All contract awards must be approved by City Council.

Response:

HPE has read and acknowledges.

Page 377 of 402 ends

13.B

Page 1565 of 1602 ends

HPE Proposal Document Page-27

Section VI Proposal Instructions and Format

6.0 INTRODUCTION
To be considered responsive to this RFP, proposer must submit proposal in the format identified in this section. All requirements and questions in the RFP must be addressed and all requested data must be supplied. The City reserves the right to request additional information that, in City’s opinion, is necessary to assure that the proposer’s competence, number of qualified employees, business of the City, and financial resources are adequate to perform according to contract.

6.1 NUMBER OF COPIES
The proposer shall provide a minimum of one (1) original (Master Copy).

The proposer must also submit an electronic copy of the proposal and be submitted electronically through PlanetBids. The City prefers Adobe Acrobat (PDF) files for general documents. The electronic copy must be identical to the paper copy in both content and layout, but signatures may be omitted from the electronic copy.

6.2 DELIVERY OF PROPOSALS
Address/deliver original to: Procurement Administrator City of Hemet
445 E Florida Ave. Hemet, CA 92543
Electronic proposal to: City of Hemet Bid Page

Proposals must be received by the Procurement Administrator no later than the date and time specified on the cover page and Schedule of Events. LATE PROPOSALS WILL NOT BE ACCEPTED. Proposals shall be labeled as follows:

Hyperconverged Solution and Services 2022

6.3 PREPARATION
Proposals should be prepared in such a way as to provide a straightforward, concise delineation of capabilities to satisfy the requirements of this RFP. Responses should emphasize the proposer’s demonstrated capability to perform work of this type. Expensive bindings, colored displays, promotional materials, etc., are not necessary or desired.

EMPHASIS SHOULD BE ON COMPLETENESS AND CLARITY OF CONTENT.

6.4 PROPOSAL FORMAT
Proposals shall adhere to the following format for City and content. Proposals must be divided into the individual sections listed below and must be indexed and tabbed.

6.4.1 Cover Letter
The cover letter shall include a brief general statement of intent to perform the services and confirm that all elements of the RFP have been reviewed and understood. The letter should include a brief summary of proposers’ qualifications and proposers’ willingness to enter into a contract under the terms and conditions prescribed by the City of Hemet Consultant Agreement. The letter should be signed by an individual who can bind the proposer contractually.

Response:

HPE has read and acknowledges.

6.4.2 Table of Contents
The table of contents shall identify the contents of the proposal in a format consistent with the proposal requirements and format set forth herein.

Page 378 of 402 ends

13.B

Page 1566 of 1602 ends

HPE Proposal Document Page-28

Response:

HPE has read and acknowledges.

6.4.3 Exceptions
Any and all exceptions to the RFP and/or Service Agreement (Attachment A) must be listed on an item-by-item basis and cross-referenced with the RFP document. If there are no exceptions, proposer must expressly state that no exceptions are taken.

Response:

Exceptions are indicated via redlines and underlines throughout this document. Please see Proposal Redlines to include Appendix A - Hyperconverged Solution and Services 2022 (Exceptions).pdf.

6.5 PROPOSAL CONTENT

6.5.1 SECTION I – EXPERIENCE
This section shall contain responses to the minimum proposer qualifications included in Section III – Proposer Qualifications of the RFP, a general overview of the proposer’s qualifications, and shall include, but not be limited to, the following information:

6.5.1.1 Proposer name, address, telephone number, and authorized representative(s).

Response:

Hewlett Packard Enterprise (HPE)
1701 E Mossy Oaks Road
Spring, TX 77389
Stacy Woode
HPE Sr Enterprise Account Manager
1-512-599-0588
[email protected]

6.5.1.2 Proposer shall identify the number of years of experience in providing equipment and installation, similar in size and scope to that requested in this RFP.

Response:

HPE has over 80 years of experience and technology and innovation business serving thousands of customers worldwide. HPE has been delivering on-premises consumption services for over 10+ years to over 1000+ customers who benefit from increased time to market and overall lower total cost of ownership.

6.5.1.3 Proposer References: Provide three (3) client references utilizing the table below for which the proposer has provided similar services. References shall include date and description of service, project location, completion dates, City’s name, contact person, title, address, email address and telephone number.

Provide a minimum of 3 similar size complete installation references.

Page 379 of 402 ends

13.B

Page 1567 of 1602 ends

HPE Proposal Document Page-29

Response:

1. Owner Name: Kern County, Bakersfield CA
Address: 4175 Mount Vernon Ave, Bakersfield, CA 93306
Name of Contact: CIO, Fidel Chavez – [email protected] Phone: 661-868-2000 Project Date: 11/2020 – Ongoing

2. Owner Name: County of Maricopa, Phoenix AZ
Address: 301 S. 4th Ave, Phoenix, AZ 85003
Name of Contact: Deputy CIO, Shea McGrew - [email protected] Phone: 602-506-8055 Project Date: 02/2021 – Ongoing

3. Owner Name: County of Yuma, Yuma AZ
Address: 2717 S. Ave B, Yuma, AZ 85364
Name of Contact: Deputy CIO, John Kullman – [email protected] Phone: 938-373-1000 Project Date: 11/21 - Ongoing

6.5.2 SECTION II – PERSONNEL
Proposer shall identify the number of working employees who will be assigned to the worksite and identify the names of the project manager and key personnel who shall be assigned to this project if a contract is awarded, including resumes. Due to the work being conducted at our Police Station and City Hall, a Live scan background review will be required on all service personnel at no cost to the service provider.

Response:

The HPE migration team will consist of a Project Manager, Solution Architect, and a Storage Consultant as well as any Subject Matter Expert as required to deliver the services. HPE is unable to commit specific resources prior to contract award. After award, HPE will work with the City of Hemet on providing the background reviews required. Descriptions of the general project responsibilities of these resources is provided below.

HPE Project Manager
HPE provides a Project Manager experienced in in the business and functional aspects of storage technology and migration methodologies to serve as the project lead with the following responsibilities:
• Work with the Customer to develop project work plans with key tasks and milestones to be tracked that include Customer and any third-party dependencies • Utilize the Work Breakdown Structure (WBS) of key milestones and tasks developed in conjunction with Customer to build the initial Project Schedule • Update the Project Schedule to reflect the identified timing of the tasks to complete the disposition for each of the in-scope systems as its timing is approved • Track progress against the master schedule and report to the team in accordance with established reporting requirements
• Work with the Customer to assure clear identification of their team’s support for the WBS and resource commitments
• Establish and maintain a Project Issue Log
• Report status against plan weekly including variances to original work effort

Page 380 of 402 ends

13.B

Page 1568 of 1602 ends

HPE Proposal Document Page-30

• Periodically review schedule status, including major issue and risks HPE Storage Consultant
HPE will provide technical storage consultant(s), with extensive experience in SAN environments of varying technologies (both HPE and 3rd party), to participate in the migration project with the following responsibilities:
• Participating in both the pilot and all phases of the migration process under direction of the HPE Project Manager and Storage Architect
• Assist in the development of the HPE Migration Playbook as described in Project Deliverables Section
• Implement 3PAR setup and configuration for virtual data migration at each site. • Implement 3PAR setup for 3PAR Remote Copy between sites. • Provide basic knowledge transfer of new target storage environment to Customer personnel during the course of the migration.

