Refer to Schedule 1 - Scope of Requirements and Specifications

Question:
Hi Team

Can you please address the following clarification questions?

1. Regarding the requirement for MACsec support, the vast majority of deployments we see, including other university deployments within Australia, will enable MACsec only on links that leave the customer’s premises; for example the Data Centre Interconnect (DCI) links. Doing this allows the customer to optimise the CapEx and OpEx of the solution while still protecting the authenticity, privacy and integrity of their data. Can the requirement for MACsec support be limited to the DCI links in the proposed solution?

2.Regarding the requirement for physical console support, does this requirement relate to the proposed network devices possessing console ports or is it calling for a physical console server to be included in the Out of Band management network component?

3.Is flow telemetry required within the proposed management platform?

4.Is bug and vulnerability exposure reporting required within the proposed management platform? If required, should the reporting cover all severity of bugs?

5.Is the ability to compare state in the network at different points in time, for example before and after a change, required within the proposed management platform?

6.What speed and media type will be used to connect the firewalls to the new network E.g. 100G LR1, 100G SR4, 100G BiDi, 10G LR?

Thank you

Answered on 14/Jul/2026 09:07 AM:


1. Yes, we only use MACsec on the link between the Rockhampton and Sydney data centres

2. It only calls for the devices to have a console port.

3. No, but it would be nice to have.

4. The focus is on security bugs not minor feature bugs. There needs to be a timely mechanism for alerting CQU regarding these. Having reporting on bugs, searchable by severity, in the platform would be nice to have.

5. The ability to checkpoint and rollback configuration is expected in devices of this type.

6. Firewalls are connected with 10G LR in Rockhampton and 10GSR in Sydney.

Question:
(Question 1) If you could please help us confirm whether the below mentioned optics / transceivers quantity is correct for both the sites put together? We just want to make sure we are quoting like to like vs Cisco and any other vendor bidding for fair comparison in terms of technicalities and commercials.

15 x Transceiver, SFP+, 10GbE, LR, 1310nm Wavelength, 10km Reach

14 x Transceiver, 25GbE SFP28 SR, No FEC, MMF, Duplex LC

50 x Transceiver, 100GbE QSFP28 SR4, No FEC Capable, MPO, MMF

2 x Transceiver, QSFP28 100GbE SR1.2, BD, LC Duplex, OM3/OM4 MMF

64 x Transceiver, SFP+, 10GbE, SR, 850nm Wavelength, 300m Reach

18 x Transceiver, SFP, 1000BASE-T

8 x Transceiver SFP+ 1/10GBASE-T 30m, rate-adaptive

(Question 2) Also, need to confirm with the customer on the cabling needed for both the sites so we can amend the quote accordingly (quantity and length of cables needed)?

It would be great if we can get on a teams call with the customer to confirm on these two things to get the BoM right with competitive pricing.

If its all Dell, they can go with all DAC cables without many transceivers which would save a lot in terms of pricing.

Answered on 17/Jul/2026 11:33 AM:


Q1 - Counts are as per Appendix B.

Current models are Cisco standard models.

Q2 - Only fibre leads for uplinks between the new devices would be in scope which will be a very minor portion of costs so we are not looking at this level of detail at this stage. You may wish to assume 2m LC-LC connections for the purpose of the respose with specific fibre leads to be assessed as part of implementation planning if successful. All uplinks for DC switches should be fibre as switches are in different racks.

Question:
Hi Team,

Can you please address the following clarification questions?

- Regarding 1G, 10G, 25G, 40G access ports being required on TOR switches. Is it acceptable to have 40G and 100G endpoints connected to the spine switches? In this design the leaf switches would offer 1, 10 and 25Gbps connectivity options.

- If 40Gbps connections are required for endpoints on the leaf switches, how many 40G ports are required for endpoint connectivity on each leaf switch?

- What airflow direction is required for each switch?

Many Thanks

Answered on 15/Jul/2026 05:03 PM:


1. We are looking to have 1,10,25 and 40G available on the leaf as access ports, with the option of 25/40/100G for the uplinks to core.

2. As this is for future proofing rather than current need, we don’t have an exact number, but 8 would be more than adequate.

3. Front to Back

Question:
Dear CQU,

1. We would like to get some clarification on the DC Core replacement. From our review, many of the devices to not need to be replaced (still supported for 7+ years). DO you need to remove and replace all or can our proposal just be for the necessary devices?

2. Please confirm what management console/platform you are currently using? (i.e. Cisco Nexus Dashboard)

Thanks in advance

Answered on 15/Jul/2026 05:06 PM:


1. Devices are being replaced due to age not EOL status. It is a risk management strategy.

2. There is no management platform in use currently

Question:
MACsec clarification

Does the current infrastructure (servers/storage/firewall) connectivity utilise/require MACsec? Or is there a plan to require MACsec connectivity for these systems.

