Filtering and firewall

[SchoolsBroadband]

We switched from SmoothWall to a Fortinet 100D with Talk-Straight - What a mistake to make - nothingg but trouble for 7 months now and still no sign of improvements. The support is nothing short of shocking, no systems properly in place to support that massive amount of new customers and quite frankly we feel ripped off. No SLA's in place to speak of and if they are they keep very quiet about it using words like "shortly". We will be looking to return to SmoothWall asap.

 

Hello Andrew,

 

I'm sorry to hear you're not happy with your solution at the moment. I know our support department has spent a lot of time with you trying to resolve your issues and we will continue to do so.

 

I think the above is a bit harsh to be honest. Never the less I want all my customers to be happy and the vast majority of the 500 schools which all use Fortinet filtering and AD authentication are and don't have the issues you're experiencing.

 

We are moving to Lightspeed content filtering in the very near future in conjunction with Fortinet security services. You'll be please to know that there will also be an upgrade path for existing customers.

 

I will be in touch again

 

Thanks

 

David

[synaesthesia]

@huxlow if there's any help we can be as a 3rd party feel free to get in touch. Very local to you, identical setup and we're quite happy with it. Might even be just for comparison purposes; I'd be happy to swing by after hours one day if you like.

[RTFM]

As i've said I think previously on this thread, 2 weeks and we get a Lightspeed / SonicWall combination installed. See how we go with it, hopefully should be good

 

Quoting myself, not sure if thats weird or not........

 

Anyway, just to follow up on the above, we've had very few issues (I say issues, more general queries about stuff and best practice for how to do certain things) any we have had have been dealt with very swiftly by Lightspeed or our firewall provider.

 

I'm actually surprised by how little faffing we have had to do with the LS box to get everything up and running so overall extremely happy with our choice

 

A couple of people have PM'd me asking questions etc and I'm more than happy to offer my opinion if anyone asks.

 

[rpmoore]

We switched from SmoothWall to a Fortinet 100D with Talk-Straight - What a mistake to make - nothingg but trouble for 7 months now and still no sign of improvements. The support is nothing short of shocking, no systems properly in place to support that massive amount of new customers and quite frankly we feel ripped off. No SLA's in place to speak of and if they are they keep very quiet about it using words like "shortly". We will be looking to return to SmoothWall asap.

 

Huxlow - we look forward to welcoming you back. We have just completed a major upgrade to our UK service center (people, processes and systems) and can now offer better services and SLAs to our customers than ever.

 

Richard

[RTFM]

Huxlow - we look forward to welcoming you back. We have just completed a major upgrade to our UK service center (people, processes and systems) and can now offer better services and SLAs to our customers than ever.

 

Richard

 

I doubt better than ever, 3 years ago Smoothwall support was second to none as literally everytime you rang it was a support engineer on the phone. From calling to resolution was never really more than a couple of hours from our experience. Since then its changed a lot but I dont see it ever getting that good again

[wickit]

Hi

Just wanted to throw this in the conversation

 

If you want SSL filtering and you have the need to use skype, then be very wary, as Last time I checked the only device that did it was the sonicwall

 

I could be wrong because last time i was looking was 18 months ago, but its worth mentioning.

[tom_newton]

SSL plus skype is an interesting one: you *will* have to allow CONNECT requests over SSL to any IP to allow skype via a proxy. This is sub-optimal, but true of any product.

[Sheridan]

We're running a TMG and Smoothwall SWG at the moment, and will probably merge them into one soon as TMG has now been ditched by MS, and annoyingly our SWG isn't capable of any BYOD functionality with our wireless setup. So hopefully ditching both for a Fortinet/Checkpoint solution soon.

[mrbios]

Checkpoint solution soon.

 

You're a brave man if you go down that route, very complex bits of kit as far as i've been told, and not cheap either. Have you considered Palo Alto?

[Sheridan]

Palo Alto look good on paper but seem a lot more expensive!

[mrbios]

Palo Alto look good on paper but seem a lot more expensive!

 

Similar in cost to checkpoint i think when you factor in the training requred on a checkpoint system, though i guess it depends what it is you need to do/size of school and so on. Might find fortinet does everything you need for half the price i guess.

[tom_newton]

We're running a TMG and Smoothwall SWG at the moment, and will probably merge them into one soon as TMG has now been ditched by MS, and annoyingly our SWG isn't capable of any BYOD functionality with our wireless setup. So hopefully ditching both for a Fortinet/Checkpoint solution soon.

