LGfL 2.0 Problems

[ict_support]

I use BT, (CN21 )

 

I am not based in the LGFL area, we moved away from YHGFL.

 

In just over two years I have had zero down time in terms of Internet connectivity. The cost savings were a bonus; it’s the flexibility / time saving/ reliability that have made such a difference to the schools that I look after.

[strawberry7]

One of my schools is going over on 29th and we are trying to retract the ones that have not had any work done.

 

We have been in contact with Brian and he has been very quick to respond and detailed in his answers but it hasn't really done much to address our concerns. For example we asked about potential port unblocking rejections for other email providers and his answer was essentially 'use staff mail'. We asked about Logmein and his answer was 'use the alternative'. We asked about filtering and he sent us a link where apparently ‘Ticking the box below will remove your school from LA filtering control and prevent their settings from affecting your school.’ This link didn't work for me though (maybe because I am not a head teacher or because the school has not migrated yet. Other than this he kept pushing the courses but who is going to pay for my time to attend. Also, I have to attend the one about the USO system (which I have been using for years and already know) in Kent before I can attend the one on filtering. I have a full week, working all day and most nights, I don't have time to attend courses on anything, let alone stuff like this. Taking a whole day out to learn about a filtering system seems like a huge waste of time to me.

 

My point still remains - Whatever LGFL say, there is going to be work involved in making our system anything like it currently is once we have migrated. This work takes time and time costs the school money.

[psydii]

You make your point re conversations with Brian very well. I think the filtering option didn't work for us until we moved over.

 

It sounds like you are stretched too thin for your sites to manage a reasonable rate of change. If you cannot get time for training something is very wrong.

 

There is work to be done and before any change the key stakeholders should be fully trained. Generally the work is not too onerous and it has been well signposted for many months. Most Secondary School LANs I have seen are of two broad types: rely on the LGfL assigned subnets - in which case just get your MIPs right, remove proxy entries and you're away, or they have their own firewall and subnets behind that, in which case DNS and SMTP and the 'external' IP interfaces of the firewall need to be added to the list.

 

1 day planning, 1 day implementing. 1 day supervising the various elements of the install.

 

Compared to BSF this is a walk in the park.

[strawberry7]

Thanks

 

I am stretched thin but I am on my own with a small business and I am at that critical expansion stage where I have to balance not turning work away with meeting customer expectation. In order to keep my service levels to the standard I expect of myself something has to give and that is my own professional development at the moment hence, no training for me. Moreover, I don't see why I should take time out of my day and burn Diesel to go and have training on something I am not interested in, don't want to be a part of and don't think is appropriate for my customers.

 

I don't support secondary schools, only primary. The thing to remember is that we are at the mercy of Atomwide in some respects. A colleague of mine at a school which has migrated submitted a request to have ports open for other email, such as Gmail and Hotmail. Atomwide simply said no.

 

To be honest, I would probably find something like BSF more interesting and engaging but I don't envy you

[hit]

The thing to remember is that we are at the mercy of Atomwide in some respects. A colleague of mine at a school which has migrated submitted a request to have ports open for other email, such as Gmail and Hotmail. Atomwide simply said no.

 

To be quite honest, I wouldn't advocate the use of personal mail systems such as hotmail/yahoo/gmail for school correspondence. Atomwide in their defence does provide a pretty good mail system in StaffMail which although has its problems is pretty adequate for a primary school. As a parent, I would consider it more professional to receive an email from [email protected] instead of [email protected]. If these accounts aren't being used for school correspondence then perhaps they shouldn't be used in the workplace anyway.

 

Anyway, hotmail/yahoo/gmail is available after you migrate to LGfL2 but only with the web interfaces, you can allow the policy for "web email" in the local categories section of webscreen2 on the support site, you may have to opt out of LA policies first if they deem to have them blocked.

[strawberry7]

I totally agree with you but it isn't always as black and white as that. Consider a staff member using their personal iPhone or iPad (protected with pass codes of course) to check their staff mail. Isn't it nice to allow them to check their personal email through the school network at the same time? Without them having to constantly switch to 3G? What is the problem if they do?

 

Consider also the situation where a school wishes to host their own domain through Google apps (as I do for my business). What about a situation where a school is using a Google calendar system and takes advantage of Google's exchange sync options for the iPad? Would this need a MIP request?

 

What about head teachers that communicate through their personal email systems sometimes because they are friends as well as colleagues. As I am sure you find yourself, not everything in a day to day work environment can always be separated so clearly from 'work' and 'personal'. I still come back to what I have been saying all along - what is wrong with the existing system that we have all been using for years?

