Giving offsite access to staff and students

[IT_Man_Dan]

Good Morning,

 

Over summer I'm planning to introduce offsite access to our network for staff and students.

I need them to be able to access their home areas, shared areas, and to use Sims.net (staff only).

 

We are in the process of changing internet provider (just choosing supplier) and it looks like my preferred supplier will use a fortinet UTM with VPN facility. That gives me the ability to easily implement the access but I think it leaves me with a problem.

 

Obviously I don't want to have the need for staff or students to map drives or creating shortcuts etc.

I was wondering if you could let me know your thoughts on what is the quickest and easiest way to setup a facility where users can just open an app or something which will automatically have shortcuts to the various drives/resources and also which would allow users to run sims without installing it locally.

 

I've only just started looking into this but I was wondering RemoteApp would do what I need?

 

Thanks

[synaesthesia]

Home Access Plus along with remoteapp for Sims is what we use, and it does so wonderfully. Works across PC and Mac without issue, although Mac users need a small program from Microsoft for the RDP side of it.

 

Incidentally, I hope you're not relying on Fortinet for content filtering (slightly off topic, sorry) - it's not good enough on it's own.

[IT_Man_Dan]

Thanks, Firstly no, filtering will be through Lightspeed ;-)

 

Is Home Access Plus aqnd RemoteApp quick and easy to setup. I've got to implement this over summer around an already rammed full job list!

 

Thanks

[synaesthesia]

Yeah, the documentation is a little sparse but a search on here will provide some good how-tos. Roughly you just need to run it on IIS, update the web.config file as required and then go through the first-run setup page to add in the shared drives you wish to show, and who see's what. Remoteapp is a bit more of a pain, and please check your licensing on using it (I've long forgotten what's required, sorry!) but should work well when it's done. We use a specific remote server running IIS for home access plus and remote services so it's separate from anything else. They don't take up a huge amount of resource though so anything lying around should do fine.

[EXA_Mark]

Hi IT_Man_Dan

 

Bit of blatant pitching here, but if you would like a quote from us (if you haven't already) please just PM me and I'll make sure we get this across to you, or get our local partner in West Sussex, who has already moved around a 100 West Sussex schools to us in the last few months, and happy to give you some local schools to speak to too.

[SJA]

Medhurst Dashboard.

 

[timbo343]

Another plus from me using Home Access Plus for file access. We dont give access to SIMS remotely.

[SchoolsBroadband]

Good Morning,

 

Over summer I'm planning to introduce offsite access to our network for staff and students.

I need them to be able to access their home areas, shared areas, and to use Sims.net (staff only).

 

We are in the process of changing internet provider (just choosing supplier) and it looks like my preferred supplier will use a fortinet UTM with VPN facility. That gives me the ability to easily implement the access but I think it leaves me with a problem.

 

Obviously I don't want to have the need for staff or students to map drives or creating shortcuts etc.

I was wondering if you could let me know your thoughts on what is the quickest and easiest way to setup a facility where users can just open an app or something which will automatically have shortcuts to the various drives/resources and also which would allow users to run sims without installing it locally.

 

I've only just started looking into this but I was wondering RemoteApp would do what I need?

 

Thanks

 

hi @IT_Man_Dan

 

sounds like that may be us then

 

Thank you very much for joining us.

 

There are a couple of ways you can do this using our Fortinet solution.

 

Either you can create them a script which will automatically map them the drives once they are connected to the VPN (via IPSEC or SSL) or I think you can use the Fortinets SSL web portal. This will give your end users a simple button via a web front end to be able to map drives. I'd suggest you call your account manager and he'll setup a call with one of our technical consultants for you who can find the best solution in combination with our products as this certainly isn't anything unique.

 

Thanks again and we're looking forward to work with you

 

David

[IrritableTech]

I'm glad David has chipped in.

 

I'd suggest his second option is the best way forward. You can tie your fortinet into AD and allow access to your SSL web portal. I believe you can create different portal pages for different security groups if you want. You can customize the portal, and create a series of bookmarks. These could be links to shares on your network, intranet sites or RDP servers for example.

