Getting rid of all our servers and going fully cloud-based - good idea or madness?

[enjay]

Our current server/network provision and support contract is up for renewal next year, and we're at the thinking big, out-of-the-box, "no idea is a bad idea" stage and asking ourselves can we ditch all our servers and go fully cloud-based. We are already heavily reliant on the Internet, with Google Apps, Pearson Activelearn, Mathswatch, etc. and all students on BYOD; we have no shared file storage on our servers, but (some) teachers are still wed to PowerPoint. So, the move to cloud is not a scary one for us, the question we're asking is can we go FULLY cloud and just serve our users an Internet connection?

 

I'd love to hear from schools who have done this, and those who considered it but decided against it.

[mjk]

My strategy is:

1) Ignore these: CCTV, Wireless Contoller, Firewall.

2) Make sure you have replication/Failover setup on *all* systems

3) start migrating your failover server to GCP/Azure/AWS

4) Run this for a bit and see how you get on, gauge the costs etc.

5) turn off your servers for giggle and see what happens

6) evaluate

[enjay]

Thanks @mjk - that's sort of what we're thinking, especially now Google have released GCP.

 

What do you mean in step 2 though? If we're fully G Suite, GCP and other online resources, wouldn't we just have a wifi controller, firewall and Internet connection? What systems would we have left which would need replication/failover?

[Norphy]

Well, the Wifi controller, the firewall and the internet connection to begin with. Plus your network core switch as well I'd say. If you're going all cloud, those are the things which are most critical and need redundancy.

[mjk]

Thanks @mjk - that's sort of what we're thinking, especially now Google have released GCP.

 

What do you mean in step 2 though? If we're fully G Suite, GCP and other online resources, wouldn't we just have a wifi controller, firewall and Internet connection? What systems would we have left which would need replication/failover?

So we first replicated DHCP, Active Directory, web servers, library system, RADIUS servers into the cloud.

If you can do all this on your networking equipment and external web servives then you could be fine.

Amazon do a samba 'cloud' active directory if you need that.

[Michael]

Can you be server-less? Almost.

 

It still makes some sense to have your AD role holder in house, but then replicate this out to services such as Azure.

 

The question should really be "Can we get rid of our file servers and go cloud based?" And the answer is really yes and no to be honest.

[enjay]

Well, the Wifi controller, the firewall and the internet connection to begin with. Plus your network core switch as well I'd say. If you're going all cloud, those are the things which are most critical and need redundancy.

 

We already have redundancy on most of that, due to how critical our Internet connection already is - no Internet means no SIMS, G Suite, printing, seating plans, 99.9% of lesson resources, oh and no phones either.

[mjk]

The question should really be "Can we get rid of our file servers and go cloud based?" And the answer is really yes and no to be honest.

 

 

For us that was by *far* the easiest thing to do, we did it ages ago and hardly presented any challenges.

[enjay]

It still makes some sense to have your AD role holder in house, but then replicate this out to services such as Azure.

 

Do I even need AD? If everything is online, what's AD doing (other than enabling user-specific filtering, which could be done with separate SSIDs and VLAN routing)?

 

The question should really be "Can we get rid of our file servers and go cloud based?" And the answer is really yes and no to be honest.

 

Why "no"?

 

The question we answer will probably end up being "can we get of our file servers?" but at this stage, it is "can we get rid of all of them?"

[Michael]

Whether you still need AD is entirely up to you, but AD gives a lot of control to services beyond your local domain, such as linking to Azure for example as your authoritative directory. I'm not saying there aren't other ways, but then the overhead to run a DC is small, even on a PC that's 10 years old.

 

As to whether you can get rid of all file servers - it depends on your environment - but realistically I'd say a high percentage yes I would agree with you.

 

For example (as far as I'm aware) there's no way to implement Folder Redirection with a cloud drive, as typically this authenticates after your initial logon. Microsoft Libraries are relatively simple for users to navigate and manage files and folders, rather than everything in a single directory.

 

Other examples are Scan to File from a local MFP - Scan to Email is the obvious solution, but Scan to Cloud drive doesn't really exist yet, but probably will in future.

[dhicks]

Scan to Cloud drive doesn't really exist yet, but probably will in future.

 

I thought this was a feature in the latest version of PaperCut?

[Michael]

Maybe it is, thanks for the heads up!

[mavhc]

So we first replicated DHCP, Active Directory, web servers, library system, RADIUS servers into the cloud.

If you can do all this on your networking equipment and external web servives then you could be fine.

Amazon do a samba 'cloud' active directory if you need that.