If not, will MACsec on uplink and inter-site connections be sufficient for the new solution

Answered on 15/Jul/2026 05:07 PM:


MACsec is only required for the link between the Rockhampton and Sydney Data Centres. It is not required on other links.

Question:
We would like to get clarification on the following points:

1/ BGP / hitless upgrade: is this a mandatory for both TOR and CORE switches? With active-active switches (in current topology between TOR and CORE), it should also allow for switching over of traffic to the redundant switch in event of maintenance (ie. Upgrading/reboot of switch).

2/ MACsec on all interfaces : this is not clear whether this is applicable to both TOR and CORE switches. What is the use case for the MACsec connectivity? Is it between the two DC (rockhampton and sydney)?

3/ CNSA 2.0 Ready: this standard covers both Ipsec PQC and as well as TLS. Since there's no Ipsec requirements stated, would TLS with AES-256-GCM be sufficient?

4/ 1GE requirement on CORE: in the requirement for Rockhampton, it is mentioned that there's an 1GE interface "1 LX (AARnet VPLS)"; Is this still required for the CORE switch? Or we can move this to the TOR?

5/What is Aruba's role in the DC network.

6/ Do you have any existing management system to manage DC network fabric (L/S)

Answered on 15/Jul/2026 05:10 PM:


1. Yes, mandatory for both TOR and Core. ( vPC or equivalent technology for distributed LACP MUST stay operational during upgrades.)

2. MACsec is only required for the link between the Rockhampton and Sydney Data Centres. It is not required on other links.

3.Yes. There is not immediate usecase for ipsec.

4.It is still required on the Core

5.CQU uses Clearpass for authentication. There are a couple of Aruba switches associated with the High Performance Computing install, however the DC network is currently Cisco Nexus and has no specific Aruba content.

6. No we use CLI only for the current network

Question:
Dear CQU,

1. Can you please advise when you can provide response to below question?

2. In order for us to provide a complete response we would need additional information; as such we are requesting if you could kindly provide a 2 week extension to respond to the tender.

Regards.

Answered on 17/Jul/2026 11:37 AM:


We are sorry, but the date cannot be extended.

Question:
I trust you are having a great day. We greatly appreciate the opportunity to participate in this process and are committed to delivering a comprehensive and competitive proposal. Due to the complexities of some of the technical requirements and our commitment to deliver a high-quality proposal that meets the CQ University's specifications, we respectfully request an extension of two weeks to the submission deadline. This additional time will allow us to ensure the accuracy, completeness, and quality of our proposal, ultimately enabling us to present a submission that fully meets the tender’s requirements.

We understand the importance of adhering to timelines and assure you that this request is made solely to enhance the quality and compliance of our submission. Should the extension be granted, we will make every effort to submit well within the revised timeframe.

Answered on 17/Jul/2026 11:38 AM:


We are sorry, but the date cannot be extended.

Question:
(Question 1)

Please help us confirm whether the below mentioned optics / transceivers quantity is correct for both the sites put together?

15 x Transceiver, SFP+, 10GbE, LR, 1310nm Wavelength,

10km Reach 14 x Transceiver, 25GbE SFP28 SR, No FEC,

MMF, Duplex LC 50 x Transceiver,

100GbE QSFP28 SR4, No FEC Capable,

MPO, MMF 2 x Transceiver,

QSFP28 100GbE SR1.2, BD, LC Duplex,

OM3/OM4 MMF 64 x Transceiver, SFP+, 10GbE, SR, 850nm Wavelength,

300m Reach 18 x Transceiver, SFP,

1000BASE-T 8 x Transceiver SFP+ 1/10GBASE-T 30m, rate-adaptive

(Question 2) Is cabling needed for both the sites? So we can amend the quote accordingly (quantity and length of cables needed)?

It would be great if we can get on a teams call with the customer to confirm these two things to get the BoM right with competitive pricing. If the suggested hardware of Dell is acceptable, they can go with all DAC cables without many transceivers which would save a lot in terms of pricing.

Answered on 22/Jul/2026 03:25 PM:


Counts are as per Appendix B.

Current models are Cisco standard models.

Only fibre leads for uplinks between the new devices would be in scope which will be a very minor portion of costs so we are not looking at this level of detail at this stage. You may wish to assume 2m LC-LC connections for the purpose of the respose with specific fibre leads to be assessed as part of implementation planning if successful. All uplinks for DC switches should be fibre as switches are in different racks.

Question:
Can you please confirm the operating model of your Cisco Nexus environment? Specifically, are the switches running NX-OS, or are they deployed in Cisco ACI mode?

Answered on 17/Jul/2026 11:39 AM:


NX-Os Only

Question:
Hi Team,

Due to the complexity of the technical requirements and the need to finalise vendor pricing and supporting documentation, we would like to respectfully request a two-week extension to the tender closing date.

Answered on 23/Jul/2026 11:53 AM:


I'm sorry, we are unable to offer an extension.