HPE Technical Services Business Consultant
HPE provides a Technical Services Business Consultant / Storage Architect experienced in the business, functional and technical aspects of storage technology (HPE and 3rd party) and migration methodologies to serve as the technical lead with the following responsibilities:
• Assist in the logical design of the new storage that will be deployed at Eversource, providing configurations for the predefined devices and remaining involved until the implementation and migration meets the requirements and design assumptions. • Evaluation of source and migration target for viability of appropriate migration technologies • Identifying any technical compatibility issues that need addressing for a successful migration • Developing the migration processes and procedures for each migration technology to be used. • Participating in pilot and initial migration phases of project Please see sample resumes of potential team members: Attachment 2 – Project Manager Resume.pdf, Attachment 3 – Storage Consultant Resume.pdf, and Attachment 4 – Technical Services Business Consultant Resume.pdf.

6.5.3 SECTION III – QUALITY OF SOLUTION PROPOSED
Proposer shall provide a detailed description of the equipment and installation plan to be used in response to Section IV - Scope of Work. The prepared plan should demonstrate an overall understanding of the scope of work to be performed, and a timeline for how the project will be completed from start to finish.

Include in the schedule the sequence of implementation phases, the technical components, and modules to be installed, configured, and rolled out in each phase, the functionality to be rolled out in each phase, and the timing of each phase.

Response:

Please see Attachment 5 – HPE GreenLake Statement of Work Sample Agreement.pdf.

Page 381 of 402 ends

13.B

Page 1569 of 1602 ends

HPE Proposal Document Page-31

6.5.4 SECTION IV – COST SECTION
All costs associated with the services of this contract must be identified summarized on the Cost Sheet (Section VII). Projected hours for completion of the project shall also be included.

Additionally, include a fee schedule for possible additional services.

The completed Cost Sheet shall be signed and submitted with proposal.

Response:

Please refer to Section VII.

Page 382 of 402 ends

13.B

Page 1570 of 1602 ends

HPE Proposal Document Page-32

Section VII Cost Sheet Submittal Form
Appendix A - Agreement Sample

7.1 INTRODUCTION
In addition to completing the proposal, the proposer shall complete this summary cost sheet to include all costs, including travel and per diem, in accordance with the scope of work defined in Section IV. Proposer should submit detailed cost sheets on installation, freight, travel, and other reimbursable costs, as back up to this summary page; however, total costs must be reflected on this summary page.

7.2 COST FOR SCOPE OF WORK, SECTION IV
Item Description Unit Price Quantity Ext. Price
Per Node Configuration
Appliance $- $-
CPU $- $-
Memory $- $-
Storage $- $-
Networking $- $-
Licensing $- $-
Training/Certs $- $-
Installation $- $-
Other $- $-
Other $- $-
Shipping $- $-
Tax $- $-
Total
Hardware/Software
Cost

Note: Detail costs sheets shall be attached.

Response:

Please see Attachment 6 - City of Hemet RFP Pricing.pdf.

Page 383 of 402 ends

13.B

Page 1571 of 1602 ends

HPE Proposal Document Page-33

Annual Support
Item Description Unit Price
Year 1 $ -
Year 2 $ -
Year 3 $ -
Year 4 $ -
Year 5 $ -
Total Five-Year Cost $ -

Response:

Please see Attachment 6 - City of Hemet RFP Pricing.pdf and Attachment 5 – HPE GreenLake Statement of Work Sample Agreement.pdf.

Note: All associated charges, including shipping and taxes must be included in the grand total of the submitted proposal.

Addendum(a) No(s). has/have been received and is/are included in this quotation.

The undersigned hereby proposes and agrees to furnish any and all materials, equipment, tools, labor, and services for proposed hyperconverged solution,

The undersigned bidder certifies that this proposal is made in good faith, without collusion or connection with any other person or persons bidding on the work.

This proposal submitted by: Joseph Mack

Company Name Representative

Address

Phone & Fax Numbers

Email:

Authorized Signature

Hewlett Packard Enterprise Joseph Mack, Contracts Negotiator 1701 Mossy Oaks Road, Spring, TX 77389
(512) 319-0044
[email protected]

Page 384 of 402 ends

13.B

Page 1572 of 1602 ends

HPE Proposal Document Page-34

Attachments
Appendix A - Hyperconverged Solution and Services 2022 (Exceptions).pdf Attachment 1 – Solution Overview.pdf
Attachment 2 – Project Manager Resume.pdf
Attachment 3 – Storage Consultant Resume.pdf
Attachment 4 – Technical Services Business Consultant Resume.pdf Attachment 5 – HPE GreenLake Statement of Work Sample Agreement.pdf Attachment 6 – City of Hemet RFP Pricing.pdf
Attachment 7 – HPE GreenLake Core Training.pdf
Attachment 8 – HPE Storage Data Migration Service Data Sheet.pdf Attachment 9 – Technical White Paper - HPE Alletra dHCI for VMware vSphere.pdf Attachment 10 – HPE Nimble Storage dHCI Solution Security Guide – Secure Service Architecture Overview.pdf
Attachment 11 – Technical White Paper - Protecting Data from Ransomware with HPE StoreOnce Catalyst.pdf
Attachment 12 – VMWare Site Recovery Manager Datasheet.pdf Attachment 13 – Zerto 7.0 Platform Overview.pdf

Page 385 of 402 ends

13.B

Page 1573 of 1602 ends

Account Executive: Leslie Cartee
Phone: (800) 800-0019 ext. 34400
Fax: (603) 683-1405
Email: [email protected] Date: 2/22/2023
Valid Through: 3/24/2023
Account Manager: Account #: Riverside
Phone:

Fax:

Email:

Customer Contact: Scott Underwood Phone: (951) 765-3765 Email: [email protected] Fax: (951) 765-2385

