mpe Posted December 2, 2008 Posted December 2, 2008 My job is difficult enough as it is without having to jump through any more hoops! It would have been better for everyone if the school(s) in question added rules to their local routers preventing unfiltered access and then tightened up on security. IIRC it was necessary to specifically enable the unfiltered proxy and firewalling was mentioned in the instructions. I also have an issue with making the unfiltered proxy become a filtered one. Rather than displaying an explanation page.
ICT_GUY Posted December 2, 2008 Posted December 2, 2008 Then you have issues like ensuring that none of these staff let kids know this information. But cover teachers can get hold of it. As well as it being an "all or nothing" approach. I'd also be reluctant to call something which only works in a few specific web browsers a "web interface" too. Agreed, does not like Chrome very much
mpe Posted December 2, 2008 Posted December 2, 2008 Would an aceptable way forward be to suggest that the unfiltered proxy is only available to specified IP addresses? This is apparently what they are offering as a "smartcache proxy". With some various hoops to jump through. However IP based restrictions are only of much use in the case of a workstation or dedicated device. As I have a multi purpose server I can completly guarentee that this won't be remotly secure. I've tried to explain that proxy authentication would be far more useful in this situation. But they don't appear to understand.
mpe Posted December 2, 2008 Posted December 2, 2008 Am I missing something here but can't you turn off the filtering lists on the normal proxy? We can here... Can't those of you who have your own filtering solution simply do that? The interface is rather clunky especially if you need to do this with a rather large set of URLs. Then there's the issue of if it dosn't like your web browser you tend to get something like "Browser: [Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.18) Gecko/20081113 Ubuntu/7.10 (gutsy) Firefox/2.0.0.18] SWGfL Filtering is only supported on Microsoft Internet Explorer 4 or above, on a Windows platform."
Heebeejeebee Posted December 2, 2008 Posted December 2, 2008 The interface is rather clunky especially if you need to do this with a rather large set of URLs. Then there's the issue of if it dosn't like your web browser you tend to get something like "Browser: [Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.18) Gecko/20081113 Ubuntu/7.10 (gutsy) Firefox/2.0.0.18] SWGfL Filtering is only supported on Microsoft Internet Explorer 4 or above, on a Windows platform." I think he means this page (attached) and not unticking them all one by one. HBJB
Heebeejeebee Posted December 2, 2008 Posted December 2, 2008 ... also RM are trialling outbound filtering at the moment so any site hosted by you (inside the SWGfL) will be subject to filtering. This means that your intranet/website/VLE may have pages blocked if the filter deems it undesirable. HBJB
mpe Posted December 3, 2008 Posted December 3, 2008 It is restrictive things like the above that puts people off the whole RBC thing in the first place. My biggest grip about RBCs in general is that they are looking at bolt on bits i.e. add-on to the services rather than looking at improving the the reliability of the core services i.e. reliable internet access, reliable web filtering and reliable email access and filtering. Providing some flexibility of IP address assignment or network design would also help as well rather than dictating what the school should use. If this break the grand SSO and Federated services (i will be suprised if RBCs get this done until 2012 if that) then be it and let the school become one of the identity provider in the whole SSO framework. Ash. Specific issues I have with the SWGfL are. They don't appear to have any plans for IPv6 support. Email delivery only to a specific IP address, I complained about this one back when they started up. If you have more than one H.323 video conferencing system they want you to point all of them at their gatekeeper. The idea of having an onsite gatekeeper to handle all onsite units dosn't appear to be something they have thought about. Having DNS records for your LAN on their servers. But being unwilling to configure their servers to be slaves so the data they contain dosn't follow the GIGO principle. (They appeared to get completly confused when I offered to send them instructions on how to do this). Effectivly they just havn't realised that both DNS and H.323 are designed to be hierarchical in structure. Connections between sites on the grid getting source NATed to 62.171.194.161. Which makes things both more complex and potentially less secure. They claim they can't fix things to have no NATing at all. All they can offer is to change what address things are NATed to, on a good day they might even consider setting something which has a DNAT to have the same SNAT. Again something which hasn't been thought about is people in secondary schools providing support to primary schools. Where the likes of VNC, RDP, SSH, HTTP(S), VoIP, etc can save time, money, shoe leather, petrol/diesel, etc. There is also the issue of roving technicians, teachers, etc who can need various VPN setups. "Change requests" virtually never happen according to the claimed timescale. Also they tend to get easily confused if the request just involves changing a firewall rule. Understanding protocols such as IAX and OpenVPN use UDP only also apparently causes confusion so they are apt to create rules for TCP as well. Fortunatly I havn't had to try asking for a an IP protocol other than TCP or UDP, wonder what they'd make of number 20 I've also stumbled over various things, notably firewall exceptions, which don't appear to be documented at all. The latest being the whole proxy mess. 1
mpe Posted December 3, 2008 Posted December 3, 2008 ... also RM are trialling outbound filtering at the moment so any site hosted by you (inside the SWGfL) will be subject to filtering. This means that your intranet/website/VLE may have pages blocked if the filter deems it undesirable. HBJB This would also be likely to mess up any access statistics. e.g. the output of webalizer (which produces lots of nice graphs from apache log files for anyone unfamiliar with it). Also they'd need to conduct a MITM attack on HTTPS.
