Smoothwall MAT Alternatives

[chrisjako]

We have a smoothwall multi tenant build across our MAT:

 

1 x Parent S15 in secondaries

1 x Child S10 in secondaries

15 x Child S1 in primaries

 

In the past been a big advocate of their solution in education however,

 

Our secondaries are split-site so we depend on internet breakout and smoothwall VPN for some essential services, for example our canteen civica cashless system, papercut and Peice of Sh* Financials (PSF)

 

Until our suppliers offer a proper cloud based solution for these services, we are at the mercy of the VPN mutli tenant build solution provided for by smoothwall

 

We seem to be facing issues on regular basis, VPN control randomly failing, web content filter service not working, system logs getting full despite settings telling logs to recycle. A handful of S1 boxes where handed over to us with default username and password along with SSH access so got comprimised, we where blamed for this by the installations team for not changing them after they where the ones who had configured the multi tenant build.

 

Kids have been unable to eat as we are cashless and cannot checkout at the tills, our examination officer has been unable to download papers this morning, when printing goes down, the guy who sells pitchforks to the staff mob around the corner rubs his hands together in glee, it's becoming so disruptive I'm now no longer an advocate of their solution and looking for alternatives

 

Yes we have backup procedures but still its not ideal when i or the senior techs are offsite trying to implement them remotely on a last minute basis

 

What alternatives are their for a MAT build, i realise every company has its flaws, i just want to keep options open when it comes to renewal

[localzuk]

Most big name filter/firewall solutions should be able to handle what you want. Sophos XG can do it, and companies like Fortinet etc would be able to as well.

 

However, I'd question the design of the system first - would it make more sense to redesign your connectivity, so all sites connect to a single ISP, and then have a central filtering/firewall device at their datacentre instead? Fewer boxes, simpler network design, no VPN links to worry about?

[chrisjako]

Most big name filter/firewall solutions should be able to handle what you want. Sophos XG can do it, and companies like Fortinet etc would be able to as well.

 

Our LEA had that solution, when the main box goes down every site is totally screwed, the way we have it now is more resilient (from past experiences) - we don’t have essential services on VPN for secondary to primary connectivity, its more for convenience in that manner

 

The VPN is only essential for one of the secondaries which is a split site school 1 mile apart that shares printing, canteen and financial system

[Aprice]

We primarily use Smoothwall across our customers, we just manage them individually with an openVPN connection for us to dial in and make changes. We find the requirements for blocking unblocking quite diverse between our customers so multi Tennant wouldn't help us that much.

 

In your instance, I would suggest a HA Smoothwall setup, and getting the traffic sent from the primaries to that central setup.

[localzuk]

Our LEA had that solution, when the main box goes down every site is totally screwed, the way we have it now is more resilient (from past experiences) - we don’t have essential services on VPN for secondary to primary connectivity, its more for convenience in that manner

The VPN is only essential for one of the secondaries which is a split site school 1 mile apart that shares printing, canteen and financial system

You don't have to have a single box centrally - you can have a failover cluster of appliances. We have a 2 box cluster at our core, and that handles all our schools. In the 7 years we've run this design, we've never lost both boxes (we used to use Sophos, moved to Smoothwall).

[SchoolsBroadband]

Fortinet will do this for you no problem.

 

You can do boxes on site or if you used an ISP with cloud and virtualised FortiGates (such as our selves) then we could simply VPLS sites together via a single pane of glass for all schools or each school can have its own virtual firewall. Either way you wouldn't need to setup or manage any VPN's using hosted.

 

If you used FortiGates onsite you could use FortiManager to give you a single pane of glass to managed security and filtering policies over your estates of Fortinet Firewalls.

 

You could also use FortiAnalyzer for advanced reporting or our new hosted Incident Management Platform which takes exported Fortinet syslogs in real time and creates real time safeguarding alerts for any pupil or staff member at any site.

 

I'd be more than happy for one of our technical chaps to chat through this if you'd like?

 

We've now over 2,300 schools using FortiGate services so they're very well established in the education market with us.

 

Thanks

 

Dave

 

We have a smoothwall multi tenant build across our MAT:

 

1 x Parent S15 in secondaries

1 x Child S10 in secondaries

15 x Child S1 in primaries

 

In the past been a big advocate of their solution in education however,

 

Our secondaries are split-site so we depend on internet breakout and smoothwall VPN for some essential services, for example our canteen civica cashless system, papercut and Peice of Sh* Financials (PSF)

 

Until our suppliers offer a proper cloud based solution for these services, we are at the mercy of the VPN mutli tenant build solution provided for by smoothwall

 

We seem to be facing issues on regular basis, VPN control randomly failing, web content filter service not working, system logs getting full despite settings telling logs to recycle. A handful of S1 boxes where handed over to us with default username and password along with SSH access so got comprimised, we where blamed for this by the installations team for not changing them after they where the ones who had configured the multi tenant build.