DELIVERY FOB SHIP VIA SHIP WEIGHT TERMS CONTRACT ID#
Destination Small Pkg Ground Service Level .00 lbs Net 30 R210402 * Line # Qty Item # Mfg. Part # Description Mfg. Price Ext 1 42 16438867 V-VBRENT-VS-P01
MR-00
Corp. Annual Monthly Renewal Backup
and Replacement Enterprise for VMware
Veeam
-
Veeam 40.46$ 1,699.32$
2 14 41265815 V-VBRENT-0S-SUP
MG-00
Migration Socket to VUL 24X7 Support
Backup & Replication
Veeam
-
Veeam 513.43$ 7,188.02$
3 9 41478907 P-VBRVUL-0I-SU4
AR-00
Corp. Back up and Replace 4 Year
Subscription Renewal
Veeam
-
Veeam 3,803.69$ 34,233.21$
4 9 41279265 P-VBRVUL-0I-SU1
MG-00
Corp. VASVUL 1 Year Manager From
Socket to VUL Public
Veeam
-
Veeam 315.02$ 2,835.18$
5 7 41524514 P-VASVUL-0I-SU5
YP-00
Govt. Availability Suite VUL Sub Upfront
Billing 5 Year Subscription
Veeam
-
Veeam 5,630.45$ 39,413.15$
6 Pricing is good until 3/30/2023 -$
Subtotal 85,368.88$
Fee 0.00$
Shipping and
Handling 0.00$
Tax Exempt!
Total 85,368.88$
Hemet, CA 92543-4265
(951) 765-3765 (951) 765-3765
5-30 Days A/R/O
Important Notice: --- THIS QUOTATION IS SUBJECT TO THE FOLLOWING Terms of Sale: All purchases from GovConnection, Inc. are subject to the Terms and Conditions of our OMNIA Partners/Region 4 ESC Contract # R210402. Any Order accepted by GovConnection for the items included in this Quotation is expressly limited to those Terms and Conditions; any other terms and conditions referenced or appearing in your Purchase Order are considered null and void. No other terms and conditions shall apply without the written consent of GovConnection, Inc. Please refer to our Quote Number in your order.

SALES QUOTE
GovConnection, Inc. # 25426329.04
732 Milford Road PLEASE REFER TO THE ABOVE
QUOTE # WHEN ORDERINGMerrimack, NH 03054
City of Hemet
445 E Florida Ave
QUOTE PROVIDED TO: SHIP TO:

AB#: 21126818 AB#: 21074366
City of Hemet
445 E Florida Ave Scott Underwood
Hemet, CA 92543-4265
445 East Florida Ave

Page 1 of 2 ends

13.B

Page 1574 of 1602 ends

ORDERING INFORMATION
GovConnection, Inc. DBA Connection
OMNIA Partners/Region 4 ESC Contract #R210402
Contract Expiration: 31 May 2024

Please contact your account manager with any questions.

Ordering Address
GovConnection, Inc.
732 Milford Road
Merrimack, NH 03054
Remittance Address
GovConnection, Inc.

Box 536477
Pittsburgh, PA 15253-5906

Please reference the Contract # on all purchase orders.

TERMS & CONDITIONS

Payment Terms: NET 30 (subject to approved credit)
FOB Point: DESTINATION (within Continental US)
Maximum Order Limitation: NONE
FEIN: 52-1837891
DUNS Number: 80-967-8782
CEC: 80-068888K
Cage Code: OGTJ3
Business Size: LARGE

WARRANTY: Manufacturer’s Standard Commercial Warranty

NOTE: It is the end user's responsibility to review, understand and agree to the terms of any End User License Agreement (EULA).

Important Notice: --- THIS QUOTATION IS SUBJECT TO THE FOLLOWING Terms of Sale: All purchases from GovConnection, Inc. are subject to the Terms and Conditions of our OMNIA Partners/Region 4 ESC Contract #R210402. Any Order accepted by GovConnection for the items included in this Quotation is expressly limited to those Terms and Conditions; any other terms and conditions r eferenced or appearing in your Purchase Order are considered null and void. No other terms and conditions shall apply without the written consent of GovConnection, Inc. Please refer to our Quote Number in your order.

If you require a hard copy invoice for your credit card order, please visit the link below and click on the Proof of Purchase/Invoice link on the left side of the page to print one:
https://www.govconnection.com/web/Shopping/ProofOfPurchase.htm

Please forward your Contract or Purchase Order to:

[email protected]
QUESTIONS: Call 800-800-0019
FAX: 603.683.0374

Page 387 of 402 ends

13.B

Page 1575 of 1602 ends

HTTP://WWW.INSIGHT.COM

Page 1 of 2 ends

2701 E INSIGHT WAY
CHANDLER AZ 85286-1930
Tel: 800-467-4448
SOLD-TO PARTY 10383010

CITY OF HEMET

ACCOUNTS PAYABLE
445 E FLORIDA AVE
HEMET CA 92543-4209

SHIP-TO

CITY OF HEMET

ACCOUNTS PAYABLE
445 E FLORIDA AVE
HEMET CA 92543-4209
We deliver according to the following terms:

Payment Terms : Net 30 days
Ship Via : Insight Assigned Carrier/Ground
Terms of Delivery: : FOB DESTINATION
Currency : USD
Quotation
Quotation Number : 0226003313
Document Date : 24-FEB-2023
PO Number :

PO release: :

Sales Rep : Christopher Letsinger
Email : [email protected]
Telephone : +14804096848
Sales Rep 2 : Dorene Turner
Email : [email protected]
Telephone : +15097422278
In order for Insight to accept Purchase Orders against this contract and honor the prices on this quote, your agency must be registered with OMNIA Partners Public Sector (formerly U.S. Communities).

Our sales teams would be happy to assist you with your registration. Please contact them for assistance -- the registration process takes less than five minutes.

Material Material Description Quantity Unit Price Extended Price VVBRENTVSP0PMR00 Veeam Premium Support - technical support (renewal) - for Veeam Backup & Replication
Enterprise for VMware - 1 month
98 47.75 4,679.50
Coverage Dates: 01-AUG-2022 - 30-MAR-2023
OMNIA PARTNERS IT PRODUCTS & SERVICES(# 4400006644)
VVBRENTVSP01MR00 Veeam Standard Support - technical support (renewal) - for Veeam Backup & Replication
Enterprise for VMware - 1 month
98 38.91 3,813.18
Coverage Dates: 01-AUG-2022 - 30-MAR-2023
OMNIA PARTNERS IT PRODUCTS & SERVICES(# 4400006644)
VVBRVUL1SPE1MG07 MIGRATION FROM 1 SOCKET OF ENTERPRISE EDITION

