Netsweeper with Schools Broadband

[fiza]

Won't v3 of lightspeed fix the issues currently being experienced by everyone on SB?

[IrritableTech]

BYOD is the hardest as there may not be a separate subnet. Some of the smaller schools won’t do any VLANs.

Plus on Windows machines it’s getting the user to turn the proxy off while at home - unless it will work from offsite somehow.

 

Just a pain as Lightspeed works well with the no proxy requirements. Although I will be glad to see the end of it

 

Although lightspeed requires you to use its proxy to decrypt ssl traffic.

 

Even if small schools don’t setup vlans, they can probably reserve IPs for school owned devices and set different filtering rules based on these IPs over the others.

 

Turning the proxy on and off at home is quickly sorted with a pac file. First statement should interrogate what IP it is communicating on... if a school one use the proxy, if anything else go direct.

 

As for the question about v3 well we don’t really know do we until it’s live - and then the story may have been different with all SBs schools on a v3 platform rather than just some on LS and some on NS. A lot of customers have lost confidence in the brand, and the fact that NS doesn’t require specific hardware means SB can spin up a new vm or add additional ones within minutes. It does seem like a more robust and scalable solution for them.

[fiza]

We can't currently get any device to connect to wifi unless through an unfiltered IP. With the Chromebooks we changed the proxy details on the Google Console, thinking they would then pull down the new settings but they don't. We have wiped one but it still won't connect to the wifi (It says connected though). When I use a static IP it connects and lets me register to our Google domain but then it pulls down the new proxy settings and won't connect again, or let me change the IP. I've tried using a unsecured connection but still no luck.

 

We've had 125 Chromebooks sat in their charging trolley for two weeks now not being used.

@TMBS - Any luck resolving those issues? We are due to move our Primary School with SB over to Netsweeper next week.

[TMBS]

I'm afraid not. At the moment we can't get wifi working let alone the Chromebooks. Not a good start to the year! SB have set up a pac file for our laptops but it doesn't work and they don't know why.

 

Still no Chromebook solution. I'm currently deprovisioning one to test off our Google domain but can only get it to connect to the Internet unfiltered which is not a solution with students. It's not happy with me manually changing the IP to an unfiltered range and keeps switching back...

 

Staff are not happy as we have 125 Chromebooks sitting in trolleys and you would be amazed at how many times I've been asked if they can be used unfiltered.

 

Happy 2018

[Dom_]

I'm afraid not. At the moment we can't get wifi working let alone the Chromebooks. Not a good start to the year! SB have set up a pac file for our laptops but it doesn't work and they don't know why.

 

Still no Chromebook solution. I'm currently deprovisioning one to test off our Google domain but can only get it to connect to the Internet unfiltered which is not a solution with students. It's not happy with me manually changing the IP to an unfiltered range and keeps switching back...

 

Staff are not happy as we have 125 Chromebooks sitting in trolleys and you would be amazed at how many times I've been asked if they can be used unfiltered.

 

Happy 2018

 

Can you get them to apply pupil filtering to an IP range, then put the chromebooks on that IP range (at least, temporarily while you figure out the other stuff?)

[fiza]

@SchoolsBroadband - Any ideas why this is taking so long to sort out Chromebook filtering with Netsweeper? We are moving to Netsweeper next week with you and although we don't have any Chromebooks we are heavy users of Google Apps.

[SchoolsBroadband]

Can you get them to apply pupil filtering to an IP range, then put the chromebooks on that IP range (at least, temporarily while you figure out the other stuff?)

 

yes this will work and we've done on other installs too so I'm not sure why the engineers wouldn't have recommended this yet.

 

I'll check for you.

 

Dave

[Nightshade2k]

Anyone had an issue with Macs? ive installed the Root Certificate in the System Keychain both Manually and Trusted it and ive also completed a configuraton payload to deploy said certificate, however my AD users are still getting connection is not private issues when trying to open even google, working with SB on it but wondered if any of the tester schools ran into this issue with Macs?

 

Should note Netsweeper doesnt filter by OU (which lightspeed could do hence the macs were not an issue before)

 

Also i made my own version of the proxy.pac as the SB one wasnt working for me, though working with Jamie from SB managed to add the correct exception for the authportal, this one works by checking you first part of your IP Address as someone suggested earlier

 

function FindProxyForURL(url, host){ var myProxy = "proxylb.schoolsbroadband.net:31280"; var ipSubs = myIpAddress().split("."); if( host == "localhost" || shExpMatch(host, "*.local") || shExpMatch(host, "*authportal") || host == "127.0.0.1" || ipSubs[0] != "10" ) { return "DIRECT; PROXY " + myProxy; } else { return "PROXY " + myProxy + "; DIRECT"; }}

Edited January 16, 2018 by Nightshade2k

[Nightshade2k]

Figured it out had to sudo bash the cert as the config profile payload and settings would just not work! Funt times!

