MISSION PARTNER GATEWAY (MPG) / NIPRNET FEDERATED GATEWAY (NFG) COMMUNITY OF INTEREST (COI)

Overview

NFG COI service is for non-DoD federal agencies and partners connections that connect directly into the Non-secure Internet Protocol Router Network (NIPRNet). Customers ordering this service will be connected to the DISN but will have their connection directed to the nearest NFE router. All traffic will go thru the NFE prior to accessing any DoD available networks.

NFG COI consists of implementation of Multiprotocol Label Switching (MPLS) VPN to move traffic across the DISN to the nearest NFE router using Virtual Routing and Forwarding (VRF's) and Virtual Firewalling techniques to terminate the COI connection at an enclave boundary.

The Department of Defense (DoD) has granted some non-DoD federal agencies and partners connections directly into the Non-secure Internet Protocol Router Network (NIPRNet). This introduces a potential threat to the NIPRNet due to the absence of any mechanisms for effectively controlling and monitoring traffic to/from these agencies. The path forward is to acquire and deploy NIPRNet Federated Gateways (NFG) at multiple Internet Access Point (IAP) locations to provide a secure and robust means for these agencies to connect to the NIPRNet. The benefit is that it will provide protection from and visibility into threats and events involving traffic to/from these agencies and partners. NFG shall support customers using physical/logical connections (described below as “External Customer Connecting Directly to NFE Router” and “External Customer on NIPRNet”). The system shall support logical traffic separation as traffic transits through NIPRNet.

Value to Our Mission Partners

This service provides for logical and physical isolation of Public Internet facing applications at the DoD CC/S/A/FA provided COI locations.

Features

STANDARD FEATURES

DISA managed VPN using Multi-Protocol Labeled Switching (MPLS)
Provides privacy and limits access to IP data to VPN members only
Quality of Service (QOS): provides the ability to provide different priorities to different pre-marked packets (applications, users, or data flows) or to guarantee a certain level of performance to those packets across the DISN. It does not provide on customer's traffic a higher priority than another customer's traffic.
Circuit connection to DISN can be physical or virtual. Virtual connections are supported on a limited number of interface types. Contact the DGSC for the list of supported interfaces.

OPTIONAL FEATURES

MPG/NFG mission partners can be categorized into two types:

External Mission Partner Connecting Directly to NFE Router: The first and simplest type of connection is directly to the NFE router. The benefit is to keep the non-DoD partner traffic separate from the Internet Access Point Network (IAPNet) infrastructure. This will limit the attack vectors for the NIPRNet and its components. These mission partners may connect to the NFE router via third-party leased circuit or transport provided by DISN transport infrastructure. It is also possible that the mission partner equipment may be collocated with an MPG/NFG site and can make back-to-back connections with the router. With these types of connections, encryption may not be necessary. These mission partners may use External Border Gateway Protocol (eBGP) peer directly with the NFE router over the physical interface using the interface IP address.

External Mission Partner on NIPRNet: The second type is a customer currently connecting directly to NIPRNet. These mission partners sometimes have their own back-end connection to the Internet. The goal of this MPG/NFG design is to leverage the existing connections to NIPRNet without installing new circuits. This can be accomplished by providing a physical trunk between the NFE and the collocated Unclassified Provider Edge (UPE) router. A partner may build a logical tunnel, possibly encrypted, to the NFE router over this physical connection. This encryption will be broken between at the NFE router and NFI for inspection/monitoring. The mission partner router will no longer have BGP peering directly with the UPE/AR router, but instead will exchange eBGP routes only with the NFE router over the tunnel. Additionally, a new MPLS Layer 3 VPN (L3VPN) (e.g., NFE_VPN) has been created to isolate traffic for these mission partners from the rest of NIPRNet to sense traffic before the NFE and IA components inspect it. The NFE routers from all MPG/NFG sites would also be members of this VPN and are visible to all these mission partner routers. An external mission partner on this VPN may peer with multiple NFE routers for redundancy. Tunnel and encryption between mission partner routers and the NFE router is optional and can overlay the VPN.

Rates

This is an "emerging" service and cannot yet be ordered via DDOE. Service will be available as a DISN Subscription Service (DSS) at any DSS location that includes NIPRNet IP Data.

Service Support

1-844-DISA-HLP (347-2457), Option 2
disa.dccc@mail.mil
disa.scott.conus.mbx.dccc@mail.smil.mil

Terms of Reference

Service Performance	Service performance is measured, monitored, and reported as defined in the Telecommunications Service Level Agreement, which can be found on the Telecommunications Service Level Agreement page.
Connection Approval	There are services that require a connection approval. Information regarding connection approvals can be found at the Enterprise Connection website for unclassified users, and at https://www.disa.smil.mil/connect website for classified users.
Customer Ordering Guide	For step-by-step information on how to order VPN Service, access the ordering guide available to mission partners. This is the Establish & Connect to a VPN consolidated guide detailing the steps to Establish a VPN and the steps to Connect to an Established VPN.

Additional Information

Service Lifecycle Status	Maintain & Sustain
Security Classification	Up to and including Sensitive but Unclassified (SBU)