PRODUCTION SUPPORT PERPETUAL SOCKE
14 590.25 8,263.50
OMNIA PARTNERS IT PRODUCTS & SERVICES(# 4400006644)
VVBRVUL07PE4AR1S RENEWAL OF VEEAM BACKUP & REPLICATION
UNIVERSAL PREVIOUSLY MIGRATED FROM. FOR 4
14 2,360.96 33,053.44
OMNIA PARTNERS IT PRODUCTS & SERVICES(# 4400006644)
PVBRVUL0ISU5YP00 Veeam Backup & Replication Universal License - Upfront Billing License (5 years) +
Production Support - 10 instances
7 5,107.42 35,751.94
Coverage Dates: 01-AUG-2022 - 30-MAR-2023
OMNIA PARTNERS IT PRODUCTS & SERVICES(# 4400006644)

Page 388 of 402 ends

13.B

Page 1576 of 1602 ends

HTTP://WWW.INSIGHT.COM
Document Date 24-FEB-2023
Quotation Number 226003313

Page 2 of 2 ends

Product Subtotal 85,561.56
TAX 3,615.23
Total 89,176.79
Thank you for choosing Insight. Please contact us with any questions or for additional information about Insight's complete IT solution offering.

Sincerely,
Christopher Letsinger
+14804096848
[email protected]
Fax 4807608104
Dorene Turner
+15097422278
[email protected]
Fax 8005460565
OMNIA Partners (formerly U.S. Communities) IT Products, Services and Solutions Contract No. 4400006644

Insight Public Sector (IPS) is proud to be a contract holder for the OMNIA Partners Technology Products, Services & Solutions Contract.

This competitively solicited contract is available to participating agencies of OMNIA Partners. OMNIA Partners assists local and state government agencies, school districts (K-12), higher education, and nonprofits in reducing the cost of purchased goods by pooling the purchasing power of public agencies nationwide. This is an optional use program with no minimum volume requirements and no cost to agencies to participate.

Thanks for choosing Insight!

Insight Global Finance has a wide variety of flexible financing options and technology refresh solutions. Contact your Insight representative for an innovative approach to maximizing your technology and developing a strategy to manage your financial options.

This purchase is subject to Insight’s online Terms of Sale unless you have a separate purchase agreement signed by you and Insight, in which case, that separate agreement will govern. Insight’s online Terms of Sale can be found at the “terms-and-policies” link below.

SOFTWARE AND CLOUD SERVICES PURCHASES: If your purchase contains any software or cloud computing offerings (“Software and Cloud Offerings”), each offering will be subject to the applicable supplier's end user license and use terms ("Supplier Terms") made available by the supplier or which can be found at the “terms-and-policies” link below. By ordering, paying for, receiving or using Software and Cloud Offerings, you agree to be bound by and accept the Supplier Terms unless you and the applicable supplier have a separate agreement which governs. https://www.insight.com/terms-and-policies

Page 389 of 402 ends

13.B

Page 1577 of 1602 ends

VUL and ADD ON Veeam Backup and Replication
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 01/25/2023 Quote Expires:03/31/2023 Quote #:155363Project #:107937 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX The following was quoted in
accordance with the CA
NASPO ValuePoint Contract
(California Contract #7-15-70
-34-002). Please make your
purchase order out to Nth
Generation Computing and
Reference the CA NASPO
ValuePoint Contract #7-15-70
-34-002
NASPO
7 Veeam Backup & Replication
Universal License. Includes
Enterprise Plus Edition
features. - 5 Years
Subscription Upfront Billing &
Production (24/7) Support -
Public Sector
$5,586.55 $39,105.85$5,859.00P-VBRVUL-0I-SU5YP
-00
5% N
$39,105.85

Page 1 of 217055 ends

Page 390 of 402 ends

13.B

Page 1578 of 1602 ends

VUL and ADD ON Veeam Backup and Replication
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 01/25/2023 Quote Expires:03/31/2023 Quote #:155363Project #:107937 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX Quote Subtotal $39,105.85
Est. Shipping *
$39,105.85TOTAL DUE

UNDER REVIEW
Tax Rate
Payment Terms
* Thank you for allowing Nth Generation to provide you with the above quotation. Charges for Shipping and insurance will be additional. If you require an estimated shipping cost prior to issuing a purchase order, please contact your sales or inside sales rep. This quotation is the sole property of Nth Generation Computing, Inc. and is intended as an offer to sell goods and services to the client named in this quote. This document may not be reproduced, or provided to parties outside this organization, without written consent of Nth Generation Computing, Inc.

8.750%

Page 2 of 217055 ends

Page 391 of 402 ends

13.B

Page 1579 of 1602 ends

Veeam Backup ad Replication
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 02/21/2023 Quote Expires:03/31/2023 Quote #:155998Project #:107937 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX The following was quoted in
accordance with the CA
NASPO ValuePoint Contract
(California Contract #7-15-70
-34-002). Please make your
purchase order out to Nth
Generation Computing and
Reference the CA NASPO
ValuePoint Contract #7-15-70
-34-002
NASPO
98 MONTHLY PRODUCTION
(24/7) MAINTENANCE
RENEWAL (INCLUDES 24/7

UPLIFT)-VEEAM BACKUP &

REPLICATION
ENTERPRISE. FOR

CUSTOMERS WHO OWN

VEEAM BACKUP &

REPLICATION

ENTERPRISE SOCKET

LICENSING PRIOR TO JULY
1ST, 2022.
$47.00 $4,606.00$47.36V-VBRENT-VS-
P0PMR-00
1% N

Page 1 of 317055 ends

Page 392 of 402 ends

13.B

Page 1580 of 1602 ends

Veeam Backup ad Replication
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 02/21/2023 Quote Expires:03/31/2023 Quote #:155998Project #:107937 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX 98 MONTHLY BASIC

MAINTENANCE RENEWAL-

VEEAM BACKUP &

REPLICATION
ENTERPRISE. FOR

CUSTOMERS WHO OWN

VEEAM BACKUP &

REPLICATION

ENTERPRISE, BASIC

SUPPORT SOCKET

LICENSING PRIOR TO JULY
1ST, 2022.
$38.00 $3,724.00$38.59V-VBRENT-VS-
P01MR-00
2% N
14 SIMPLE MIGRATION FROM

VEEAM BACKUP &

REPLICATION

ENTERPRISE TO VEEAM

BACKUP & REPLICATION
UNIVERSAL LICENSE.