Question:
Can we know the main objective of the migration and new setup?

Criteria for defining POC as success. What is the expectation of CQ-U during POC?

How does CQU define “hitless” in measurable terms, including acceptable packet loss, BGP session interruption and application transaction impact?

Which links must have AES-256-GCM MACsec enabled at initial go-live: inter-DC, core-to-ToR, firewall-facing, server-facing or all eligible interfaces?

Which device certificates must use ACME or EST,

what CA/PKI platform is currently available,

and related to above point, will an orchestrated certificate-renewal solution be accepted where native switch support is unavailable?

How many production migration windows are available at each site, what is the maximum duration of each of those window, and will the Palo Alto, F5, VMware, server, storage and application SMEs be available during those windows?

Are the existing routed VLANs or Layer-2 extensions between the data centers mandatory, and which applications or services depend on them?

Can you share existing Centralized Management Platform Information (APIC Controllers, Nexus Dashboard Fabric Controllers).

What Automation requirements are needed.

Certificate Management. (Is customer looking for PKI Solution? Need more clarity).

Post Quantum Readiness. (Cisco N9K solution is not fully CNSA 2.0 ready. ML-KEM and ML-DSA still not supported

Is POC Setup mandatory or optional. Need more clarity on how it needs to be done, does the customer have setup for POC

Can you share the complete existing inventory (BOM)

Can you share Detailed Topology of the current system

Under Page 12, Schedule 2, There is a ask to meet specific requirements as per table 1, could not trace Table 1. What is table 1 and where is it referred to?

Answered on 23/Jul/2026 04:26 PM:


"1. Equipment is being retired due to age

2. The POC is primarily for testing hitless upgrades and failovers and for tuning to meet these and other requirements.

3. Hitless = no interupption to traffic flow during an upgrade.

4.The only link that uses MACSec is the one that operates between the 2 data centres.

5.Any certificicates required by the device for either functional use or management interfaces.

6.CQU has an internal private CA and also use Sectigo for external facing certificates. An automated solution is required. An orchestrated solution would be considered. The aim is to avoide manual certificate updates giving the shorter lifetimes on certificates being enforced.

7.The listed devices will be available. CQU would like to see as seemless a replacement as possible. Options that required long outage windows will not find favour.

8.Yes they are, we do not use L2 extensions but we do use L3 routed VLANs between the DCs in the same VRF (VRFs map to security zones) for multiple applications

9. CQU do not currently use a managment platform with the Nexus solution.

10. No specific automation requirements have been identified except for certificate updates.

11. No PKI. this is a generic requirement for any device or service that needs external certificates for any purpose - that it have automated renewal.

12. The solution/hardware proposed should meet this requirement.

13. Optional

14. Inventory has been provided in Appendix B

15. Topology has been provided in Appendix A

16. Table 1 is the table with the requirements listed in Schedule 1"

Question:
For the MACsec link between the DataCenters.

Is it currently using port-to-port MACsec or MACsec for WAN extensions to allow for L2 provider networks ?

Answered on 23/Jul/2026 04:21 PM:


The current connection is port to port.

Question:
1. Should the Cost Summary be provided as a single combined quotation covering both Rockhampton and Sydney, or itemised separately per site?

2. Given the evaluation finishes 5 August 2026, what is the expected timeframe for arranging POC/test equipment access?

3. Addendum #01 notes that post-migration care may be included or provided as an option. Does CQU have an expected scope and duration of this post-migration/hypercare period (e.g. weeks of elevated support following cutover)?

4. Appendix A shows Palo Alto firewalls for reference only and states they are “not in scope”. Could CQU confirm whether any firewall-facing configuration changes (e.g. eBGP peering adjustments or timer changes required to support hitless upgrades) fall within the scope of this engagement, or whether all firewall-side changes will be managed exclusively by CQU or its incumbent firewall support arrangement?

5. Given CQU has confirmed that TLS with AES-256-GCM is sufficient for the CNSA 2.0 / Post-Quantum Readiness requirement (no IPsec use case), could CQU clarify the expected evidentiary standard for the Post-Quantum Cryptography (ML-KEM) roadmap? Is a manufacturer roadmap statement is acceptable?

7. For the automated certificate lifecycle management requirement, could CQU confirm which internal PKI/CA infrastructure is currently in use (e.g. Microsoft ADCS)?

We appreciate CQU's consideration of these questions ahead of the submission deadline and look forward to lodging a compliant response.

Answered on 23/Jul/2026 04:24 PM:


1. The cost summary should combine all items. A more detailed quote should also be provided.

2. Negotiable

3. No, this item was in respose to a vendor question.

4. Makeing firewall changes would be out of scope and would be managed by CQU staff. Working with CQU on the required changes and testing these elements will be in scope.

5. Yes, a manufacturer roadmap statement would be acceptable.

7. Microsoft ADCS