DavidYoung

I work with @PaddyNewman at LGfL and wanted to update this thread with the fix in case there's any other LGfL (or other provider) customers experiencing a similar issue. Last year, a new technology called TLS-ECH (https://developers.cloudflare.com/ssl/edge-certificates/ech/) was rolled out by CloudFlare which hides the domain name from filters (all inline network-level filtering, not just ours). We quickly updated our DNS servers to counter this by removing the required HTTPS records delivered by clients and, more recently, blocking the underlying ECH domain (cloudflare-ech.com). This means that all LGfL customers using our DNS resolvers are fully protected from this bypass. Those not using our DNS servers (e.g. Google DNS, OpenDNS, etc.) will find sites that implement ECH aren't accessible as the protocol does not have a fallback. The solution here is for LGfL schools to make sure you're using our DNS forwarders (there are several depending on what YouTube mode you want). We also implement PDNS, safe search and other protections through our DNS servers. Making sure you are using HTTPS decryption is also important for proper filtering. Those using other network filtering platforms should check with your provider that they can properly filter ECH sites both when using decryption and when not. Hope this helps if anyone else has a similar issue. David

LiveRegister can do this. At my last trust, we had 2 secondary schools each with their own canteen but one catering company. We had 1 LiveRegister server which imported from both school MISs (SIMS then Arbor) and each school payment system (ParentPay then Arbor). Students and staff from both schools could purchase from each canteen. While the tills were separated into groups for each school, if they had just one physical canteen that would also have worked.

Hi, I would take a look at Bitfocus Companion: https://bitfocus.io/. It is a great bit of OOS for controlling lots of AV equipment. It's desginex around using the Elgato Streamdeck as a controller but also has timer based automation (triggers). Looks like there is a Sharp TV module: https://bitfocus.io/connections/sharp-tv. Hopefully will work with your model. David

Hi Koldov, Sorry to hear this is happening. Normal websites accessed through a browser shouldn't be showing as 'Host is an IP' which implies something Is going wrong with the SNI detection. Keeping Host is an IP blocked is always a good idea as it stops a whole load of potential backdoors, so I wouldn't unblock it to fix this. Do you have a case raised for this? If so can you post/DM the reference? Otherwise, drop me a email to SchoolProtect at LGfL . net. We'll get this sorted for you. David

Hi @Cat_Jam148 I'm leading on the SchoolProtect project. Can you drop me a DM with your school details. We'll get this sorted for you (and if I can't @PaddyNewman can when he's back on Monday). David

I checked on my iPad and got the same thing. It is definitely the Web Content Filter settings in Meraki as I took that off and was able to search for hot choc. Remember the filtering is managed by Apple so they may have simply added the term 'hot' to their denied list recently.

Sorry for not being so active on this thread recently. I changed jobs at the start of this year (not because of Arbor!) so haven't been as involved but I am trying to keep in touch with my former colleagues to see what's going on. We engaged with both suppliers (Arbor and Bromcom) extensively and had lots of demos from them. We did speak to some schools, including @supportman, who was very helpful, but I don't think we did a particularly good job of finding very similar organisations, i.e. MATs with primary and secondary and sixth form, ideally, with shared teaching across schools. I think this was mainly due to the time constraints placed upon us by a certain incumbent supplier... I think this is true and will become more true in the long-term. I maintain that this was the correct strategic decision and will pay off in the coming years. Just a word of caution that cloud-based MISs are coming at the problems from a very different angle and require schools to think about modern approaches to administration. And training, support, training and support for users.

Hi, I work for LGfL and look after some aspects of the web filtering. Can you drop me a DM with your email address and we'll take a look to see what we can do. Our schools have full control of their own filtering so are able to make exceptions for your app if it uses standard web protocols (i.e. https over TLS), however, if it uses non-standard ports then the school would need to make a firewall request for the port to be opened. Also, are you using your own domain name or an Amazon ones for all your communications? It's best if you have your own domain with subdomains as it only takes a single entry to allow the app. Drop me a message with your contact details and a link to the app and we can take a look. David

Ah, the Google policy probably doesn't process XHR requests then, only main/subframe requests which is actually the same as the on-device filter we operate for performance reasons. The other option would be to look at your network web filter. IF you have HTTPS decryption available, you could block that URL there.

