Moving to LGFL

[chekmate1984]

Hi all

 

one school i support is moving to LGFL

 

Wondered what changes do we as IT needs to do on our end? anything on the switches? DHCP/DNS? or do they just come setup their router and plug the internet cable to our core switch and all live?

 

Thanks

[pantscat]

Hi Checkmate,

 

Generally, during the setup process LGfL will ask you to either confirm what your existing internal IP addressing scheme is, or if you're happy to adopt one that they suggest - they give most sites a /22. So potentially, there could be some work to be done there.

 

Then they provide a CPE and firewall and you just plug it in to your core switch and you're all good.

 

They have a pretty good team to help get you up and running and I'd ask to be copied in to all of those emails.

[Koldov]

You should be completely informed if this is a school you support?

 

How was the decision made (or who decided on the move)?

 

@PaddyNewman should be able to point you in the right direction.

 

If you are supporting the school you will need to be very involved from the get-go as there are huge implications for the entire way the network runs and how you currently access services over the internet (with a whole new filtering set-up), NAT etc...

 

You will need to have yourselves as nominated contacts set-up and access to the LGfL/Adept/Atomwide service/support portals. You will also need access to OTP tags.

 

We were told we had to completely change our IP addressing scheme (which cost us support fees from our network provider), then were later told the old scheme could have been used (depends on clashes as you are in effect one big LGfL network with central routing/firewalls).

Edited June 24, 2022 by Koldov

[Aprice]

In our experience they to allocate subnets to you, having said that that's only based on the sites we've moved off LGFL and similar. We've just got one customer left on one of these (not LGFL specifically) and they are going with Smoothwall and a leased line this summer.

 

Can't say how much time has been wasted this year with Netsweeper and messing around with CRFs for firewall rules. Having local control of this certainly makes our lives easier and our customers have had a much better experience since.

[PaddyNewman]

I did write a decent post but mobile seems to be so buggy!

 

More than happy to chat and go through what you might need if that helps?

 

@Aprice I totally understand, sometimes local control is the way for you, but I've seen some requests that make me worried for the security of schools, so whilst we do need a change request, I feel that's part of the managed service and adding to the protection of schools, your mileage may vary of course

[nicholab]

The subnet change is very poor I also think that any change request have to be signed of by the head which is some what of a pain. We were with the old LGFL option which was just internet no filtering or firewall and that worked for our needs.

[PaddyNewman]

Things have changed somewhat, the Head can designate a techy user to make the techy decisions now so its a 1 time sign off, also change requests are just raise it and we'll change it, just need to be a nominated user to do so, maybe you had a much older version of LGfL before the LGfL2 side of things became the common use setup?

 

With the subnet thing, if we can fit you in, we will, but we use 10.x for schools, our hosted/core stuff is 172 ranges and 192 is used elsewhere, so the whole 10.x/8 is for schools. If you dont use that, NAT and do your own filtering/NAT to specific LGfL provided IPs for staff/students etc, you lose the benefit of user based filtering though.

We do try to slot you in and re-use though, sometimes a school is already using it and we can't up and lift them!

 

When it comes down to it, re-IP is less than a few hours in a secondary and even less so for a primary, but we do have a finite amount of IPs and we can't just hand out bits and bobs from across the range

[Koldov]

Honestly there shouldn't be any need to attack or defend how it works... that's just how it works... might not be for everyone and there might be 'options', but basically it is what it is.

 

It also depends where you are coming from, your experience and what sort of level of 'control' you want over everything. If you are used to doing everything yourself, you may find having to ask for every little change in a support request very frustrating (especially if you think you can do a better job and quicker).

 

I've always found them to be accommodating and willing to sort out any issues where possible. Also, as an only IT tech, I find a lot of the LGfL stuff quite reassuring and helps me concentrate on the day to day. Plus we take advantage of most of the bundled software/services (Sophos, Malwarebytes, Meraki, Gridstore, Adobe CC and CISCO AnyConnect for VPN access).

Edited June 26, 2022 by Koldov

[Face-Man]

It looks like this website has a lot of explanations as to the onboarding process onto an LGFL connection.

 

The first thing you might want to do @chekmate1984 is get set up as a nominated contact on the support site.

 

https://national.lgfl.net/services/moving-to-lgfl