Moving away from LGFL Web filtering/Firewall

[xicor]

Hi All

 

we have 3 sites with LGFL and so far we've been using LGFL web filtering but to be honest I'm getting fed up with web screen and the lack of any control over the firewall, some of you might have seen my previous threads about this and despite various promises from LGFL this issue remains several years later and web screen is still looks it was made by a graduate at uni

 

So..... I've decided to slowly move away from my reliance on LGFL's web filtering and firewall and just get my own and have complete control, I'll set the LGFL connection to be completely unrestricted and just use my own firewalls/filtering etc.

 

in your experiences what has worked very well with web filtering and firewall ?

 

Thanks in advance!

[chris11256]

We're not an LGFL school, but I'm a very big fan of Palo Alto. We have one of their firewalls currently(it also does the webfiltering), works perfectly and have had no problems with it.

[GrumbleDook]

Hi All

 

we have 3 sites with LGFL and so far we've been using LGFL web filtering but to be honest I'm getting fed up with web screen and the lack of any control over the firewall, some of you might have seen my previous threads about this and despite various promises from LGFL this issue remains several years later and web screen is still looks it was made by a graduate at uni

 

So..... I've decided to slowly move away from my reliance on LGFL's web filtering and firewall and just get my own and have complete control, I'll set the LGFL connection to be completely unrestricted and just use my own firewalls/filtering etc.

 

in your experiences what has worked very well with web filtering and firewall ?

 

Thanks in advance!

 

This was the model we operated whilst on embc around 15 years ago. I got grief about it to start with, but then it became an established model ... to the joy of a lot of other schools in the area (and to the joy of a number of filter/firewall providers too ... mentioning no names!) and also adopt more of a monitoring approach rather than explicitly blocking things.

 

It has downsides though. When something goes wrong (and it will) it takes more time and effort to get sorted. You may have to have a fall back option of going back to the 'default config' to get something fixed and then turn it back to how you want again. You can also lose the flexibility of some resources that can come with using an RBC's filters.

 

If you are that annoyed, tell LGfL and ask them for a more flexible option.

[xicor]

We're not an LGFL school, but I'm a very big fan of Palo Alto. We have one of their firewalls currently(it also does the webfiltering), works perfectly and have had no problems with it.

 

I've had them in my previous place but this was a long tome ago and was told at them time they run something like £50k a unit! not sure how true that is though, which model do you use at your place ?

 

EDIT: I just spoke with palo alto and it seems their PA-400 is a good option and does not cost £50k!

Edited December 2, 2021 by xicor

[chris11256]

It’s the VM-300, including the 3 year subscription for the various things like filtering & wildfire it was £7K.

 

Our subscription is up in May & I’ve heard similarly good things about the new PA-400 model. Will be quoting for it nearer the time.

[xicor]

This was the model we operated whilst on embc around 15 years ago. I got grief about it to start with, but then it became an established model ... to the joy of a lot of other schools in the area (and to the joy of a number of filter/firewall providers too ... mentioning no names!) and also adopt more of a monitoring approach rather than explicitly blocking things.

 

It has downsides though. When something goes wrong (and it will) it takes more time and effort to get sorted. You may have to have a fall back option of going back to the 'default config' to get something fixed and then turn it back to how you want again. You can also lose the flexibility of some resources that can come with using an RBC's filters.

 

If you are that annoyed, tell LGfL and ask them for a more flexible option.

 

I asked them many times for a better solution, they just don't seem to care and I know for a fact and from a technical point of view they can implement a solution that allows firewall control and I also know their web screen can be made better but I don't think they are interested, Jackson said LGFL listens but here we are many years later and still no ability to manage the firewall other than using some silly excel sheet, and web screen as I said still feels like a uni graduate product...