 

Kids have been unable to eat as we are cashless and cannot checkout at the tills, our examination officer has been unable to download papers this morning, when printing goes down, the guy who sells pitchforks to the staff mob around the corner rubs his hands together in glee, it's becoming so disruptive I'm now no longer an advocate of their solution and looking for alternatives

 

Yes we have backup procedures but still its not ideal when i or the senior techs are offsite trying to implement them remotely on a last minute basis

 

What alternatives are their for a MAT build, i realise every company has its flaws, i just want to keep options open when it comes to renewal

[Wave9_Lee]

We have a smoothwall multi tenant build across our MAT:

 

1 x Parent S15 in secondaries

1 x Child S10 in secondaries

15 x Child S1 in primaries

 

In the past been a big advocate of their solution in education however,

 

Our secondaries are split-site so we depend on internet breakout and smoothwall VPN for some essential services, for example our canteen civica cashless system, papercut and Peice of Sh* Financials (PSF)

 

Until our suppliers offer a proper cloud based solution for these services, we are at the mercy of the VPN mutli tenant build solution provided for by smoothwall

 

We seem to be facing issues on regular basis, VPN control randomly failing, web content filter service not working, system logs getting full despite settings telling logs to recycle. A handful of S1 boxes where handed over to us with default username and password along with SSH access so got comprimised, we where blamed for this by the installations team for not changing them after they where the ones who had configured the multi tenant build.

 

Kids have been unable to eat as we are cashless and cannot checkout at the tills, our examination officer has been unable to download papers this morning, when printing goes down, the guy who sells pitchforks to the staff mob around the corner rubs his hands together in glee, it's becoming so disruptive I'm now no longer an advocate of their solution and looking for alternatives

 

Yes we have backup procedures but still its not ideal when i or the senior techs are offsite trying to implement them remotely on a last minute basis

 

What alternatives are their for a MAT build, i realise every company has its flaws, i just want to keep options open when it comes to renewal

 

Hi @chrisjako

 

I'd be happy to discuss a Sophos option here, I believe it would work for you. Centralised Management, individual control, highly resilient. We have many happy customers in this scenario - if you'd like an outline proposal or a more technical discussion, drop me a PM or book a meeting at your convenience below?

 

regards

 

Lee

[Primus]

localzuk is right, you can rearchitect this with Smoothwall - we run 2 UTM virtual appliances that are child nodes hosted in our ISP's data centre at two different Internet breakout points for us and an S14 physical appliance (due to be replaced with an S15 soon) as a reporter/parent node.

 

Across the trust every school is on our WAN, every school has a 1Gb MPLS connection back to our ISP who handle routing at this level - each school has a preferred breakout but can failover to the other in case of an issue with one. Every school then has a further 1Gb point to point leased line link to the nearest school in the trust to it - we then make sure that each school is effectively connected to both ISP data centres - eg. School A connects to data centre A and to school B. School B connects to data centre B and so across their two links can hit either breakout.

 

We make filtering changes on the parent and it pushes them to the 2 child nodes - the only thing it doesn't do is firewall changes - you need to do these on the 2 child nodes.

 

It's stable and reliable.

[Jcx500]

I can vouch for Fortinets for large users bases(non edu) you might want another content filter on top also

[Will.B]

We have great experience with Sophos XG and Site-to-Site VPN links, From Wave9 (Hey Lee!)

4x Secondary

1x large primary + 1x small primary linked to a secondary

 

While I much prefer the filtering options and ease of use from Smoothwall, Sophos does a great job - plus with Wave9 support we have no concerns generally.

Would be really interested on hearing more about Smoothwall VPN and Fortigate solutions out of interest...

[nicholab]

You may also want to think about your MPLS connection to Azure.

[chrisjako]

We looked at your solution as part of the tender process, whilst i agree fortigate seems like a solid high end solution, i was put off with SBB outtages for the actual internet service, being on other network manager forums it seems like you have suffered with a few more UK outtages since we moved all our schools away. For the schools we had to move off SBB, the exit procedure was a bit of a circus which has left a bitter taste tbh.

[chrisjako]

I looked into a MPLS solution, 1gb was too expensive for our primary schools

 

I feel the serverless intune enviroment we now have is the most cost effective and effeiceint way to connect the MAT under 1 Azure tennant, albeit it a lot of work cloud migrating 17 school (took us a year non stop 12 hour workdays!)

 

It would be a perfect setup if smoothwall was reliable

[chrisjako]

Hi @chrisjako

 

I'd be happy to discuss a Sophos option here, I believe it would work for you. Centralised Management, individual control, highly resilient. We have many happy customers in this scenario - if you'd like an outline proposal or a more technical discussion, drop me a PM or book a meeting at your convenience below?

 

regards

 

Lee

 

Hi Lee, we have spoken before, you will be invited again for the next tender in 2025

[tom_newton]

Drop me a line with your details - I have a few ideas to help you solve the problem