Google Chromebooks - Smoothwall Cloud Filter

[ssouth]

Hello

 

Are they any schools out there who run a large 1 to 1 chromebook deployment and use the Smoothwall Cloud Filter on a separate VLAN?

 

A few years ago we decided to use the cloud filter and the internet speed for the whole school just ground to a halt. We went back to the Connect for Chromebooks app method and all was fine.

 

Over the summer we decided to try the Cloud filter again and the same thing is happening. When we get 500+ chromebooks on, the resource usage on the smoothwall box rises above 10. A simple ping to the IP address of the smoothwall box goes from <1ms to 100ms plus and also timing out.

 

We are at a loss what to try, other than scrapping using the cloud filter again.

 

Any advice or shared experiences would be happily recieved.

 

Thanks in advance.

[Primus]

We have about 2000 Chromebooks across our 5 schools on one WAN with 2 Internet break outs, we've used Cloud Filter for years and we've never seen that.

 

What bandwidth is your Internet connection?

[ssouth]

We have about 2000 Chromebooks across our 5 schools on one WAN with 2 Internet break outs, we've used Cloud Filter for years and we've never seen that.

 

What bandwidth is your Internet connection?

 

500Mbit on a 1Gbit bearer

[Primus]

Can your ISP supply stats on if you're maxing the connection out, if you've got 500 Chromebooks all active at the same time then 500mb is probably getting hit quite hard.

 

Is that a leased line with symmetric upload speed?

[ssouth]

According to our ISP all is good, thought I may need them to dig a little deeper.

 

500Mbit up and down with a dedicated fibre line to premises.

 

I think the issue is more to do with the Smoothwall box and how that is maxing out - we have an S9 box.

[Primus]

According to our ISP all is good, thought I may need them to dig a little deeper.

 

500Mbit up and down with a dedicated fibre line to premises.

 

I think the issue is more to do with the Smoothwall box and how that is maxing out - we have an S9 box.

 

Your Chromebooks should be using the secret knock to bypass the Smoothwall so they shouldn't be causing any load - have you configured this?

 

The only time I've ever seen a Smoothwall box go randomly high on load was when we were maxing out an old low bandwidth backup line.

[ssouth]

Your Chromebooks should be using the secret knock to bypass the Smoothwall so they shouldn't be causing any load - have you configured this?

 

The only time I've ever seen a Smoothwall box go randomly high on load was when we were maxing out an old low bandwidth backup line.

 

Hi - Yes, configured the secret knock method and the VLAN method as shown on their support website.

 

Neither method seemed to make any difference sadly.

[Primus]

If you SSH into the Smoothwall and run top what's showing as causing the load?

 

Also what's the spec of your Smoothwall - is it one of their appliances?

[ssouth]

If you SSH into the Smoothwall and run top what's showing as causing the load?

 

Also what's the spec of your Smoothwall - is it one of their appliances?

 

Hi - I don't have \ allowed SSH access to the device, so can't run Top.

 

Its an S9 Appliance -

 

Intel® Xeon® E-2276G CPU @ 3.80GHz (GenuineIntel)

Cores 6 (hyperthreaded to 12)

Speed 3801.000 MHz

 

32GB Ram

[Primus]

Hi - I don't have \ allowed SSH access to the device, so can't run Top.

 

Its an S9 Appliance -

 

Intel® Xeon® E-2276G CPU @ 3.80GHz (GenuineIntel)

Cores 6 (hyperthreaded to 12)

Speed 3801.000 MHz

 

32GB Ram

 

Have you logged it with support? Perhaps @tom_newton can help?

[tom_newton]

Definitely log with support.

Are your chromebooks clearing profiles on every login? This usually means more files pulled down on boot.

[ssouth]

Definitely log with support.

Are your chromebooks clearing profiles on every login? This usually means more files pulled down on boot.

 

Hi

 

No we don't clear profiles. We have our smoothwall support through NYES, but I'm quite happy for you to get involved.

 

This morning Resource Usage on Smoothwall box has gone above 14! - why would that be?

 

To me everything seems to point to the cloud filter - but very happy for someone to find some other issue.

 

Regards

[Joeloman]

Hi,

I don't know what the settings look like in an S9 but increasing the SYN backlog queue size usually helps a bit...

You can find the setting under Network-Settings-Advanced

 

Even upgrading to Maiden can help, if they don't already have it..

[ssouth]

Hi,

I don't know what the settings look like in an S9 but increasing the SYN backlog queue size usually helps a bit...

You can find the setting under Network-Settings-Advanced

 

Even upgrading to Maiden can help, if they don't already have it..

 

Hi - yes it is already on the max value.

[simpsonj]

If you goto Smoothwall - Guardian - Cloud filter, do any devices appear in the Current knocks?

[Joeloman]

Have you tried dual filters?

By turning off Secret Knock.

 

A Proxy helps with low bandwidth and many users on the same pages..

[ssouth]

Hi - Yes - all ip addresses relating to the Chromebooks - all looks good there.

[ssouth]

Have you tried dual filters?

By turning off Secret Knock.

 

A Proxy helps with low bandwidth and many users on the same pages..

 

Hi - tried the secret knock on and off - not a massive difference though possibly worse with the secret knock on.

 

Not looked at channeling them through a proxy - never had to, and never had an issue when we used the connect for chromebooks app.

 

An option though - thanks

[Joeloman]

Connect uses MobileProxy.

 

Have you now switched to Maiden where Connect is no longer available?

If not, I think a move to Maiden would make a very big difference.

[simpsonj]

Just for comparative reasons, we're a 1:1 device school with Chromebooks and using Cloud filter and onsite Smoothwall S9, roughly 750 devices connected and our current load on the Smoothwall is 1.70

 

Edit: Running Maiden-21, though we didn't experience any issues whilst on Leeds.

Edited October 8, 2024 by simpsonj

[Joeloman]

Have you checked how DNS is set up?

You should use "System internal DNS server" to save bandwidth and make surfing faster.

 

Also check different response times regarding different DNS forwarders.

Sometimes the ISP is significantly slower than e.g. Google 8.8.8.8 or Cloudflare 1.1.1.1

[ssouth]

Just for comparative reasons, we're a 1:1 device school with Chromebooks and using Cloud filter and onsite Smoothwall S9, roughly 750 devices connected and our current load on the Smoothwall is 1.70

 

Edit: Running Maiden-21, though we didn't experience any issues whilst on Leeds.

 

Hi

 

Thanks for that. I'd be very interested to see what your smoothwall access and firewall rules are relating to your chromebooks.

 

I'd be very grateful if you could PM a couple of screenshots.

 

It seem to me that for whatever reason the VLAN chromebook \ Secet Knock traffic is being just not being processed the same way that standard LAN \ other VLAN traffic is.

 

A simple test of that is pings to the smoothwall when a lot of student chromebooks are connected - >250ms from the student chromebooks | <1ms from everywhere else.

 

Thanks in advance

[tom_newton]

Can you pass me your ticket # - [email protected] - and I will keep an eye on it!

[Joeloman]

We have seen many systems where it is something other than Smoothwall that is at fault when there are long response times on just one network..

Everything from switches to AP points with too many users..

 

Also DHCP problems with too short Default lease time as well as other Broadcast problems..

 

Try resetting the switch and the AP points and check the traffic with Wireshark if there is anything strange on the network...

I have also seen that the switch has been set to 100 Mbit/s on some ports....

[ssouth]

Can you pass me your ticket # - [email protected] - and I will keep an eye on it!

 

Thanks - I have emailed you.

 

Regards