[PaddyNewman]

I asked them many times for a better solution, they just don't seem to care and I know for a fact and from a technical point of view they can implement a solution that allows firewall control and I also know their web screen can be made better but I don't think they are interested, Jackson said LGFL listens but here we are many years later and still no ability to manage the firewall other than using some silly excel sheet, and web screen as I said still feels like a uni graduate product...

 

Hello!

 

So I work on (mainly) the firewalling side but I also handle WebScreen.

 

If you have issues with them and ideas to improve, I'm happy to talk.

 

I would preface by saying that currently, I have no idea how you would be able to make firewall changes, ones in our core which handles inbound rules and ones on prem with you in a shared management platform for outbound (and inbound, but not the NAT)

 

We couldn't give you access to the core one, 100% not as that's handling the whole of LGfL. Your school one, possibly, it's been asked about before. It's one of those things that could possibly be done, but you still will only have outbound rule configuration.

 

Yes, the Excel spreadsheet is outdated as such, what would you prefer, other than direct firewall access?

 

WebScreen is changing, can't really say much as I don't want to 'run my mouth' but it's my only real ongoing project which is taking up all my time, so the upgrades are coming, but what is it about WebScreen you dislike? Happy to make suggestions to all here.

 

It sounds like we've left a sour taste in your mouth so I'd like to try and see what's gone wrong, but do be aware you can't fully open the LGfL firewall or filter, you need a second line or choose the Option 2 configuration. That's a raw feed on the router, you use your own firewall and filter and we revert our firewall to a basic configuration.

 

As always happy to talk and thrash anything out, it helps improve the service and I'm all for that.

[PaddyNewman]

@xicor if you find some time to give me a call, I am around tomorrow and Wednesday from 9am, feel free to give me a buzz to go over these items (this is to all LGfL customers also, if you have a query or idea that we may not have on our ever growing wishlist)

[gh5000]

@xicor - just genuinely curious as I work with a number of LGfL schools at the moment... how often do you have to make firewall changes that the spreadsheet is a hassle? I agree it's not the best thing in the world but never found it to be too onerous.

 

And I also am not a fan of schools outsourcing stuff to companies when a tech should be able to learn it, but on firewalls I'd rather have someone that does firewalls as his day job like Paddy and his team checking over the changes I'm requesting.

[jnfarmer]

We're currently an LGfL school and are moving to a new service provider soon who are giving us more control over our firewall and web filtering and the products look SO much better. Can't say to much at the moment but if all goes well, I'll revert back!

[gh5000]

@jnfarmer are you able to give some overview of costs - how much are you saving when including AV, firewall, filtering, connection etc?

[jnfarmer]

I'll PM you some details when I get moment.

[xicor]

@xicor if you find some time to give me a call, I am around tomorrow and Wednesday from 9am, feel free to give me a buzz to go over these items (this is to all LGfL customers also, if you have a query or idea that we may not have on our ever growing wishlist)

 

Hi Paddy, thanks for your reply and sorry for my delayed one its been a busy week.... I am free today and tomorrow and also next week so let me know what days,times you are free and the number to call you on.

 

it would be good to also share the outcome of our call here so other people might benefit

[xicor]

@xicor - just genuinely curious as I work with a number of LGfL schools at the moment... how often do you have to make firewall changes that the spreadsheet is a hassle? I agree it's not the best thing in the world but never found it to be too onerous.

And I also am not a fan of schools outsourcing stuff to companies when a tech should be able to learn it, but on firewalls I'd rather have someone that does firewalls as his day job like Paddy and his team checking over the changes I'm requesting.

 

I agree having 3rd line support like Paddy is better as they do firewalls all day and would know more than me but not having simple easy access to that level of support combined with lack of control/access causes issues, if at least one of those issues is resolved then it would solve everything, but this cant just be for me, it needs to apply to all schools and to give schools better access to 2nd/3rd line technical support after all we are not your average "end user" we are IT professionals and do not need to speak to a 1st liner that cannot be asked to even run checks from their end and has to pass it to 2nd,3rd line...

