Internet, firewalls, vmware, vxrail and network switches for cef sandton and sanpc refinery (3 years)

Closing date: 05 November 2026 at 12:00 (midday)

Briefing session: None

Tender validity period: 120 days from closing date (until 05 March 2027)

Enquiries (technical and procurement):

• Contact: Wellem Skhosana
• Email: [email protected]
• Telephone: 010 201 4793

Submission:

• Method: email
• Submission email: [email protected]

Service delivery locations:

• CEF Sandton, Sandton, Gauteng (approximately 200 users)
• SANPC Refinery, Prospecton, KwaZulu-Natal (approximately 100 users)

Submission method: email only, to [email protected]

Closing time: 05 November 2026 at 12:00 (midday)

• Late emails are disqualified.
• Emails sent to the wrong address are not accepted.
• Links (URLs) in the submission are not accepted and will lead to disqualification.
• Do not copy or blind copy any CEF SCM representative in the response; doing so disqualifies the bid.
• All returnable documents must be submitted with the proposal; missing any may lead to disqualification.

Returnable documents (each must be completed, signed and submitted):

• Part 3: Proposal Form – the offer, including bidder details and acceptance of terms.
• Part 4: Signing Power – Resolution of Board of Directors authorising the signatory.
• Part 5: Certificate of Acquaintance with RFP Documents – confirms the bidder has read and understood all RFP conditions.
• Part 6: Certificate of Acquaintance with Scope of Work – confirms familiarity with the scope.
• Part 7: Breach of Law Form – declares any serious breach of law in the preceding 5 years.
• SBD 1: Invitation to Bid – bidder and contact details, signed as cover page.
• SBD 4: Bidder's Disclosure – declares any relationship with state employees or the procuring institution.
• SBD 6.1: Preference Points Claim Form – claims B-BBEE and specific goal points under the 2022 regulations.
• Valid SARS tax compliance status (or tax verification PIN) – for consortia/JVs, each party must submit separately.
• Valid B-BBEE affidavit or certificate.
• CSD Summary Report or CSD supplier number (MAAA...).
• Proof of authority (e.g. company resolution) for the signatory.

Disqualification risks:

• Any returnable document omitted or unsigned.
• Fraudulent, untrue or inaccurate information.
• Attempts to canvass CEF officers or employees between closing and award.
• Collusion with other bidders.
• Receiving information not available to other bidders through fraudulent means.

Evaluation is in three phases:

Phase 1: Mandatory requirements – failure to comply with any disqualifies the bid.

• Bidder must have its own Network Operation Centre (NOC) in South Africa for at least three years, with a 24x7x365 call logging facility. Supporting document: letter on company letterhead confirming NOC existence and period of operation, signed and dated.
• Bidder must have a service level agreement with the OEM for internet, network switches and firewall solutions (or be the OEM). Supporting document: valid certificate/letter from the OEM.
• Bidder must be a valid member of the Internet Service Provider Association of South Africa (ISPA).

Phase 2: Technical evaluation – criteria in Annexure B (not fully extracted).

Phase 3: Price and specific goals – 80/20 preference point system (price 80 points, specific goals 20 points).

• Specific goals points: 10 for enterprises with 51% or more black ownership; 5 for 51% or more women ownership; 3 for 51% or more youth ownership; 2 for 10% or more disability ownership.
• Failure to submit proof for specific goals means those points are not claimed.
• CEF reserves the right to award to the highest scoring bidder unless objective criteria justify otherwise.

The department requires a service provider to supply, install, configure and support internet connectivity, managed firewalls, VMware, Dell VxRail and network switches for CEF Sandton and SANPC Refinery over 36 months.

Internet connectivity (both sites):

• Two dedicated fibre links per site: primary 500 Mbps and backup 500 Mbps.
• Symmetrical upload/download, low latency, high availability.
• SLA uptime of 99.5% or higher, subject to penalties.
• 40 usable public IP addresses per site.
• Guaranteed 1:1 contention ratio for local and international connectivity.
• The two links must come from different ISPs/vendors.

APN connectivity (36 months):

• 300 activated SIM cards (150 eSIMs, 150 physical SIMs) with combined 2 TB (2,048 GB) recurring monthly data.
• Secure private APN with encrypted connectivity.
• Web-based management portal for SIM activation/deactivation, data usage monitoring, bundle allocation, reporting, alerts and inventory management.
• Centralised administration, role-based access control, audit logging.

Managed firewalls:

• Replace existing HA clusters: Quantum Force 3950 at CEF Sandton HQ, Quantum Force 3920 at SANPC Refinery.
• Deploy HA cloud firewall cluster in Azure.
• High-availability clusters using ClusterXL.
• Central security management for policy, threat prevention, VPN, logging, reporting.
• Controlled migration and recertification of existing firewall rules, objects, NAT, VPN and threat-prevention settings.
• Integration with CEF identity services, SIEM/SOC, NTP, DNS, PKI, email alerting, ticketing and monitoring systems.
• Each site will have two firewalls for redundancy and seamless failover.