I would suggest that is a bad idea and not great advice from Google! I have done a quick test with google search and it seems that trending searches are served from https://www.google.com/complete/search. If you add that address to the URL Blocklist setting in the admin console it should block the trending searches. Please test this before rolling it out as I have just quickly found it and don't know what impact it may have on other things but blocking it doesn't seem to break search. Information about the URLblocklist setting can be found here: https://support.google.com/chrome/a/answer/7532419?hl=en David

You can just use DKIM but the important part is Arbor need to turn on signing for your domain at their end. Once that is done it should all work.

When we set this up, we only added the DKIM records (the first 3 from your initial post) but we then needed Arbor to enable signing on their end once the records are in place. If Arbor don't make the change then the records won't mean anything. Once they have made the change you can simply revert the SPF record to what it was (just the Google one) as you only need either SPF or DKIM to pass (DKIM is better and more secure, if you haven't set up DKIM for Google I would suggest you do.). I would recommend signing up for MailCheck from NCSC: https://www.ncsc.gov.uk/information/mailcheck and setting up DMARC on your domain following their instructions. This will allow you to monitor all email coming from your domain to see what is failing (though it will take a few days for data to start being processed).

Hi @Chuckster I am an LGfL customer but am also working as a consultant for them with a focus on web filtering, so can see from both sides of this. It is annoying that you have to fit in with the IP addressing scheme and appreciate for new customers this can be a lot of work to change over. There are, however advantages of doing this. The main one is my area of expertise, Webscreen which need to be able to identify the traffic from the individual IP address to deliver per-user/per-device filtering and detailed logging. You absolutely can run VLANs on the LGfL network, 2 of my larger schools do. You just need to work with the support desk to let them know what the address of your internal router/L3 switch for the 'next hop'. Hopefully this makes sense. David

Hi Richard, Your story sounds very similar to us but about 1 1/2 years ahead. We're particularly interested in your journey with Edval and what you are using now (Timetabler?). We are struggling to get a working timetable out of Edval, regardless of the integration problems. Your comment about primary school functionality being prioritised over secondary school is fair and much of the system feels very much like it is focussed on how primaries work and the complexity of secondaries doesn't fit that well. I think part of this issue is that there are 6 times the number of primary customers (~3,000) compared with secondary (~500) so relevant features will get higher upvotes. It is also my issue with the survey linked in my first post from The Key as it does not split the data out by phase or perform any statistical weighting based on staff/pupil numbers, so the view from primary schools will always hold more weight. I also became so frustrated with being directed to the roadmap where functionality doesn't work (not feature requests but simply broken or implemented in an unworkable manner) that I preempted this response on one of my support tickets with our support provider (we are partner supported) that I would 'loose it' if Arbor came back telling us to raise something on the roadmap (I think that may have been around the time I started this thread...). I too had to do the post-16 census for two schools this year and it took days and days of work. I have never done it in SIMS (I am told it was a pain there too) but there are many ways that the Programmes of Study area in Arbor could be improved. We virtually had to manually go into each sixth form student to check and fix their programme enrolments. We are also finding the system unresponsive when dealing with large amounts of data, with more and more being added now we are entering assessment and behaviour data. I see the 'Sorry, something went wrong' message probably about 5 times an hour when using Arbor and I don't use it that much! Arbor as the solution to replacing external solutions is a sore point with us as they market the system as being able to replace all of the third party add-ons (we dropped ParentPay, Edulink One and Behaviourwatch), there is even a section in the onboarding process when they'll go through the apps and tell you which ones not to renew, but when we met with James a few weeks ago, the message was that they were not trying to be the best payments platform, parent app or behaviour management system, they are trying to be the best MIS (though with a fair way to go) and recommend integrating with external providers for 'best-in-breed' functionality. I'm going to send you a DM if you don't mind, it would be great if we could connect directly. David

That's weird, Wagent should send the logged in username to Webadmin to associate a client. What client name does it show on the block page, also, what Wagent settings do you have listed in the Google Admin console where the extension is installed?