 

I'd be cautious about external sims access though personally. I'd probably only allow the very well trained and most security conscious staff access to that particular service.

[SchoolsBroadband]

I'm glad David has chipped in.

 

I'd suggest his second option is the best way forward. You can tie your fortinet into AD and allow access to your SSL web portal. I believe you can create different portal pages for different security groups if you want. You can customize the portal, and create a series of bookmarks. These could be links to shares on your network, intranet sites or RDP servers for example.

 

I'd be cautious about external sims access though personally. I'd probably only allow the very well trained and most security conscious staff access to that particular service.

 

No problem @IrritableTech, for sims access I'd recommend using a Fortitoken which will do you your 2 factor authentication. The Fortinet can then only allow access to certain Windows AD users those with the token too.

 

Dave

[IrritableTech]

No problem @IrritableTech, for sims access I'd recommend using a Fortitoken which will do you your 2 factor authentication. The Fortinet can then only allow access to certain Windows AD users those with the token too.

 

Indeed that would add an additional safeguard, however my worry was more with the way sims works, and how data can be easily extracted in one fell swoop once past the fortinet. Being able to run a report, from home (airport, starbucks...) which can extract all personal and sensitive data about students and staff past and present into a handy csv file worries me.

 

The connection may be safe, but the device once that data has passed over the connection, may not be. A user training issue rather than a technical one generally.

[Synkrox]

Congratulations on making the leap!

 

Have you considered just using remote desktop to a dedicated server?

All users can then access most of your usual network software as well as shared areas/printers the lot. You can use a 2 factor plugin if need be.

RDP is generally lighter and more responsive than copying whole files up and down a VPN link. It also doesnt matter if they are using a virus riddled device.

Im pretty sure you will require separate VPN licenses from fortinet above the one or two built in.

 

As a web based/webdav file manager I use http commander and cook it into OWA so essentially SSO.

 

Hope this helps :-)

[SchoolsBroadband]

Congratulations on making the leap!

 

Have you considered just using remote desktop to a dedicated server?

All users can then access most of your usual network software as well as shared areas/printers the lot. You can use a 2 factor plugin if need be.

RDP is generally lighter and more responsive than copying whole files up and down a VPN link. It also doesnt matter if they are using a virus riddled device.

Im pretty sure you will require separate VPN licenses from fortinet above the one or two built in.

 

As a web based/webdav file manager I use http commander and cook it into OWA so essentially SSO.

 

Hope this helps :-)

 

Fear not Fortinet and Schools Broadband give you unlimited VPN licenses included in our normal annual charge

[Jasbo]

@exa_mark

 

What west sussex based company is this?

[rob_coles]

We use RDP with sms pass code for 2 form auth for staff and moodle smb for students.

[HPlum78]

DA if your staff and students have laptops supplied, HAP is very good as is RDP tend to find that there is no best fit for just one solution in my experience.

[EXA_Mark]

@exa_mark

 

What west sussex based company is this?

 

Hi Jasbo, I have sent you a PM with the details of the company and contact details, let me know if you need anything else.

[wickit]

+1 for HAP+ (Home access plus)

[edutech4schools]

Congratulations on making the leap!

 

Have you considered just using remote desktop to a dedicated server?

All users can then access most of your usual network software as well as shared areas/printers the lot. You can use a 2 factor plugin if need be.

RDP is generally lighter and more responsive than copying whole files up and down a VPN link. It also doesnt matter if they are using a virus riddled device.

Im pretty sure you will require separate VPN licenses from fortinet above the one or two built in.

 

RDP gateway is built in to server OS and is almost free + once its installed you never really need to do anything to keep it running, it just keeps working.

[edutech4schools]

It also doesnt matter if they are using a virus riddled device.

 

I am able to copy and paste a file from my local desktop to the remote desktop, would a virus not be able to do the same?