Network switches:

• Two modular enterprise-grade core switches (one at each site) with: 38.4 Tbps switching capacity, 28,800 Mpps forwarding, dual main controller boards, redundant power supplies, 48 x 1GbE RJ45 ports, 48 x 10GbE SFP+ ports, 12 x 40GbE QSFP+ ports, support for chassis clustering/virtual switching, required transceivers (48 x 10GbE SFP+, 12 x 25GbE SFP28, 2 x 40GbE QSFP+), centralised management platform.
• Core features: Intent-Based Networking (IBN), VXLAN/EVPN, Layer 2/3 overlays, OSPF/IS-IS, automated provisioning, model-driven telemetry (NETCONF/YANG).
• Six enterprise-grade 48-port PoE+ access switches (three per site) with: 48 x 1GbE ports, 4 x 10GbE SFP+ uplinks, 2 stacking ports, PoE+, N+1 redundant power supplies, 520 Gbps switching, 168 Mpps forwarding, iStack support.
• Access features: VXLAN/EVPN integration, Layer 2/3 segmentation, IBN, automated provisioning, real-time telemetry (gRPC).

VMware and VxRail:

• 36-month quotation: 12 months support for existing Dell VxRail S570 hardware (service tags FW707X2, GW707X2, HW707X2, JW707X2, 1X707X2) and 24 months support for upgraded hardware (latest Dell VxRail S570 or equivalent).
• VMware licensing: 12 months for current environment (vSphere 6 Enterprise Plus, vSAN Enterprise, vCenter Server 6 Standard) and 24 months for upgraded environment including 80 cores of VMware vSphere Foundation, 90 TiB vSAN add-on, three-year ProSupport Plus with four-hour mission-critical support and parts replacement, plus licence application and cluster configuration assistance.

Deliverables:

• Two 500 Mbps fibre links per site (primary and backup).
• APN solution with 300 SIMs and 2 TB monthly data.
• HA managed firewalls at Refinery, Azure Cloud and CEF Sandton.
• 2 core switches and 6 access switches supplied, installed and configured.
• 40 public IP addresses per site.
• VxRail and VMware licences.
• All network equipment insured by the service provider for theft, damage and acts of God for the contract duration.
• Documentation: network configuration, topology, IP addressing, firewall configuration, security and failover test reports.
• Training and knowledge transfer to CEF and SANPC ICT staff.
• 36-month post-implementation support and monitoring.

Service level requirements:

• Internet link uptime: 99.5% or higher.
• Firewall HA failover time: less than 10 seconds.
• Support response: critical incidents within 1 hour; high-priority within 4 hours; normal within 8 business hours.

Pricing schedule: full scope of work pricing schedule must be completed, showing once-off charges, monthly charges, and totals for each of the three years, plus total per line item over 3 years.

• Line items: 500Mbps primary/backup fibre for SANPC-REFINERY and CEF Sandton, APN, Managed Firewall Solution (three sites), Network Switches (2 core, 6 access), Support/Service management/Service desk (both sites), Static public IP addresses, VMware License, Dell VxRail License, Other costs.
• Total Excl. VAT, VAT, Total Inc. VAT must be shown.
• The table is a template; bidders must amend to include all foreseeable costs, including price escalations over the 3-year period.

No bid security, bonds, guarantees, retention or payment terms are stated in the document.

Tax compliance:

• Valid SARS tax compliance status or tax verification PIN required at closing date and time.
• For consortia/JVs, each party must submit a separate tax compliance status/PIN/CSD number.
• If no TCS PIN, provide CSD number.
• Tax compliance must remain valid for the duration of the contract; failure to renew may lead to termination.

B-bbee:

• Valid B-BBEE affidavit or certificate required.
• B-BBEE points claimed via SBD 6.1 under the 80/20 system.

Csd:

• CSD Summary Report or CSD supplier number (MAAA...) required.

State employment:

• Bids from persons in the service of the state, or companies/CCs with directors/members in the service of the state, will not be considered.

Breach of law:

• Must declare any serious breach of law in the preceding 5 years (Part 7).
• CEF may exclude bidders found guilty of serious breach of law.

Security screening:

• CEF may subject the bidder to security screening by the State Security Agency (SSA) before appointment.

Legal review:

• Proposal will be reviewed by CEF's Legal Counsel; acceptance/rejection of proposed contractual terms is at CEF's discretion.

Evaluation is in three phases: Phase 1 mandatory requirements, Phase 2 technical evaluation (Annexure B), Phase 3 price and specific goals (80/20 system). Mandatory requirements include having an own NOC in South Africa for at least three years, OEM service level agreements for internet, switches and firewalls, and ISPA membership. Technical evaluation criteria are detailed in Annexure B (not fully extracted). Price and specific goals are scored out of 100 (80 price, 20 specific goals).