[Nodrog]

I had the same thing with Google Mail in an Apple based school - the trick here was to specify the ranges to talk to and I believe LGfL now have a range of address and ports that they open up to support Gmail via an ipad and all the other stuff.

 

I think the trick here is never to ask for a firewall rule that involves the word 'any' in it that’s what LGfL don't like - the moment you are specific about rules then it all starts to happen - can't really argue with that - opening everything upon a network to the internet is a bit dangerous and it dose not take much effort to work out specifically what you want to talk to.

 

What was wrong with the existing system ?? That’s easy - can't you remember in LGfL 1 when the whole network came to a halt on how many occasions because the core single firewall was being attacked by some random hackers from miles away or when outbound email was trapped because a workstation in a school was infected and spamming the universe which got the whole wan added to global spam lists or again when the core firewall fell over because an entire LA was firing conficker at everything ..... That’s what was wrong with the existing system and why there are firewalls and security all over the new system.

 

Security is a good thing when it's deployed carefully and making use of the technology available - it's a bad thing when short cut's are taken to make a quick win that looses in the long run.

 

BTW - VNC - this runs down RAV3 perfectly well

[psydii]

What was wrong with the existing system ?? That’s easy - can't you remember in LGfL 1 when

 

Oddly no i can't, but that returns me to my comments about thier opacity. However I have bought into their logic.

 

As for head teachers using thier personal emails - I draw your attention to exibit a BBC News - Michael Gove loses 'private email' battle

 

S7 have you considered that the pan-london shared services and USO system of LGfL could be saving you a lot of work - and give you capacity to take on more clients? Sophos, Netsweeper, Live@ are all properly world class solutions. If you operate in London then consider the net benefit to your clients in having the same systems across not only the sites you look after but also those that you don't?

 

I appreciate that it isn't the sexiest service around, but by being able to represent a number of schools who can be presented as 'wanting to engage' you can gain leverage with Brian et al.

[strawberry7]

I had the same thing with Google Mail in an Apple based school - the trick here was to specify the ranges to talk to and I believe LGfL now have a range of address and ports that they open up to support Gmail via an ipad and all the other stuff.

 

I think the trick here is never to ask for a firewall rule that involves the word 'any' in it that’s what LGfL don't like - the moment you are specific about rules then it all starts to happen - can't really argue with that - opening everything upon a network to the internet is a bit dangerous and it dose not take much effort to work out specifically what you want to talk to.

 

I totally understand what you are saying although when I asked Atomwide how to construct the MIP request once we migrate, they did say to specify 'any'. Are you talking about being specific with the internal IP section?

 

What was wrong with the existing system ?? That’s easy - can't you remember in LGfL 1 when the whole network came to a halt

 

Can't say I remember that specifically, although we did have times that our connection went down for a while. I kind of came to expect th

 

Security is a good thing when it's deployed carefully and making use of the technology available - it's a bad thing when short cut's are taken to make a quick win that looses in the long run.

 

I totally agree with you. When I think of security, I always think of the old saying 'the safest computer is one that is switched off'. I find that security and usability are almost always at war, it's about balance.

 

BTW - VNC - this runs down RAV3 perfectly well

 

Can you do that with an iOS device? I have used VNC on my iPad and iPhone and found it a bit rubbish compared to Logmein to be honest but then I am used to Logmein

[strawberry7]

As for head teachers using thier personal emails - I draw your attention to exibit a BBC News - Michael Gove loses 'private email' battle

 

I think you maybe misunderstand my previous statement. I am not talking about head teachers wanting to evade any 'official channels' I am only talking about ease of getting jobs done. A head teacher might drop a personal email saying 'how was your daughters play last night?', they might then engage in a friendly conversation and then the replying head might mention an AV system in use at the play and ask the other head if they have something similar in their school. This conversation has now started to branch into work/school related topics. It is a little far removed from what we are talking about here but friendly chat between people during work time isn't always a 'waste of time'.

 

S7 have you considered that the pan-london shared services and USO system of LGfL could be saving you a lot of work - and give you capacity to take on more clients? Sophos, Netsweeper, Live@ are all properly world class solutions. If you operate in London then consider the net benefit to your clients in having the same systems across not only the sites you look after but also those that you don't?

 

Oh, please don't misunderstand, all of my schools do use LGFL services right now. I totally understand the ease as an administrator of using standard universal tools, such as all my schools using Logmein. I can grab my iPad, hit the app, be in a server within 20 seconds, check what I need to and get out. I understand that LGFL systems can provide similar experiences, although products such as Sophos still have a couple of simple things to do that would make administrators lives a lot easier. I have to put my customers needs before my own though and initially I was very keen for all of my schools to pick up the service. If I am going to have a situation where the day after we migrate, 90% of my teachers have at least 1 lesson out of the window due to YouTube being blocked for example, then that is a situation I (and they) don't want.