seanmh Posted December 3, 2008 Posted December 3, 2008 Reading all the posts, from Emails I get and from other schools that I visit, I'm still glad I'm not on the SWGFL. Am I the only South West School not on it? They keep trying to persuade me but at the moment I'm standing firm, and they're not really doing anything to make me think otherwise.
localzuk Posted December 3, 2008 Posted December 3, 2008 Reading all the posts, from Emails I get and from other schools that I visit, I'm still glad I'm not on the SWGFL. Am I the only South West School not on it? They keep trying to persuade me but at the moment I'm standing firm, and they're not really doing anything to make me think otherwise. Who do you get your connection from? As schools are required to be on the NEN (it's been discussed previously on here), we're all kinda restricted to who you can use.
Heebeejeebee Posted December 3, 2008 Posted December 3, 2008 Who do you get your connection from? As schools are required to be on the NEN (it's been discussed previously on here), we're all kinda restricted to who you can use. Exactly. We expressed an interest in removing ourselves at one point but were told that all sorts of funding would be withheld and that we'd still have to pay for the service anyway since the LA had signed a contract on behalf of all schools (not that they asked us for opinions before spending our money for us). As a foundation school we 'should' have the ability to govern our own budgets but with this they have us over a barrel. HBJB
seanmh Posted December 3, 2008 Posted December 3, 2008 Exactly. We expressed an interest in removing ourselves at one point but were told that all sorts of funding would be withheld and that we'd still have to pay for the service anyway since the LA had signed a contract on behalf of all schools (not that they asked us for opinions before spending our money for us). As a foundation school we 'should' have the ability to govern our own budgets but with this they have us over a barrel. HBJB I'm in a foundation school as well. Been here 4 years now, when I first joined the SWGFL were trying to put their equipment in and I told them I didn't want it as the school already had a broadband internet connection and due to various issues didn't want a SWGFL connection at that time. Had to argue the toss with the LEA etc for a while but they haven't hassled me and allowed me to do my own thing (I've worked in education in ICT for over 10 years so had "experienced" the SWGFL). We don't get any funding for our Internet connection as such, but then we use a business connection ADSL (upto 20Mbps) which is a darn sight cheaper than the SWGFL and more reliable at the moment. There are a few "disadvantages" to not being on the SWGFL (cannot use our local support service online backup, and they cannot VNC into us to have a look at SIMS) - but thing that we have been able to work around. Still very much in contact with the person at the LEA who is responsible (been lumbered with) the SWGFL and I am still open to suggestions, and who knows one day maybe we will go with the SWGFL, but like I said at the moment I am standing firm.
manick Posted January 20, 2009 Posted January 20, 2009 Is anybody experiencing any problems with the swgfl's internet connection lately (trying to find out if the problem is internal, but nothing to prove so at the moment), ours occasionally grinds to a virtual halt for 5-10 minutes at a time. Before we were forced off the unfiltered proxy, we had no problems whatsoever, since then the internet is dog slow. Anyone?
DrPerceptron Posted January 20, 2009 Posted January 20, 2009 Yup grinding to a halt here too, though usually during lesson time, so I am dismissing it as people playing flash games.
mpe Posted January 20, 2009 Posted January 20, 2009 Is anybody experiencing any problems with the swgfl's internet connection lately (trying to find out if the problem is internal, but nothing to prove so at the moment), ours occasionally grinds to a virtual halt for 5-10 minutes at a time. Before we were forced off the unfiltered proxy, we had no problems whatsoever, since then the internet is dog slow. Their filtered proxy has had intermittent issues for years. Also since the unfiltered proxy has been "removed" they have been changing quite a few things behind the scenes.
TheScarfedOne Posted January 20, 2009 Posted January 20, 2009 We had issues the other day - cut off all our external services. It seemed to be painfully slow browsing anything for the past few days.
DrPerceptron Posted January 20, 2009 Posted January 20, 2009 the beginning of their 21st century network? I must admit, it suddenly got quicker if I quit IE and went back in, likewise, it did pick up by the afternoon.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now