No AD Filtering with Lightspeed for now

[Arcath]

I've Just had it confirmed to me over the phone that we are looking at MONTHS before we can use AD filtering with the lightspeed system. The only differential filtering you can do at this time is based on if its curriculum or admin network traffic.

 

There are no words to describe how angry I am with this, I have a few schools who heavily rely on the NEDS AD Filtering who are now screwed and even more schools who I had told to wait for the new filtering system.

 

OCL are telling everyone who currently use the NEDS AD Filtering that they now have to take a step backwards. This is going to mean NO access to sites that we currently only block for pupils as we have no safe way to allow staff access to it.

Edited February 24, 2014 by Arcath
add for now to title to reduce the shock

[Cache]

Hmmmmm, can you do filtering based off a single IP then? No idea when we are likely to get a roll out or what conflict that is going to cause with Cumbria/CICT but would be good to know whether it's going to throw our setup all off....

[ChrisH]

So basically no different from what we have now (sans NED) ?

[Marshall_IT]

I know it might mean a ton of work but couldn't you create VLANs for staff and students PCs then filter these differently?

You could even do 802.1x auto vlan assignment of your switches support it for per user vlan assignment.

 

Not ideal. The ad filtering from Lightspeed works well for us.

[seawolf]

So, Lightspeed doesn't have the capability to filter based on the AD group? I thought that was one of the advertised abilities of Lightspeed. This works very well on our iBoss web filter.

 

Well, if the Lightspeed can set default filtering based on subnet, then you could use separate subnets / VLANs for students and staff. That doesn't help if you have staff and students logging into the same computers though. That's where you need the AD group-based filtering.

[Marshall_IT]

Lightspeed can provide ad group based filtering in using it. I'm not sure why it can't in this situation.

[Arcath]

Lightspeed can! OCL just can't make it work in this situation, no idea why they just said it will take months. The biggest kick is that the lightspeed devices are already bound to the Exchange Domain for our county email so its not like they don't know how to do it they just wont let us do it.

 

I could use VLANS or even just reservations for every machine but that is a lot of work for someone thats only in a maximum of 3 hours a week and more importantly why should I? I can do it now under the current system no problem why should I spend ages changing my entire network structure to accommodate OCLs laziness. It just goes to show that getting some good publicity around contract renewal was more important than providing a decent service to the schools.

 

As it stands I think I'm going to contact them and ask for the NED to be pointed at the lightspeed rocket, I know the NEDS are being decommissioned but they are the only way to do AD filtering in the short term.

[SchoolsBroadband]

I know it might mean a ton of work but couldn't you create VLANs for staff and students PCs then filter these differently?

You could even do 802.1x auto vlan assignment of your switches support it for per user vlan assignment.

 

Not ideal. The ad filtering from Lightspeed works well for us.

 

I'm a bit mystified as to why they can't do this. We supply hosted Lightspeed and Leased Line connectivity for @Marshall_IT + many other people here on Edugeek and its a doddle to do.

 

if you want it working come send me a PM and move from "the dark side"

[Arcath]

I'm a bit mystified as to why they can't do this. We supply hosted Lightspeed and Leased Line connectivity for @Marshall_IT + many other people here on Edugeek and its a doddle to do.

 

if you want it working come send me a PM and move from "the dark side"

 

My company is already a @SchoolsBroadband partner, we have a few schools moving away this year but a lot more that wanted to wait and see.

[SchoolsBroadband]

oh yes

 

The words "wood" and "trees" and "coffee required" springs to mind this early hour

 

Dave

[jhothersall]

Well you could set-up as I have with putting my Terminal Server on my Admin range and asking for that to be unblocked, and then create a Remote app on the desktop to a "Unfiltered Internet Connection".

 

It works great, and as the teachers use the terminal server in the Mac Suite too this works well,

 

We have Youtube unblocked but this does need to change to Youtube for Education ... We still get the odd video which is inappropriate.

[Arcath]

@jhotherall in the average primary that I support they have 2 servers, a Primary DC/Fileserver and a Backup DC (Some also have a separate admin/sims server) there is no capacity in that to be running terminal services and running remote apps.