[Nodrog]

 

Can you do that with an iOS device? I have used VNC on my iPad and iPhone and found it a bit rubbish compared to Logmein to be honest but then I am used to Logmein

 

I've never tried that but all the bit's are there - in theory - I've always just done RDP as just about everything has that capability - obvious down side is you can't show people at the other end whats happeing which VNC would do - need to be careful with VNC to get the right versions to make it all work the 'Cisco' way (!"£$)

[strawberry7]

Well, my first school has migrated over. Although it is not as bad as I thought it would be, it is still going to cause disruption plus the system is so over the top and complicated. I want to just go in to Webscreen 2.0 and add sites to an allow list but no chance. After reading most of the 21 separate support articles (does Brian think we have nothing better to do) I am still non the wiser as to how this system actually works. The trouble is that all the documents just talk about how to impose more restrictions (for obvious reasons I suppose) which is the opposite of what I want to do.

[nicklec]

Well, my first school has migrated over. Although it is not as bad as I thought it would be, it is still going to cause disruption plus the system is so over the top and complicated. I want to just go in to Webscreen 2.0 and add sites to an allow list but no chance. After reading most of the 21 separate support articles (does Brian think we have nothing better to do) I am still non the wiser as to how this system actually works. The trouble is that all the documents just talk about how to impose more restrictions (for obvious reasons I suppose) which is the opposite of what I want to do.

 

There is a free training course...

 

... but the answer to your question is that there are 'whitelists' everywhere there are 'blacklists' however as we may end up doing you need to get away from the very broad policies that can filter down from your LA.

[Nodrog]

Absolutely have to start by choosing your own filter policy - by default you get the uber-safe LGfL policy which is great if your a primary with no idea but not any good to anybody else.

 

Like Niclec says there are also training course that are well worth the effort. If you have a pile of schools to do sort one of them out and then ask the help desk guys nicely to copy that policy against all the other schools as they come on line.

 

Plus theres on-line help as well rather than emails from LGfL about what can be done ....

 

https://support.lgfl.org.uk/secure/guide/WebGuide/Help.html?webscreen2.html

[strawberry7]

Thanks for the pointers guys. As I mentioned earlier, I am rammed with actual work and so don't have time to go off on a jolly to Kent for the USO course (which is pointless for me but you have to do it to get on the web screen one) and then off to wherever for the web screen course. I simply don't have any time in my week. Secondly, I don't see why I should spend the money going to a course that neither I nor the school have any interest in because we don't actually want this filtering system. Finally, why has this system been made so complex that even IT pros need an entire days course to learn how it works? I didn't go on a course to learn how my iPhone works, or my iPad, or my MacBook, or any of my Google apps, or Windows 7, orActive Inspire. Have I made my point yet lol

[psydii]

I'm not sure that the netsweeper training is necessary - unless there is some super secret stuff out there, it is pretty straightforward and everything needed to get a competent SysAdmin started on it is delivered in the NomCon training day (MeerkatProTip: start at the top of the menu and work your way down. Simples! It really is just a new UI on the same Netsweeper backend). I really do think that you have to make the time to attend a NomCon day, your customers have chosen the service, and it is critical to the delivery of their primary function. The vendor is offering you (another comercial entity) FREE training on their product to allow you to better understand their product and support your mutual clients. There is also an opportunity for networking with the Atomwide team and other London technical (and perhaps more crucially, non-technical) staff which is what opens doors for the future.

 

Going by something you said earlier you are prepared to work well outside the 9-5 to get your business through this initial growth period. As such, perhaps you could negotiate Saturday access with one of the schools in lieu of the day taken for NomCon training? I really cannot express any more strongly how worthwhile you can make this be (even if you know 90%+ of it already).

 

For the record we have a TMG behing the LGFL system. We make use of both filtering services. If I were building a green-field site I would be strongly tempted to just use Webscreen on its own.

Edited July 3, 2012 by psydii

[strawberry7]

Thanks for the input. My customers didn't choose this filtering service, it was thrust upon us by LGFL. As for it having a different UI, that might be true but I have never used Netsweeper, so it is brand new to me.

 

I do understand what you are saying about the training, it's just annoying when I don't go to sessions that I am interested in (and actually benefit a school) but am now faced with being forced into one that I have no interest in attending at all. I understand also about networking but I can do that myself, I don't need an LGFL training session to do that. Equally, I predict that this session is going to be 90% commercial rubbish and 10% golden nugget information will just anger me further.

 

We are attempting to back 1 school out of LGFL 2.0, if that works, I am simply going to get my other schools to do the same as I, nor my customers, want to be in a situation where we are told by Atomwide or LGFL what we are and are not allowed to do.