INCLUDES ENTERPRISE
PLUS EDITION FEATURES.
1 YEAR WITH
PRODUCTION SUPPORT. 7
INSTANCE PACK.
$572.00 $8,008.00$585.40V-VBRVUL-1S-
PE1MG-07
2% N

Page 2 of 317055 ends

Page 393 of 402 ends

13.B

Page 1581 of 1602 ends

Veeam Backup ad Replication
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 02/21/2023 Quote Expires:03/31/2023 Quote #:155998Project #:107937 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX 14 VEEAM BACKUP &

REPLICATION UNIVERSAL
LICENSE. INCLUDES

ENTERPRISE PLUS
EDITION FEATURES.-4

YEARS RENEWAL

SUBSCRIPTION UPFRONT

BILLING & PRODUCTION
(24/7) SUPPORT. 7
INSTANCE PACK.
$2,290.00 $32,060.00$2,341.60V-VBRVUL-07-
PE4AR-1S
2% N
$48,398.00
Quote Subtotal $48,398.00
Est. Shipping *
$48,398.00TOTAL DUE

8.750%

Page 3 of 317055 ends

Page 394 of 402 ends

13.B

Page 1582 of 1602 ends

Pricing Proposal
Quotation #:  23131424
Created On:  2/23/2023
Valid Until:   3/31/2023

CA-City of Hemet Inside Account
Executive

Scott Underwood
445 E. Florida Ave
Hemet, CA 92543
United States
Phone: 9517652348
Fax:

Email: [email protected]

Jon Bateky
290 Davidson Ave
Somerset, NJ 08873
Phone: 732-584-8251
Fax: 732-564-3099
Email: [email protected]
All Prices are in US Dollar (USD)
Product Qty Your Price Total

1 Veeam Premium Support - Technical support (renewal) - for Veeam Backup & Replication Enterprise for VMware - 1 socket - includes 24/7 uplift - phone consulting - 1 month - 24x7
Veeam Software - Part#: V-VBRENT-VS-P0PMR-00
98 $49.90 $4,890.20

2 Veeam Standard Support - Technical support (renewal) - for Veeam Backup & Replication Enterprise for VMware - 1 socket - phone consulting - 1 month - 12x5 Veeam Software - Part#: V-VBRENT-VS-P01MR-00
98 $40.66 $3,984.68

3 MIGR FROM ENT PROD SUP 7 DENTYSIMPLE MIGRATION
Veeam Software - Part#: V-VBRVUL-1S-PE1MG-07
14 $623.06 $8,722.84

4 4YR MIGR FROM ENT PROD SUPRENEWAL 07 DENTY
Veeam Software - Part#: V-VBRVUL-07-PE4AR-1S
14 $2,492.20 $34,890.80

5 VEEAM BCK AND RPL VUL SUB 5YR LICS
Veeam Software - Part#: P-VBRVUL-0I-SU5YP-00
7 $5,367.71 $37,573.97

Subtotal $90,062.49
Shipping $0.00
*Tax $0.00
Total $90,062.49
*Tax is estimated. Invoice will include the full and final tax due.

Additional Comments
Veeam has a no returns policy.

Please note, if Emergency Connectivity Funds (ECF) will be used to pay for all or part of this quote, please let us know as we will need to ensure compliance with the funding program.

Hardware items on this quote may be updated to reflect changes due to industry wide constraints and fluctuations.

Page 395 of 402 ends

13.B

Page 1583 of 1602 ends

Thank you for choosing SHI International Corp! The pricing offered on this quote proposal is valid through the expiration date set above. To ensure the best level of service, please provide End User Name, Phone Number, Email Address and applicable Contract Number when submitting a Purchase Order.

SHI International Corp. is 100% Minority Owned, Woman Owned Business.

TAX ID# 22-3009648; DUNS# 61-1429481; CCR# 61-243957G; CAGE 1HTF0 The Products offered under this proposal are resold in accordance with the SHI Online Customer Resale Terms and Conditions , unless a separate resale agreement exists between SHI and the Customer.

Page 396 of 402 ends

13.B

Page 1584 of 1602 ends

Aruba Network Refresh
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 01/03/2023 Quote Expires:03/20/2023 Quote #:154984Project #:112903 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX The following was quoted in
accordance with the NASPO
Data Comm CA - AR3228-
CA.

NASPO
Hardware
2 Aruba 8325-48Y8C FB 6 F 2
PS Bdl
$28,431.00 $56,862.00$46,645.00JL624A:ABA 39% Y
2 Aruba X474 4-post Rack Kit $174.00 $348.00$285.00JL483C 39% Y 50 Aruba 25G SFP28 LC SR
100m MMF XCVR
$802.00 $40,100.00$1,316.00JL484A 39% Y
20 Aruba 10G SFP+ LC SR
300m MMF XCVR
$806.00 $16,120.00$1,322.00J9150D 39% Y
1 Aruba X472 2-post Rack Kit $70.00 $70.00$115.00JL482C 39% Y 1 Aruba X2C2 RJ45 to DB9
Console Cable
$20.00 $20.00$33.00JL448A 39% Y
$113,520.00
Support
2 Aruba 5Y FC NBD Ex HW
8325-48 SVC
$2,144.00 $4,288.00$2,552.00HU7K1E 16% N
$4,288.00
Subscription

Page 1 of 217055 ends

Page 397 of 402 ends

13.B

Page 1585 of 1602 ends

Aruba Network Refresh
Account Manager:
[email protected]
[email protected]
James Gonzalez
Lisa Byers
[email protected]
Inside Sales:

Email Orders To:

Email:

Phone:

Scott Underwood
City of Hemet
445 E. Florida Ave.

Hemet, CA 92543
Quoted to: Ship to:

Quote Date: 01/03/2023 Quote Expires:03/20/2023 Quote #:154984Project #:112903 EXT PRICEUNIT PRICEQTYPART # DESCRIPTION LIST PRICE DISC% TAX 2 Aruba Central 8xxx Switch
Foundation 5 year
Subscription E-STU
$3,996.00 $7,992.00$6,590.00R3K05AAE 39% N
$7,992.00
Services
32 HPE Aruba WW Education
Tech Training SVC
$168.00 $5,376.00$200.00H1EJ9E 16% N
$5,376.00
Quote Subtotal $131,176.00
$9,933.00
Est. Shipping *
$141,109.00TOTAL DUE

8.750%

Page 2 of 217055 ends

Page 398 of 402 ends

13.B

Page 1586 of 1602 ends

Hardware Software Services ITSolutionsBrandsResearchHub SCOTT UNDERWOOD,Thank you for considering CDWG for your technology needs. The details of your quote are below. If you are an eProcurement or single sign on customer, please log into your system to access the CDW site. You can search for your quote to retrieve and transfer back into your system for processing.For all other customers, click below to convert your quote to an order.