[xicor]

We're currently an LGfL school and are moving to a new service provider soon who are giving us more control over our firewall and web filtering and the products look SO much better. Can't say to much at the moment but if all goes well, I'll revert back!

 

do share the love man haha, who is that provider I am also interested in pricing, services etc

[PaddyNewman]

Calendar is free all Monday. Feel free to buzz me then or Tuesday, definitely clear after 9am for both days, happy for our call to be relayed here, also please do feel free to think up and throw some ideas our way, we occasionally entertain them

 

Just to point out the 1st line part. They are our defence between calls and support, if I'm upgrading a school to SSL inspection, I need to be on the ball, so they are essentially defending us from calls, otherwise I'd love to have a direct dial in to help, I appreciate you want your issue fixed asap, me too! Perhaps something I can chat with people about, can't promise anything but I appreciate sometimes we have more technical folk on the phone.

 

I/management also do try to upskill the entry point of calls, our team is constantly learning so if there are skills you think they need, feel free to give me some ideas and I can feed back to their manager who is all for upskilling them.

Edited December 9, 2021 by PaddyNewman

[Cat_Jam148]

Hi Paddy,

 

Thanks for taking the time to pop on here and discuss

 

Wondering if there any plans to further improve the Webscreen portal in regards to the viewing of the filtering logs? The current system of having to create a report and then wait for it to process, download it and then open becomes a bit tedious - a way to view the reports and filter within the portal itself would be a great help and improve the effectiveness of the logs. This is currently my biggest issues when it comes to Webscreen and where I think it falls short compared to other filtering providers. I understand that it probably works this way for a reason and that the amount of data held by Webscreen is vast, so having a responsive log is a challenge.

Edited December 9, 2021 by Cat_Jam148

[jnfarmer]

do share the love man haha, who is that provider I am also interested in pricing, services etc

 

I couldn't possibly comment at this point in time...

[PaddyNewman]

Hi Paddy,

 

Thanks for taking the time to pop on here and discuss

 

Wondering if there any plans to further improve the Webscreen portal in regards to the viewing of the filtering logs? The current system of having to create a report and then wait for it to process, download it and then open becomes a bit tedious - a way to view the reports and filter within the portal itself would be a great help and improve the effectiveness of the logs. This is currently my biggest issues when it comes to Webscreen and where I think it falls short compared to other filtering providers. I understand that it probably works this way for a reason and that the amount of data held by Webscreen is vast, so having a responsive log is a challenge.

 

Probably worth responding a bit more in-depth when I'm not hustling around a shopping centre for some last minute stuff!

 

I'm happy to discuss certain aspects of logging with you, I see location is West Mids, so our Outside London/NGfL platform I assume, which we recently rebooted so it should be pretty responsive.

 

Let me sort my stuff out today and I'll probably drop a PM with some school specific items if that's ok?

 

But... There are changes coming, I feel our reporting is pretty quick given the size of the files and extraction of said data but if it's not just the time and more the output and the quality of said data, that's another thing

[xicor]

Calendar is free all Monday. Feel free to buzz me then or Tuesday, definitely clear after 9am for both days, happy for our call to be relayed here, also please do feel free to think up and throw some ideas our way, we occasionally entertain them

 

Just to point out the 1st line part. They are our defence between calls and support, if I'm upgrading a school to SSL inspection, I need to be on the ball, so they are essentially defending us from calls, otherwise I'd love to have a direct dial in to help, I appreciate you want your issue fixed asap, me too! Perhaps something I can chat with people about, can't promise anything but I appreciate sometimes we have more technical folk on the phone.

 

I/management also do try to upskill the entry point of calls, our team is constantly learning so if there are skills you think they need, feel free to give me some ideas and I can feed back to their manager who is all for upskilling them.

 

Hi Paddy, what number should I call to ask for you ?

[PaddyNewman]

Hiya,

 

0208 255 5555 option 3 then 1. Just ask for me and they will pass you through.