 

How does dhcp work if it's not on the LAN?

 

If your school is 50% not in the building, fair enough, but don't see the point otherwise, it's not going to be cheaper unless you stop paying for Windows and Office.

 

Any tiny computer can run dhcp, dns.

 

How do you do filtering?

[IrritableTech]

I think there is a real possibility of this working in the right school, but you asked for challenges so here are a couple that come to mind...

 

What OS do your systems run? How will you deploy that OS or will you build each machines from scratch? How will you ensure that users aren't saving work locally on that OS unless you have some management tools?

How will you host DHCP, DNS? How will you manage OS upgrades, security patches and firewalls?

BYOD is great to supplement learning of many subjects but will it work for all subjects? I presume you're not thinking BYOD will work for IT lessons? So what kit, what OS, what services are required for teaching?

You said you've got sims online - how does that play with O365 and or GDrive? My previous experience is capita like fully blown office for many reports. How will that work without some layer of OS management?

Admin back office functions - finance, cashless catering, building management etc. Are they compatible in this new world?

 

As others have mentioned, moving to cloud storage has a lot of wins, being serverless isn't really doable for me.

[mjk]

How does dhcp work if it's not on the LAN?

 

If your school is 50% not in the building, fair enough, but don't see the point otherwise, it's not going to be cheaper unless you stop paying for Windows and Office.

 

Any tiny computer can run dhcp, dns.

 

How do you do filtering?

 

We run the DHCP failover on a server in London over a VPN (3 - 4 ms latency).

If all our servers go down the DHCP works, people can still authenticate to wifi (radius) and get online although the firewall is currently a Single Point of Failure.

We don't pay for Office and have very few windows licenses.

Filtering is done on the firewall - but I could run it in cloud if I want to, it's a well established method now: https://www.fortinet.com/solutions/service-provider/communications-service-provider/cloud.html or https://aws.amazon.com/marketplace/seller-profile?id=243a3a4c-e35a-49b0-9061-3f354bb2254e

Edited July 5, 2018 by mjk

[enjay]

We do have some services which use AD authentication, but some of those also support Google authentication.

 

If people only have Google Drive for storage, that does away with the problems of folder redirection doesn't it?

 

We only use scan-to-email from the MFDs anyway. The fancy super high speed scanners in Finance scan locally but I think they can scan to Google Drive.

 

Most of the applications currently running on the app server could either be migrated to cloud (especially with GCP) or replaced with cloud versions. I think our hosted SIMS provider can support Groupcall XOD, but we do have some products which use their own sync tool so need a SIMS client (one of our servers has a VPN link to the hosted environment, and runs a client). Biometric ID for catering could be problematic too, are there any hosted products? So, there would be some work in switching off the app server, but the financial saving of not having to run the server could offset that.

[enjay]

I think there is a real possibility of this working in the right school, but you asked for challenges so here are a couple that come to mind...

 

All good questions, and a list of challenges is exactly what I'm after. Here are my responses:

 

What OS do your systems run? How will you deploy that OS or will you build each machines from scratch? How will you ensure that users aren't saving work locally on that OS unless you have some management tools? How will you manage OS upgrades, security patches and firewalls?

 

Currently, Windows 10 but in the brave new serverless world, we'd have Chromeboxes on all the desks.

 

How will you host DHCP, DNS?

 

I would expect our router to do that, just like my home one does.

 

You said you've got sims online - how does that play with O365 and or GDrive? My previous experience is capita like fully blown office for many reports. How will that work without some layer of OS management?

 

Not SIMS online, SIMS runs is a hosted Windows environment accessed via RDP or an HTML5 portal, so Excel reports etc could be run in that then copied and pasted into Google Docs/Sheets

 

Admin back office functions - finance, cashless catering, building management etc. Are they compatible in this new world?

 

Mostly,yes. Those which aren't could potentially be replaced with ones which are.

 

As others have mentioned, moving to cloud storage has a lot of wins, being serverless isn't really doable for me.

 

I suspect our end point of all this will be a VM server on-site running AD, a small app server for the one or two things we couldn't replace or migrate, and clients being Chromeboxes with RDP back to the app server, or thin client in admin perhaps.

Edited July 5, 2018 by enjay

[gshaw]

If you're fairly free of legacy applications you potentially could but once you have to start spinning up Windows VMs in Azure etc. to run "on-prem" software then it can get expensive pretty quick unless the costs have come down considerably since I last looked.

 

Lack of a true cloud MIS is probably the biggest barrier to being completely free of on-prem. Hosted ones running in a massive Azure \ AWS VM don't count as that's a really pricey way to "cloud" a product imo.