Convert Quote to Order
QUOTE# QUOTEDATE QUOTEREFERENCE CUSTOMER# GRANDTOTALNDMJ65112/30/2022NDMJ6516630936$171,249.21 QUOTEDETAILSITEM QTY CDW# UNITPRICE EXT.PRICEHPE Aruba 8325-48Y8C - switch - 48 ports - managed - rack-mountable - TAA C2 6741121$27,593.61$55,187.22Mfg. Part#: JL624AContract: National IPA Technology Solutions (2018011-01)HPE Aruba X472 2-post Rack Kit - switch mounting kit2 7134324$63.46$126.92Mfg. Part#: JL482CContract: National IPA Technology Solutions (2018011-01) HPE Aruba X474 4-post Rack Kit - switch mounting kit2 7140011$157.47$314.94Mfg. Part#: JL483CContract: National IPA Technology Solutions (2018011-01) HPE Aruba - SFP+ transceiver module - 10 GigE20 5787995$1,181.67$23,633.40Mfg. Part#: J9150DUNSPSC: 43201553Contract: National IPA Technology Solutions (2018011-01) HPE Aruba - SFP28 transceiver module - 25 Gigabit LAN50 6893948$1,127.45$56,372.50Mfg. Part#: JL484AContract: National IPA Technology Solutions (2018011-01) HPE Aruba X2C2 Console Cable - network cable2 4766300$21.48$42.96Mfg. Part#: JL448AUNSPSC: 26121609Contract: National IPA Technology Solutions (2018011-01) NEW ITEM 2 NEW-ITEM$10,896.30$21,792.60Mfg. Part#: NEW-ITEMHPE 5Y FC NBD ARUBA 8325-48 SVCHPE Foundation Care Next BusinessDay Service - extended serviceagreement

Page 399 of 402 ends

13.B

Page 1587 of 1602 ends

Page 2 of 2 ends

QUOTEDETAILS(CONT.)Contract: Standard Pricing
SUBTOTAL $157,470.54SHIPPING $0.00SALESTAX $13,778.67GRANDTOTAL $171,249.21PURCHASERBILLINGINFO DELIVERTOBilling Address:CITY OF HEMETACCOUNTS PAYABLE445 E FLORIDA AVEHEMET, CA 92543-4265Phone: (951) 765-2348Payment Terms: Net 30 Days-Govt State/Local Shipping Address:CITY OF HEMETSCOTT UNDERWOOD445 E FLORIDA AVEHEMET, CA 92543-4265Phone: (951) 765-2348Shipping Method: UPS Ground (1 - 2 Day)Pleaseremitpaymentsto:CDW Government75 Remittance DriveSuite 1515Chicago, IL 60675-1515 Sales Contact Info
Jordan Hamu | (877) 881-6914 | [email protected]
NeedHelp?
MyAccount
Support
Call 800.800.4239
About Us |Privacy Policy |Terms and Conditions This order is subject to CDW's Terms and Conditions of Sales and Service Projects athttp://www.cdwg.com/content/terms-conditions/product-sales.aspxFor more information, contact a CDW account manager © 2023 CDWG LLC, 200 N. Milwaukee Avenue, Vernon Hills, IL 60061 | 800.808.4239

Page 400 of 402 ends

13.B

Page 1588 of 1602 ends

Pricing Proposal
Quotation #:  22907732
Created On:  12/29/2022
Valid Until:   1/31/2023

CA-City of Hemet Inside Account
Executive

Scott Underwood
445 E Florida Ave
Hemet, CA 92543-4209
United States
Phone: (951) 765-2300
Fax:

Email: [email protected]

Jon Bateky
290 Davidson Ave
Somerset, NJ 08873
Phone: 732-584-8251
Fax: 732-564-3099
Email: [email protected]
All Prices are in US Dollar (USD)
Product Qty Your Price Total

1 HPE Aruba 8325-48Y8C - Switch - L3 - managed - 48 x 10/25 Gigabit SFP+ / SFP28 + 8 x 40/100 Gigabit QSFP+ / QSFP28 - front to back airflow - rack-mountable - TAA Compliant
Hewlett Packard Enterprise - Part#: JL624A
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
2 $40,087.58 $80,175.16

2 HPE Foundation Care 4-Hour Exchange Service - Extended service agreement - replacement - 5 years - shipment - 24x7 - response time: 4 h - for P/N: JL624A, JL624AR, JL624AR#ABA, JL625A, JL625AR, JL625AR#ABA, JL857A, JL858A Hewlett Packard Enterprise - Part#: HC7H8E
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
2 $19,723.85 $39,447.70

3 HPE Aruba - SFP+ transceiver module - 10 GigE - 10GBase-SR - SFP+ / LC multi- mode - up to 300 m - for HPE Aruba 2930F 12, 2930F 8G, 2930M 40, 6300, 6405 48, 6405 96, 64XX, 72XX, 83XX; CX 8360
Hewlett Packard Enterprise - Part#: J9150D
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
20 $926.22 $18,524.40

4 HPE Aruba - SFP28 transceiver module - 25 Gigabit LAN - 25GBase-SR - LC multi- mode - up to 100 m - for HPE Aruba 8325-48Y8C; CX 8360-12C V2, 8360-16Y2C V2 Hewlett Packard Enterprise - Part#: JL484A
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
50 $932.11 $46,605.50

5 HPE Aruba X472 2-post Rack Kit - Switch mounting kit - 2-post - rack mountable Hewlett Packard Enterprise - Part#: JL482C
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
2 $81.44 $162.88

6 HPE Aruba X474 4-post Rack Kit - Switch mounting kit - rack mountable Hewlett Packard Enterprise - Part#: JL483C
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
2 $201.86 $403.72

Page 401 of 402 ends

13.B

Page 1589 of 1602 ends

7 HPE Aruba X2C2 Console Cable - Network cable - RJ-45 (M) to DB-9 (F) - for FlexNetwork 5510 24, 5510 48; HPE Aruba 2530, 2930M 24, 2930M 48, 3810M 24, 3810M 48, 8325
Hewlett Packard Enterprise - Part#: JL448A
Contract Name: Sourcewell- Technology Catalog Solutions Contract #: 081419-SHI
2 $23.37 $46.74

Subtotal $185,366.10
Shipping $0.00
*Tax $13,531.36
Total $198,897.46
*Tax is estimated. Invoice will include the full and final tax due.

Additional Comments
Please Note: Hewlett Packard Enterprise has a zero returns policy on custom build machines.

SHI SPIN: #143012572
SHI-GS SPIN (For Texas customers ONLY): #143028315
For E-rate SPI orders, applicant shall be responsible for payment of any outstanding or ineligible costs if USAC rejects reimbursement claim in whole or in part.

Please note, if Emergency Connectivity Funds (ECF) will be used to pay for all or part of this quote, please let us know as we will need to ensure compliance with the funding program.