 

here is the script for anyone else who may have issues with netsweeper on macs

 

Sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "/private/tmp/certs/ca.crt"

[Lee-H]

Wifi? It works fine yeah, we had a custom port added for the ipads so they default to pupil web, and use the normal one for devices that we want people to log into. No Chromebooks here but plenty of ipads... No sims either - we're integris (which works fine), isn't sims local?

 

We have the first 50 IP's unfiltered (server, switches, printers etc), I assume at least your server will be unfiltered though which would allow any Sims updates through?

 

On your iPads have you manually entered the proxy settings? We have had the custom ports set up too however i am still being directed to the Authportal even when i manually enter the proxy settings with the custom port

 

We have the proxy settings being pushed out by DHCP so clients can auto detect them but im not sure if this is clashing with the settings on the iPads or Schools broadband just haven't configured the custom ports correctly?

[Dom_]

On your iPads have you manually entered the proxy settings? We have had the custom ports set up too however i am still being directed to the Authportal even when i manually enter the proxy settings with the custom port

 

We have the proxy settings being pushed out by DHCP so clients can auto detect them but im not sure if this is clashing with the settings on the iPads or Schools broadband just haven't configured the custom ports correctly?

 

We use MDM to push out a global proxy for the ipads - they didn't pull the PAC file from DHCP (I think it needs hosting securely for ipads to accept it).

 

So, when using MDM/manual proxy, no we don't need to authenticate:

 

proxylb.schoolsbroadband.net:31280 - requires authentication

proxylb.schoolsbroadband.net:3128# - automatically flags as pupil (though doesn't flag in reports, so something I'm still messing with...)

 

What happens when you set the manual proxy on a desktop?

[Lee-H]

We use MDM to push out a global proxy for the ipads - they didn't pull the PAC file from DHCP (I think it needs hosting securely for ipads to accept it).

 

So, when using MDM/manual proxy, no we don't need to authenticate:

 

proxylb.schoolsbroadband.net:31280 - requires authentication

proxylb.schoolsbroadband.net:3128# - automatically flags as pupil (though doesn't flag in reports, so something I'm still messing with...)

 

What happens when you set the manual proxy on a desktop?

 

Just tried on a desktop with manual proxy settings with the custom port and Auto detect settings unticked and its not working

 

If auto detect is unticked then surely the settings pushed out by DHCP will be ignored and use the manual settings?

 

That's what makes me think the custom ports have not been set up correctly?

[Dom_]

Just tried on a desktop with manual proxy settings with the custom port and Auto detect settings unticked and its not working

 

If auto detect is unticked then surely the settings pushed out by DHCP will be ignored and use the manual settings?

 

That's what makes me think the custom ports have not been set up correctly?

 

Yeah, sounds like the custom ports haven't been done (or haven't been applied to your school - I had this once or twice). Give service delivery a ring back, you should get straight through to someone who can resolve it then (Martin is great).

[Lee-H]

Yeah, sounds like the custom ports haven't been done (or haven't been applied to your school - I had this once or twice). Give service delivery a ring back, you should get straight through to someone who can resolve it then (Martin is great).

 

Thanks for your help, i will get back in touch with Schools Broadband!

[TMBS]

yes this will work and we've done on other installs too so I'm not sure why the engineers wouldn't have recommended this yet.

I'll check for you.

Dave

Hopefully an engineer is ringing today to set this up.

 

I've managed to set up one Chromebook but to do so I've had to deprovision it from our Google domain, set it up as a personal Chromebook, on an unfiltered IP with no proxy settings. It now connects to the Internet but obviously I can't give it to a student!

 

I have deprovisioned another Chromebook, added it again to our Google domain, created a basic wifi connection with WPA security, added the wifi connection to the Google Admin Console with no proxy settings just a direct internet connection. When I restart the Chromebook it says 'Network not Available', it's showing the wifi I have recently created and if I go into the Network settings it says I'm connected to it. If I log in as an existing user it gives me a 'There is not Internet connection Err_PROXY_CONNECTION_FAILED' error. When I go back into the wifi settings the proxy connection type has changed to 'Manual proxy configuration'.

 

Any ideas where I'm going wrong?

 

Thanks

Tracey

[Dom_]

Hopefully an engineer is ringing today to set this up.

 

I've managed to set up one Chromebook but to do so I've had to deprovision it from our Google domain, set it up as a personal Chromebook, on an unfiltered IP with no proxy settings. It now connects to the Internet but obviously I can't give it to a student!