 

As a temporary measure I've used the Assignment system to assign a different list to each of the IWB machines via their IP (with a reservation in DHCP) bit of a PITA and wont stop the kids from using the IWB but its the best of a rubbish situation

[browolf]

I know it might mean a ton of work but couldn't you create VLANs for staff and students PCs then filter these differently?

You could even do 802.1x auto vlan assignment of your switches support it for per user vlan assignment.

 

Not ideal. The ad filtering from Lightspeed works well for us.

 

I'd suggest set up simple proxy for the staff and connect that to an admin port on the router whilst leaving everyone else defaulting to pupil port/filter. Use group policy or pac file to deploy this proxy for staff.

[ChrisH]

It looks like the lightspeed filtering is active on the admin ranges, it's pretty wide open at the moment so be careful! The curriculum ranges get activated next month apparently.

[Arcath]

It looks like the lightspeed filtering is active on the admin ranges, it's pretty wide open at the moment so be careful! The curriculum ranges get activated next month apparently.

 

Oh yeah, looking at the categories everything apart from proxies, viruses and porn is unblocked. OCL have made the decision that all admin staff can get on social media etc... which is very popular here.

[ChrisH]

Should we have access to some sort of panel at the moment ?

[Arcath]

Should we have access to some sort of panel at the moment ?

 

Yeah go to https://filter.education.btlsl.co.uk/ and login with the head/itcoord or bursar MyLFGL account. Since my primaries still use the exchange mail from OCL we just log in as [email protected]

[sammy42]

Would you believe it today we get a post on the portal telling us that we are next in line to get the filtering. Reading further down the page it states they have changed the filtering for the school to the new lightspeed filtering for the staff admin network already, and that on Monday 03 march at 08:00hrs we will be changing the students curriculum network on to the lightspeed filtering. you would think no problem that's workable.

 

Except the filtering is not working correctly got social networking blocked on the old netsweeper system (using the admin network for the guest wireless access and the BYOD access) not blocked on the new system. Changes made without first sending us access rights to the new filtering admin console. Phoned them to be told your not due to get access until your live date of 14 march. So come Monday morning 1300 students potentially having access to the world with no way of controlling who sees what.

 

What a shower you think the logical thing to do is send out all the admin rights first then change the admin filtering to allow you to have a play them change the curriculum filtering not BTLSL same sh-t different name

[explodingcarrots]

Looking on the Lightspeed webui it appears there's an option to add users within that system to allow an override to websites. So, you could define a staff account there so that when/if they come across a site that is blocked they enter their username/password to get through it.

Not tested it but did see that as a thing when adding a few urls to the student allow list.

[Arcath]

I had a conversation with one of the Lightspeed team at OCL earlier today and was told that AD filtering is coming in the next couple of weeks.

 

Apparently they are very close but needed to get the roll out started to be done it time.

 

I've asked to be notified when it is available and as soon as I know I will post here and let you all know.

[Arcath]

I've been informed and confirmed that the parent proxy on the NED is now lightspeed (if you have been swapped over) so for now you can get AD filtering the old way.

[SimpleSi]

Just got info through for my first school (simple primary - no ad needed/used)

I'm confused as it seems with no proxy setting - I can get on T'internet

And with PAC file settings I can get on the internet

 

Whats the advantage of using the PAC file?

 

Simon

[the_dude]

we used to use lightspeed and at the time their AD filtering depended on a user agent that had to be pushed out to the client...let me say this was a huge PAIN IN THE ASS because it never worked. We switched to iBoss about 3 years ago. Their AD filtering is done with a plugin that is installed on your DC's (kind of like every other filter out their except STUPID LIGHTSPEED). Works great...haven't looked back.

[ticker]

anyone have any issues with emails from outside providers/suppliers we have had two calls this morning from people reporting that when sending emails to us, they are getting a response back saying their IP address is blocked as spam.

[LukeC]

@ticker we have also had these issues too. Issue was resolved around 11am according to their helpdesk