Hardware items on this quote may be updated to reflect changes due to industry wide constraints and fluctuations.

SHI International Corp. is 100% Minority Owned, Woman Owned Business.

TAX ID# 22-3009648; DUNS# 61-1429481; CCR# 61-243957G; CAGE 1HTF0 The products offered under this proposal are resold in accordance with the terms and conditions of the Contract referenced under that applicable line item.

Page 402 of 402 ends

13.B

Page 1590 of 1602 ends

City of Hemet
City Council Meeting

STAFF REPORT

Meeting: City Council Meeting - Mar 14 2023
Department: Fire Department
Submitted by: Mark Prestwich, City Manager
Eddie Sell, Fire Chief;

☐ Receive and File ☐ Consent Calendar ☒ Business Item ☐ Public Hearing

TITLE:

A Resolution of the City Council of the City of Hemet, California, Approving the Third Amendment in the amount of $484,642.48 to the Agreement for Services between the City of Hemet and Willdan Engineering for a Total Contract Amount Not to Exceed $950,000 per City Fiscal Year and Authorizing the City Manager to Execute the Agreement and Authorizing the Finance Director to Record a Supplemental Appropriation and a Revenue Estimate Increase to the Fiscal Year 2022 -23 Adopted Budget in the amount of $484,642.48

RECOMMENDED ACTION:

It is respectfully recommended that the City Council:

Adopt a Resolution of the City Council of the City of Hemet, California, approving the Third Amendment in the amount of $484,642.48 to the Agreement for Services between the City of Hemet and Willdan Engineering for a Total Contract Amount Not to Exceed $950,000 per City fiscal year and authorizing the City Manager to Execute the Agreement and Authorizing the Finance Director to Record a Supplemental Appropriation and a Revenu e Estimate increase to the Fiscal Year 2022 -23 Adopted Budget in the amount of $484,642.48.

BACKGROUND:

The City of Hemet contracts with Willdan to provide plan check, inspection, and permit technician services. On September 8, 2022 the City entered int o a contract (not to exceed $50,000) with Willdan for permit technician and inspection services.

On September 27, 2022, the First Amendment to the contract was approved and the contract not -to- exceed amount was increased to $200,000.

On February 28, 20 23, the Second Amendment to the contract was approved in the amount of $265,357.52 for a total amount not -to-exceed of $465,357.52 for permit technician and inspection services. This amendment was recommended by staff to become current with Willdan for s ervices performed through January 2023. At this same meeting, staff advised the City Council that a future

Page 1 of 12 ends

13.C

Page 1591 of 1602 ends

amendment was forthcoming to recommend an additional appropriation to continue services for permit technician and inspection services through the remainder of the FY 2022-23.

ANALYSIS:

At the adoption of the FY 2022 -23 Operating Budget, Building and Planning staff had conservatively estimated Building revenues to amount to approximately $1.4 million for the fiscal year. However, through the end of January 2023 significant activity in co nstruction and development projects has occurred citywide and Building revenues appear to be surpassing staff original estimates and are projected to end the year at $2.6 million. The table below illustrates staff's original revenue expectations compared to the year-to-date activities and staff's updated revenue projections for the FY 2022-23.

Based on this analysis, staff is anticipating the building revenues in these categories will exceed budget forecasts in the total amount of $1.2 million for the FY 2022-23.

DISCUSSION:

The Building and Safety Division requires inspections and permit technician services to process the projects and permits that are submitted daily to the City. With the increase in permitting and building activity, the Building and Safety Division is recommending a third amendment to the Willdan contract to continue to provide external services to advance projects and permits forward. The services include Field Inspection and Permit Technician Services. This will allow for continuous services to developers, builders, and residents. The current contract with Willdan amounts to a not -to-exceed amount of $465,357.52 and would need to be increased by an additional amount of $484,642.48 to an updated not-to-exceed amount of $950,000 for the remainder of the Fiscal Year 2022-23.

It is helpful to note that the Building Division has seen a substantial increase in construction, building and development projects citywide. Given this and the anticipated growth through the remainder of the fiscal year, the cost to provide these services will also increase. Overall, based on the updated building revenue projections when compared to the original budget expectations, the cost for the Third Amendment with Willdan will be more than offset by this revenue increase.

The proposed amendment also includes a new mandatory invoice notification provision that requires Willdan to notify the City in writing when costs the consultant expects to incur in the following 60 days, when added to all costs previously incurred, exceed 80% of the contract's not to exceed amount.

PREVIOUS COUNCIL ACTION:

On September 8, 2022, the City entered into a contract with Willdan Engineering Services (not to exceed $50,000) for permit technicians, plan check, and inspection services.

Page 2 of 12 ends

13.C

Page 1592 of 1602 ends

On September 27, 2022, the City entered into a contract with Willdan Engineering Services (not to exceed $200,000) for permit technicians, plan check, and inspection services.

On February 28, 2023, the Second Amendment to the contract was approved in the amount of $265,357.52 for a total amount not-to-exceed $465,357.52.

STRATEGIC PLAN INTEGRATION:

GOAL TWO: ECONOMIC OPPORTUNITY
To ensure that Hemet is a hub, with access to quality jobs, shopping options, and a varied and sustained tax base.

Objective 1: Develop business practices that welcome new development by streamlining processes.

Objective 2: Provide resources for new businesses to enhance the customer service experience.

GOAL FIVE: ORGANIZATIONAL EFFECTIVENESS
To identify the work needed inside the City organization to effectively provide services to the community and ensure financial stability.

Objective 1: Operate in a financially sustainable manner.

Objective 2: Evaluate existing practices to ensure continuity with industry best practices.

Objective 3: Provide Council with policies that are consistent while lessening liabilities.

Objective 4: Increase employee retention by training and creating a positive workplace.

Objective 5: Streamline fire prevention coordination efforts.

FISCAL IMPACT:

To adopt a Resolution approving the Third Amendment in the amount of $484,642.48 to the Agreement for Services between the City of Hemet and Willdan Engineering for a total contract amount not -to- exceed $950,000 would entail a supplemen tal appropriation to the Building Division - Contract Inspection/Plan Check Service budget in the amount of $484,642.48 (account no. 120-3300-2610) and revenue estimate increases to Building Permits in the amount of $390,357.48 (account no. 120 -0221) and Building Plan Check in the amount of $94,285 (account no. 120-0630) to the FY 2022-23 Adopted Budget.