[strawberry7]

On a slight side note but related to LGFL 2.0, I have just been sent an email and apparently the LGFL USO-FX system has ground to a halt as the 2GB online allocation is nearly full. They are blaming staff for not deleting documents quickly enough. 2GB between 70 schools. Well done LGFL.

[kearton]

My customers didn't choose this filtering service, it was thrust upon us by LGFL.

If you wanted, you can switch OFF *nearly* all the filtering.... there is a small amount you can't switch off, such as Remote Support Tools sites and those they are required to (by law, presumably?) such as those about paedophilia etc.

 

Equally, I predict that this session is going to be 90% commercial rubbish and 10% golden nugget information will just anger me further.

I found it to be about a 90% useful and 10% rubbish (e.g Sales talk about their other products)

[Nodrog]

On a slight side note but related to LGFL 2.0, I have just been sent an email and apparently the LGFL USO-FX system has ground to a halt as the 2GB online allocation is nearly full. They are blaming staff for not deleting documents quickly enough. 2GB between 70 schools. Well done LGFL.

 

Isn't USO-FX meant to be a file 'transfer' system rather than a 'storage' system ??

[strawberry7]

Isn't USO-FX meant to be a file 'transfer' system rather than a 'storage' system ??

 

Yes it is but the system stores the documents for a certain amount of time. It hasn't been designed properly, so you have to decide when you upload the document how it is deleted later down the line. It would have been far better to just make it so that initially it auto deleted the document once it had been received by all parties in my opinion. Even if it is just a transfer system though, 2GB is pathetic these days.

[strawberry7]

You're better placed to comment than me as you have clearly been on the course. I am just going on 3 things, the Fronter course, pointless, other teachers experiences of previous LGFL/LA related courses, pointless and finally some presentation of theirs I found which had a whole load of Disney quotes on it or something, again pointless.

 

If you are referring to 'opting out of the LA filtering' then we have done that but it still blocks YouTube, Facebook and Twitter to name a few. I don't think there is any legal requirement to block remote tools such as Logmein, after all a school could have their own connection and use these tools. Not to mention the fact that ICT support companies have been using these tools for years in schools without a problem.

 

The rational from LGFL was that tools such as Logmein are unaccountable because they do not require an individual login, such as USO. So say I employed somebody, they got arrested, I didn't change my Logmein password, they could still get into the school. I totally agree with them, that is a possibility. Personally, if I had been LGFL, I would have put the responsibility back to the company using Logmein (or similar), just as it is that companies responsibility to make sure that arrested employee didn't still have a key fob for the school (a MUCH bigger risk).

 

Following on from this, you could say that said employee works in ICT, so they know their way around a computer. Who's to say that they haven't installed a key logger on their bosses computer and got his LGFL USO information? In which case he can go about totally unnoticed and worse, nobody may realise he is logging in as his boss whilst he is arrested or whatever. What about OTP from LGFL I hear you say? Well what if he has stolen the bosses fob? Sure the boss would report it stolen but if he is that responsible and on the ball, wouldn't he have changed the Logmein password if he were using that system?

 

You can go on and on with security and as somebody mentioned way back in this thread it needs to be a balance. I don't want to hijack this thread anymore than I have already and I feel I have made my points, so I'll leave it here.

[Nodrog]

Yes it is but the system stores the documents for a certain amount of time. It hasn't been designed properly, so you have to decide when you upload the document how it is deleted later down the line. It would have been far better to just make it so that initially it auto deleted the document once it had been received by all parties in my opinion. Even if it is just a transfer system though, 2GB is pathetic these days.

 

and you can set that - it's done at LA Level NOT LGfL level - have you asked the LA concerned to make that change ??

[strawberry7]

This was just an email I was copied in on and somebody from LGFL was reporting that the 2GB limit had nearly been reached. I am not going to ask them to make a change, I encourage my schools to avoid the FX system as it is clunky and restrictive. Plus it could fall over as it is currently doing. Why is the LA setting size limits on their FX system when it is provided by LGFL/Atomwide? Haven't LGFL given out a certain amount of space to each LA? I can't imagine an LA voluntarily taking less space for their FX system? Or are you talking about the document handling side been set by the LA?

[Eric]

If you are referring to 'opting out of the LA filtering' then we have done that but it still blocks YouTube, Facebook and Twitter to name a few.

 

You really need to create, and use, your own filter set(s). When you do this, none of YouTube, Facebook nor Twitter need to be blocked.

 

I am afraid that you are doing yourself no favours by refusing to go on the filtering course.

Edited July 4, 2012 by Eric
style!