 

For now we take the view that if a product is available as a native cloud app e.g. O365, G-Suite then make that the default go-to. However if it's Windows server-based then keep it on-prem as even with power and cooling it seems less pricey than putting that up in the cloud.

Edited July 5, 2018 by gshaw

[enjay]

If you're fairly free of legacy applications you potentially could but once you have to start spinning up Windows VMs in Azure etc. to run "on-prem" software then it can get expensive pretty quick unless the costs have come down considerably since I last looked.

 

Which is why I would look to replace the on-prem software if I could. Just because you've used Product A this year doesn't mean you have to use it next year, and I certainly wouldn't continue to incur large costs all because the librarian doesn't want to change catalogue system, for example.

 

Lack of a true cloud MIS is probably the biggest barrier to being completely free of on-prem. Hosted ones running in a massive Azure \ AWS VM don't count as that's a really pricey way to "cloud" a product imo.

 

Agreed, hosted SIMS on someone else's VM is a lazy way to "cloudify" a product, but until someone comes up with a decent HTML5 MIS (and until we have the inclination to do a MIS migration - unlikely to ever happen, if we're being honest), we're stuck with it. It is an expensive way to do it, but I'm interested in bottom line, so if replacing file storage with G Drive and on-prem software with web tools allows me to cancel a £30k annual cost (provision, support, accrued cost of ongoing hardware replacement), I'm okay with having one product which is costed inefficiently.

Edited July 5, 2018 by enjay

[gshaw]

Which is why I would look to replace the on-prem software if I could. Just because you've used Product A this year doesn't mean you have to use it next year, and I certainly wouldn't continue to incur large costs all because the librarian doesn't want to change catalogue system, for example.

Indeed, although unfortunately some of the heftiest \ priciest systems are the ones that are the most deeply ingrained and hard to replace e.g. MIS, access control etc.

 

Also have to watch out for sneaky price increases for cloud equivalents, Sophos have been the worst for this at the moment when we looked to move our on-prem to Central (pricing changes from an overall site license to one where servers get charged at a higher rate than clients, which makes it a fair bit more expensive than anything we had before). Certainly the per-user model can become expensive very quickly and needs to be costed carefully.

 

Finally integration is the other hidden cost to watch for. Whereas on-prem you can often dig into a SQL database to extract data from systems in cloud you're at the mercy of APIs being made available. For some places that may not be an issue but it's about analysing your current environment and making a balanced judgement as opposed to the shiny sales pitch

[enjay]

Also have to watch out for sneaky price increases for cloud equivalents

 

True, but any increases should be considered against the saving from being serverless

 

Sophos have been the worst for this at the moment when we looked to move our on-prem to Central

 

My brave new serverless world would see Chromeboxes on all the desks, so no need for Sophos, etc.

 

Finally integration is the other hidden cost to watch for. Whereas on-prem you can often dig into a SQL database to extract data from systems in cloud you're at the mercy of APIs being made available. For some places that may not be an issue but it's about analysing your current environment and making a balanced judgement as opposed to the shiny sales pitch

 

Very little SQL stuff, and what we do have has a pretty front-end so I wouldn't want to dig in the DB. Plus, I'd be looking to move these to cloud versions anyway.

[gshaw]

True, but any increases should be considered against the saving from being serverless

 

My brave new serverless world would see Chromeboxes on all the desks, so no need for Sophos, etc.

 

Very little SQL stuff, and what we do have has a pretty front-end so I wouldn't want to dig in the DB. Plus, I'd be looking to move these to cloud versions anyway.

 

Fair do's, can see you have a sound strategy around where you want to get to and that's the key thing

 

Did want to get a couple of Chromebox \ Chromebit to migrate our digital signage players away from Windows OS as they seemed ideal for that.

[jmak]

There's a school near us that's gone serverless using Airhead 360.

 

http://blog.airhead.io/meet-airhead-360/

 

When I spoke to them a year ago they seemed pretty happy.

[mjk]

Google Cloud SQL is good. It has replication/failover, automatic backup/upgrade and you can use all standard postgresql or mysql tools.

It currently runs out library and webserver

 

you also need CloudSQL setup to use Goggle App Maker, which is awesome.

Edited July 5, 2018 by mjk

[ITGURU]

Sounds like you might do yourself out of a job - remove all the IT , put it in the cloud, give them the support numbers and say goodbye!

Much rather everything on-site, 100% uptime during school hours, choose when to upgrade, train users before major changes and solve issues as and when they occur without waiting.

users are so reliant on IT.