ATTACHMENT(S):

Willdan Resolution 3rd amendment
Willdan - Plan Review, Field Inspection and Permit Tech - Third Amendment

Page 3 of 12 ends

13.C

Page 1593 of 1602 ends

City of Hemet Resolution No. 2023-xxx

CITY OF HEMET

HEMET, CALIFORNIA
RESOLUTION NO. 2023-xxx

A RESOLUTION OF THE CITY COUNCIL OF THE

CITY OF HEMET, CALIFORNIA, APPROVING THE

AGREEMENT FOR SERVICES BETWEEN THE

CITY OF HEMET AND WILLDAN ENGINEERING

FOR A CONTRACT AMOUNT NOT TO EXCEED
$950,000 PER CITY FISCAL YEAR AND

AUTHORIZE THE CITY MANAGER TO EXECUTE

THE AGREEMENT AND RECORDING A

SUPPLEMENTAL APPROPRIATION IN THE
AMOUNT OF $484,642.48
The City Council of the City of Hemet, California (hereafter referred to as the “City Council”) does resolve as follows:

WHEREAS, City and Willdan Engineering entered into an
Agreement on September 8, 2022 to provide Building and Safety Service; and
WHEREAS, The City Council approved the First
Amendment, dated September 27, 2022 to provide a not to exceed amount of $200,00 per fiscal year; and
WHEREAS, The City Council approved the Second
Amendment, dated February 28, 2023 to provide a not to exceed amount of $465,357.52; and
WHEREAS, the City of Hemet desires to increase the not to exceed amount to nine hundred and fifty thousand dollars ($950,000) per City fiscal year and record a supplemental appropriation in the amount of $484,642.48.

Page 4 of 12 ends

13.C

Page 1594 of 1602 ends

City of Hemet Resolution No. 2023-xxx
.

NOW, THEREFORE, THE CITY COUNCIL OF THE CITY

OF HEMET FINDS, DETERMINES, ORDERS AND RESOLVES
AS FOLLOWS:

SECTION 1. Incorporation of Recitals, The City Council of the City of Hemet finds and determines that the above referenced recitals are true and correct and the material to this Resolution.

SECTION 2. City Council Actions.
a) The City Manager, or his designee, is authorized and directed to utilize the funds allocated in the Building and Safety Division budget.
b) The City Manager, or his designee, is authorized and directed to execute the Agreement for Services between the City of Hemet and Willdan Engineering, with the contract pricing for the term of the agreement not to exceed a total of nine hundred and fifty thousand dollars ($950,000) per Fiscal Year,
c) The City Manager, or his designee, is authorized and directed to execute any purchase orders, agreements, or other documents necessary to effectuate the contract in an amount not to exceed nine hundred and fifty thousand dollars ($950,000) per Fiscal Year, so long as such purchase orders, agreements, or other documents are in a form approved by the City Attorney

Page 5 of 12 ends

13.C

Page 1595 of 1602 ends

City of Hemet Resolution No. 2023-xxx
d) The Finance Director is authorized and directed to record a supplemental appropriation of $484,642.48 to the FY 2022-23 budget for the Building and Safety Division (120-3300-2610).

PASSED, APPROVED AND ADOPTED this 14th day of
March, 2023.
____________________________
Joe Males, Mayor
ATTEST:
_____________________________
John Paul Maier, City Clerk

Page 6 of 12 ends

13.C

Page 1596 of 1602 ends

City of Hemet Resolution No. 2023-xxx
State of California )
County of Riverside )
City of Hemet )
I, John Paul Maier, City Clerk of the City of Hemet, do hereby certify that the foregoing resolution was adopted by the Hemet City Council on the 14th day of March, 2023, and was passed by the following vote:

AYES: Council Members: None.

NOES: Council Members: None.

ABSTAIN: Council Members: None.

ABSENT: Council Members: None.
_____________________________
John Paul Maier, City Clerk

Page 7 of 12 ends

13.C

Page 1597 of 1602 ends

Page 8 of 12 ends

13.C

Page 1598 of 1602 ends

THIRD AMENDMENT TO AGREEMENT FOR

PROFESSIONAL SERVICES
by and between
the

CITY OF HEMET
and

WILLDAN ENGINEERING
a California corporation
Dated March 15, 2023

Page 9 of 12 ends

13.C

Page 1599 of 1602 ends

THIRD AMENDMENT TO AGREEMENT FOR PROFESSIONAL SERVICES
This Third Amendment to Agreement for Professional Services (“Third Amendment”), which is dated for reference as indicated on the cover page, is hereby entered into by and between the CITY OF HEMET, a California municipal corporation (“City”), and Willdan Engineering, a California Corporation (“Contractor”). City and Contractor are sometimes hereinafter individually referred to as “Party” and hereinafter collectively referred to as the “Parties.”

RECITALS
A. City and Contractor entered into an Agreement for Plan Review, Field Inspection, and Permit Technician Services on September 8, 2022 (“Agreement”) which provided that the total compensation shall not exceed $50,000 per City fiscal year.

B. The City and Contractor amended the Agreement by the First Amendment, increasing the total compensation to not exceed $200,000 per City fiscal year.

C. This Second Amendment amends the Agreement to provide that total compensation for FY 2022-23 shall not exceed $465,357.52.

D. This Third Amendment amends the Agreement to provide that the total compensation shall not exceed $950,000 per City fiscal year.

OPERATIVE PROVISIONS
NOW, THEREFORE, in consideration of the promises made and recited herein, the Parties do hereby enter into this Third Amendment which modifies and amends the Agreement as follows:

1. AMENDMENT. The Agreement is hereby modified and amended as follows:

1.1 [COMPENSATION AND METHOD OF PAYMENT]. Section 4 of the Agreement is hereby amended as follows:

Subject to any limitations set forth in this Agreement, City agrees to pay Contractor the amounts specified in Exhibit “B” “Compensation” and made a part of this Agreement by this reference. The total compensation, including reimbursement for actual expenses, shall not exceed nine hundred and fifty thousand dollars ($950,000) per City fiscal year, in accordance with Section 26 “Administration and Implementation” or Section 28 “Amendment” of this Agreement.
1Page 10 of 12

13.C

Page 1600 of 1602 ends

2 (Signatures on following page.)

Page 11 of 12 ends

13.C

Page 1601 of 1602 ends

3 IN WITNESS WHEREOF, the Parties hereto have executed this Third Amendment to the Agreement on the date and year first written above.

CITY:

THE CITY OF HEMET
By:_________________________________
Mark Prestwich, City Manager
ATTEST:
______________________________
John Maier, City Clerk

APPROVED AS TO FORM
______
Steven Graham, City Attorney
CONTRACTOR:

By:

Name:

Title:

By:

Name:

Title:

Page 12 of 12 ends

13.C

Page 1602 of 1602 ends

Hemet City CouncilMarch 14, 2023

Hemet City Council
March 14, 2023