 

I'm sure we can make it play ball - even if it means a switcheroo with licencing somehow.

[Sheridan]

@tom_newton - I seem to have been backwards and forwards with smoothwall on this one. End result is I've been told several times an upgrade to the UTM is the only way forward as our SWG just won't do the necessary for BYOD!

[tom_newton]

Probably for the routing aspect - no real reason to change the tin, if you're up for it you could cross-grade with a usb cdrom... though there are now ways to get most of the UTM-y stuff on a SWG - fire me any ticket ID and I will get it re-looked into. Not satisfied with no for an answer im afraid

[boombah]

Anyone using the new Cisco 5500-x Firewalls? Price here in Thailand looks great but having troubles getting my hands on one to demo. Very little info online from actual users also. Youtube video looked pretty decent.

 

Cheers

[Sheridan]

Haven't got any ticket ID for this - its been via PM/email etc. So you're saying I should be able to upgrade my SWG to UTM for the additional capabilities?

[tom_newton]

Yeah, depending on the capabilities you might just need the zone module, which is a real simple one to add, if it's a bit more than that we'll need to refresh the software build, but that's not incredibly hard, its a mite non-standard as a procedure, but if it's the difference between "Sheridan happy" and "Sheridan not happy", then so be it

[Sheridan]

Nicely put! I'm always Sheridan_happy, but I'm ready to be Sheridan_ecstatic if you let me know what I need to do next....

[tom_newton]

Talk to your account manager (suspect it is Rachel), get them to put you in touch with someone to design what you need - invoke "go talk to Tom" if anyone gives you "Huh".

[Edu-IT]

Does LightSpeed still need a client installing on each machine and does it do anything dynamic, like the Smoothwall?

[SchoolsBroadband]

Does LightSpeed still need a client installing on each machine and does it do anything dynamic, like the Smoothwall?

 

You don't have to have the client installed although we prefer to do it as you don't have to rely on windows server auditing of user logins if you do install it so therefore it's much more accurate.

 

The agent is a piece of cake to roll out via group policy.

 

There's no dynamic filtering. We don't find this a negative though in the slightest. I know many may disagree but for an end user experience there's no difference in actual day to day use.

 

Dave

[Edu-IT]

Thanks David. So, I'm assuming it works of the model of whitelists and blacklists, and the site either works or it doesn't? In terms of the MDM, the video on your website basically suggests that the in that instance the iPads connect back to the proxy in the school and then out to the internet again. Would that be a true understanding?

[SchoolsBroadband]

Thanks David. So, I'm assuming it works of the model of whitelists and blacklists, and the site either works or it doesn't? In terms of the MDM, the video on your website basically suggests that the in that instance the iPads connect back to the proxy in the school and then out to the internet again. Would that be a true understanding?

 

In a nut shell yes. The database is very specific to education and we find fantastic to use. If there's a new site then it'll get categorised within 24 hours. All non categorised sites can be automatically blocked. You can of course allow the site yourself as well.

 

Ref MDM, with iPads the only way to get them working is by use of their global proxy. We set the iPads to go to our hosted Lightspeed Rocket infrastructure. All traffic then goes via this connection. This is the only way Apple allows it.

 

Our hosted Lightspeed Rocket infrastructure is connected via multiple 10Gbit links and protected by carrier class Fortinet firewalls. One of the advantages of our service in particular over using onsite proxy servers is that as the Lightspeed Rockets are in our data centres then any bandwidth / speed used happens here and not down your Internet connection. This is left for your schools general use. If you do 1:1 iPad deployment (as many schools are doing) this will help keep bandwidth away from you school which is a good thing.

 

I believe Android + Windows 8 tablets work a little differently. They merely do a lookup against the URL list on the Rockets. The Rocket then allows the site through or not.

 

Thanks

 

Dave

[Edu-IT]

Does your hosted solution only work for the MDM then, you don't use it for general school use? Also on that note will it allow use of My Big Campus or not? We can discuss this off forum if you prefer?

[SchoolsBroadband]

Does your hosted solution only work for the MDM then, you don't use it for general school use? Also on that note will it allow use of My Big Campus or not? We can discuss this off forum if you prefer?

 

Hi again @Edu-IT,

 

Our hosted solution works with the whole suite of Lightspeed products. Rocket filtering, MDM, MBC all of which are included in our standard packages. I'll PM you for a more technical chat.

 

Cheers

 

Dave