 

I have deprovisioned another Chromebook, added it again to our Google domain, created a basic wifi connection with WPA security, added the wifi connection to the Google Admin Console with no proxy settings just a direct internet connection. When I restart the Chromebook it says 'Network not Available', it's showing the wifi I have recently created and if I go into the Network settings it says I'm connected to it. If I log in as an existing user it gives me a 'There is not Internet connection Err_PROXY_CONNECTION_FAILED' error. When I go back into the wifi settings the proxy connection type has changed to 'Manual proxy configuration'.

 

Any ideas where I'm going wrong?

 

Thanks

Tracey

 

Can you see the manual proxy that it's getting anywhere? What connection did you have prior to SBB? At a guess I'd say you're pushing out an old proxy via the admin console (which obviously won't work now, and will prevent them pulling any changes you make). If this is the case you'll need to remove/amend that setting in the console, then tether them to a phone or something to pull the new settings... I haven't used google admin console before though - so it might not be that!

[TMBS]

Can you see the manual proxy that it's getting anywhere? What connection did you have prior to SBB? At a guess I'd say you're pushing out an old proxy via the admin console (which obviously won't work now, and will prevent them pulling any changes you make). If this is the case you'll need to remove/amend that setting in the console, then tether them to a phone or something to pull the new settings... I haven't used google admin console before though - so it might not be that!

The only place I can see it being pushed out in the Google Admin Console is in Device Management - Network - Wifi and I've changed all the settings in there to the new ones. Prior to SBB we had Smoothwall filtering and all of their settings have now been removed.

 

We're now testing another method but there are issues with the certificate now, which is not being pulled through from the Google console either...

 

Thanks!

[Schools_Broadband]

@SchoolsBroadband - Any ideas why this is taking so long to sort out Chromebook filtering with Netsweeper? We are moving to Netsweeper next week with you and although we don't have any Chromebooks we are heavy users of Google Apps.

 

Hi there,

 

It's Charlotte here from Schools Broadband.

 

We are happy to assist with any filtering issues. If you have any queries, please PM me the name of your school/academy including your post code and a contact phone number and a member of our team will be in touch.

 

Many thanks,

 

Charlotte

[Schools_Broadband]

The only place I can see it being pushed out in the Google Admin Console is in Device Management - Network - Wifi and I've changed all the settings in there to the new ones. Prior to SBB we had Smoothwall filtering and all of their settings have now been removed.

 

We're now testing another method but there are issues with the certificate now, which is not being pulled through from the Google console either...

 

Thanks!

 

Hi there,

 

It's Charlotte here from Schools Broadband. I'm sorry to hear you've been experiencing issues. If you'd like to PM me the address of your School (including your postcode) and a contact phone number we will ensure that a member of the team contacts you as soon as possible.

 

Many thanks,

 

Charlotte

[TMBS]

Hi can anyone help with the following in our Chromebook saga!

 

Currently we have a domain DNS which works fine for domain computers however non-domain machines cannot resolve the names.

 

How do we append a domain to a DNS query automatically when trying to resolve local addresses?

 

Thanks!

[fiza]

Why is it that even though we are told that all policies on Lightspeed have been transferred over to Netsweeper that so many online services the School used with no issues previously have now stopped working? Is it all to do with https inspection? It's causing us nightmares at the moment!!!

 

I have a Netsweeper console login but have no access to view live traffic going through the filter. I am used to Smoothwall where I can pinpoint what is getting blocked and sort it. @Schools_Broadband - This is not going well!!

[TMBS]

I have a Netsweeper console login but have no access to view live traffic going through the filter. I am used to Smoothwall where I can pinpoint what is getting blocked and sort it. @Schools_Broadband - This is not going well!!

If you email support they can give you access to the live traffic - that's something I can do!

[fiza]

If you email support they can give you access to the live traffic - that's something I can do!

Thanks - Just emailed them.

[Nightshade2k]

Why is it that even though we are told that all policies on Lightspeed have been transferred over to Netsweeper that so many online services the School used with no issues previously have now stopped working? Is it all to do with https inspection? It's causing us nightmares at the moment!!!

 

I have a Netsweeper console login but have no access to view live traffic going through the filter. I am used to Smoothwall where I can pinpoint what is getting blocked and sort it. @Schools_Broadband - This is not going well!!

 

And you have tried using the logger to watch the users live feed?

[fiza]

And you have tried using the logger to watch the users live feed?

[ATTACH=CONFIG]47397[/ATTACH]

 

It's the logger I don't have access to but I have sent support an email asking for access.