Embc user level filtering

[GrumbleDook]

I'll check on the issues with EMBN in this afternoon's meeting.

[vikpaw]

I have an issue with RMSecureNet software which we use to securely send exam entries to exam boards. It taps into sims exams organiser.

 

When i try to send i get an error message about invalid recipient.

 

I think we've diagnosed it down to a failure of FTP, it requires ports 20,21 and all above 1024.

 

Anyone else had this issue or got a resolution?

 

I logged a call yesterday, then rang up with a chaser this morning asking for it to be made higher priority as it was still unassigned. A note was added to the call saying that i had rung! No mention of the fact that it was urgent and quite critical to the exam process.

 

help me, help me, somebody help me.

[GrumbleDook]

This is likely to be linked to some IPs that have been previously assigned as 'power users' are now regular IPs. It is being included in a list over the weekend. As always, if we get news we will pass it on.

 

Feedback from members who have had things fixed would be appreciated.

[Ashm]

Just an update from our School:

 

External IP addresses are now working but our northants.sch.uk domain & subdomains are very intermittent and are down most of the time when accessed outside the EMBC network.

 

Can access the servers using their external IP addresses with no issues.

 

Internal mail server is working sweet now.

[kmount]

Which school.northants.sch.uk?

[Ashm]

wrenn.northants.sch.uk

[kmount]

Looks like both of the Synetrix DNS servers are throwing up the correct IP certainly for http://www.* & folders.* from the outside.

 

When you say down most of the time, do you get DNS responses or do they not exist as domains? - Have you tried this on multiple ISPs?

[Ashm]

I've tried this at home (Bethere) & a collegue at work tried at home last night with no luck.

 

I'm getting server not found, so they don't exist as domains (for me at least ). If I try again in an hour it might work but then be down 2 hours later. But as said the external IP is solid.

 

I've heard Bethere's DNS servers are a bit flakey, but I never had any issues accessing the domain when fujisu were in control.

[Edu-IT]

wrenn.northants.sch.uk

Doesn't work here either and I'm using TalkTalk.

[kmount]

wrenn.northants.sch.uk WONT work, but the subdomains should.

 

Bethere's DNS servers are dire but this shouldn't occur.

 

I'm using opendns and will make a point of pinging it every hour until it dies!

[GrumbleDook]

Can I make another plea to Northants members. If you are still struggling to get the DNS / NAT / Power Users set up then please read further up the thread. In your contact with Synetrix include *all* hostnames and IPs that need to be setup to ensure that you don't have to make repeated calls. The Firewall team are working through the list and whilst I cannot update each school individually with their process it will help the F/W team get back to you quickly.

[spc-rocket]

Looking at this thread and it seems that the way of giving schools ranges to ues seems a bad idea, power users etc what would be better for the providers is to stop the connection at the boarder of the school's network i.e. the local firewall or proxy server. I don't really see any need for the RBCs to go to the workstation ip address level for each school. Yes given it is a private network, but it would be better if they allow the school's to use their own ip addressing scheme internally. I don't see any issues with this regards to SSO, Federated services etc. I also think the centralised web filtering is undesirable sometimes because the fact the kids will be kids they will try and access the sites they can't get to, this will make a connection to the web filter service centrally using bandwidth only to be denied access again using up the wan link bandwidth. Multiply this by the number of users using the system and the number of schools utilising web filter it can put a heavy burden on the web filter service and i think this was the case when fujitsu were in control of netsweeper.

 

Ash.

[GrumbleDook]

For a fair chunk of the above I can quite agree ... however, whilst there are many secondary schools capable of managing their own firewall, proxy, mail server, etc .. there are many that can't, due to staffing, skills shortage, funding, the engagement of SLT for IT. This is without considering that the larger proportion of sites / nodes on RBC networks are actually primary / infant schools with little or now technical support other than that purchased in consortia or from 3rd party companies. I know there are many members here from the primary sector that will tell you that it is a very mixed bag and the SNB of RBCs tend to be for the lowest common denominator, whilst taking into account schools at higher levels.

 

The fact that may RBCs are still willing to connect schools that operate outside of an SNB is due to requiring to keep as many schools within an NEN connection as possible, but also due to accepting that flexibility is required.

 

We could go on and on about whether we think that this is right or wrong, but the Becta documentation on IT Infrastructure actually includes the caveat that the RBC has final say about the method of connectivity to the NEN. If that means no firewall then that is what Becta support the RBC doing. If we don't like it then we know where to go when we want to get things changed (the last meeting we had for this we only had 3 schools turn up to give their input!)

[Zebadee]

Hi Tony

 

Did you find out anything about the EMBN issues with email?

 

Cheers

 

Andy

[GrumbleDook]

Hi Tony

 

Did you find out anything about the EMBN issues with email?

 

Cheers

 

Andy

 

Still chasing this. I did some more prodding today. I will continue to prod.

[Ashm]

Starting to get really cheesed off with Synetrix...

 

I spoke to them about the domain name/dns issues Wednesday morning and then since Wednesday afternoon none of our external IP addresses work!

[kmount]

Raise it again, we did today, and it was resolved today.

 

Phrase it like so:

 

Internal IP, External IP, Required Ports/Services IN, PowerUser Out?

 

Makes it nice and simple.

 

Service has been a shambles today and with the WAT Tool now pushed back a week with no portal controlled filtering available its becoming a bit of a nightmare!

[Ashm]

Yeah I already did mate.

 

I added to the support ticket in the form of internal ip - external ip - domain name

 

I'll update it again with the required ports, I assumed they did the standard ports like fujitsu used to do.

 

PowerUser Out? Is that basically an unfiltered connection to that host?

[kmount]

I only put ports if I was doing something special, IE, I wanted HTTP in on ports 80 AND 81.

 

Yeah, power user is a term carried over from Fujitsu days whereby the specified IP has much less restriction on outbound traffic. - I've not really used it but figured I'd ask for it to be put on for my servers to make connections a bit more sane.

 

Must admit though, they processed my call quickly, which was a pleasant surprise.

[GrumbleDook]

We are back up and running with NAT too ... can't do much internally due to proxy issues and will get the guys to test power user status tomorrow.

 

All problems noted are being fed back to Synetrix and if I will probably feedback after tomorrow's meeting via the learning platform as it is a Northants meeting.

[kmount]

Want a cookie?

[SpuffMonkey]

Was anyone else having connectivity problems with EMBC between 3pm yesterday and 9am today?

[kmount]

Yes, I couldn't even get through to their support people so I guess everyone else was doing it for me.

 

We had weird issues, email worked sporadically, but the REAL oddity was that two machines side by side would connect OK to remote SSH etc but 1 point blank would not go through the proxy onto the internet whereas the other did.

 

Almost as though, the sheer number of sessions was exceeded.

 

This morning however, both machines are OK.

 

Be aware though, after having our NAT/External IP's fixed, we've now discovered a problem in that our exams officer can't do exams entries which we believe is because in their wisdom Synetrix have blocked access via TCP to the secure examscentre system.

[GrumbleDook]

The Exam Officer's machine needs to be a power user IP, but specify the ports so they can't get out to anything else.

 

The ExamCentre software is meant to run over port 443 ... but seems to make additional requests on other ports to ... IIRC Vik has the full details further up the thread or over on one of the threads in FFS.

[kmount]

I see absolutely no reason as to why I should need to assign it a static IP. - Will I then need to do this for the 5 people who use AVCO? - This piecemeal approach is going to do my head in.