Cloud First School Design

[StephenPink]

Hi all,

 

Thinking about a cloud-first, hopefully serverless design/strategy for a junior school. Would appreciate others who have done this thoughts/advice, especially on the following:

- Network design. Is it time to rethink the traditional core-edge? The focus is mostly on wireless obviously, but then is there still a need for any NAC/security if there are no on-prem resources and it's all online, secured by credentials?

- DNS/DHCP. And other still needed on-site resource that I've forgotten about... possible to run those on the core switch/router? Is that wise?

- Internet. Leads on from the above, needs to have failover - 2 locations, 2 feeds, 2 core switches/routers connected? Does it need to be any more complex than that/can it be any simpler? Any downsides of cloud-based filtering?

- Printing. How do you get rid of the on-prem print server, but still have follow-me printing?

- SIMS. Yep, bloody SIMS. If everything is Azure only, what can be done about SIMS? It can be hosted at another school perhaps, that has plentiful resources, but how would that work? I remember there is such a thing as Hosted SIMS but I remember it being a bit rubbish...

 

 

If anyone feels up for good ol' chin-wag about this stuff then please PM me - I think there are some very exciting possibilities, and would love to bounce ideas around.

 

Cheers,

Stephen

[maark]

If I was starting from scratch I would be looking at doing as much as possible with google - Classroom, Chromebooks etc. They are way ahead of Microsoft - much more straightforward and good support from techs in Ireland.

Sims is a problem - what are the cloud based alternatives?

[dhicks]

And other still needed on-site resource that I've forgotten about...

 

CCTV and/or desktop phone handsets - you'll need edge switches with PoE capability and (ideally) UPS-backed power so these stay up in an emergency.

 

Internet. Leads on from the above, needs to have failover

 

Depending on your location and provider, a 5G backup service might do. I use a 5G ISP at home and have, occasionally, seen download speeds of 100Mbps, and I think maybe BT were offering a 5G backup service for some of their home connections if their main connection went down - you'd want the business version of that. Also, the new satellite ISPs might work quite nicely as a backup connection, and on a completely separate input mechanism from your standard cable.

 

Any downsides of cloud-based filtering?

 

An advantage: with ChromeOS, with a force-installed app doing the filtering on the client side, the filtering works on whatever ChromeOS device a pupil logs in to, whether at school or at home. So you can say to parents that, as long as children are logged in with their school account, their connection should be filtered.

 

SIMS

 

You can run SIMS (or any other application) on a server in a datacentre somewhere and have users log in via a web-based remote desktop connection. Ideally, your web-based remote desktop would support Google / Microsoft login and be able to run SIMS as a remote app, so as far as the user is concerned they open a web page, hit the log-in-with-Google-button and SIMS runs in their web browser. You would still need to host, license and maintain a suitable server somewhere to run SIMS and any associated remote desktop connection, but it's do-able if moving MIS is not an option.

[mavhc]

Plan to move MIS at the same time, excellent reason for a switchover.

 

Will they need Windows computers for anything? Exams? Specialist software?

 

Can easily run dns/dhcp on your router/firewall.

 

What's the plan when a free service suddenly decides to charge?

[supportman]

Flat network with Unify Gen 2 switches should be fine as well as wireless all integrated into their management interface.

Migrate to a Cloud MIS, loads of good ones these days even for Primary

I think windows server has just introduced something for cloud printing

Cloud Internet filtering is a no brainer really

Azure login and intune if using Microsoft or Google Login and chromebooks, both work well.

Edited April 27, 2021 by supportman

[Ditto]

You might find this useful/informative https://blog.theserverlessschool.net/

[StephenPink]

Thanks all, lots of good stuff so far - should've said they are currently using 365, no Google. So will likely stick with that path.

 

Yeah SIMS is a PITA... I'm not sure moving away is realistic at this stage, but definitely a long-term goal. Unless they suddenly pull their finger out with development! Any merit to getting the same MIS across a Trust? Is it worth the work involved I should say...

 

CCTV/phones - yep good point. Currently not IP based, so avoiding for now - but something to plan for, definitely. Along with yes, UPS for cabs especially with wireless, that's additional cost I will need to factor in.

5G backup internet I quite like the sound of! Assuming we can get service that is, I seem to still struggle to get 4G most places.

Agree about the filtering at home - I think especially with it being junior, that's something that should be looked into it.

 

Windows computers still being needed is interesting - I think we'll struggle to get rid completely, but definitely a reduction in need and also spec. I can't see anything needing more than a decent i5/8GB RAM/SSD these days, and they can be had for pretty cheap these days.

Free service suddenly charging I hadn't considered. That would be a a pain, but something that would have to be dealt with if/when it happened. Have you an example in mind?

 

Flat network - interesting. So no need for VLANs at all in this scenario?

 

Ah yes that blog is where I started - lots of great stuff on there!

 

Thanks,

Stephen

[mavhc]

Once every computer is just accessing the cloud you can do the whole zero trust micro segmentation thing, have an ACL on the wifi to not let them talk to each other even (although that breaks p2p updates)

[RobD]

I visited a site last year that had handsets but they all had sim cards in so they could take them home etc.

[TechMonkey]

Don't forget if you have any access control, for example Paxton.

 

Downside I mentioned elsewhere is if you don't control the device then how do you enforce filtering on your pipe? At least with a device in between your core and the router you have complete confidence that you can apply filtering. You will still need a firewall so either a combined device or one extra box won't kill the serverless dream. Or look at some of the Hybrid filtering systems, so site(s) are protected and your devices off site are covered.

 

I would still have VLANS to hive off any services you keep on site, VOIP, CCTV and access control as mentioned.

 

Some thoughts on UPS for cabs, if the power goes will school continue? So do you need to keep all the services going? How long will you keep your core going so is their much point pumping traffic to it? Will your pupils be sitting in the dark still using their WiFi devices to learn? Most schools I know will shut if it is definite that power will not be brought back up in a couple of hours. Better to ship any essential admin staff off to WfH.

 

Also print management is currently firmly stuck on site. Add to that things like copier management often have a helper service that needs to be installed on site. That is probably the biggest issues, 3rd party suppliers that expect you to have certain infrastructure. We have a managed radio system that we had to spin up a standalone PC as it had a USB dongle and didn't like server editions. Even with careful questioning those limitations never came up in pre-talks.

Edited April 27, 2021 by TechMonkey