Blue_Cookeh

@SchoolsBroadband - is there any chance that transparent filtering is going to make a come back ala Lightspeed style? We're still quite impressed with the NS solution after the LS debacle. Netsweeper and transparent proxying would be a dream at this point

As much as they can fit onto their laptops and still have OneDrive sync it into Office365

Also be careful because it depends on what you're licensing. We're licensing our usual Core CAL pack/Windows/Office/whatever on the FTE (200 hrs with use of a computer) whereas when looking at products like InTune it seems to be all staff.

Hey guys, Just looking into a cloud-based PBX solution that would tie in nicely with things like Skype for Business etc and Office365 seems to be the obvious choice. Is anyone using it and can you comment on your experiences? How are you handling phones in shared areas like staff rooms/meeting rooms? Do you have physical phones or just use SfB? Any opinions and experiences welcome

And a few shady big names keep trying to push their own patented technology into the IEEE standards, thankfully failing thus far... being on a standards body doesn't mean much nowadays.

Same - we terminate them into an Avaya IP Office system just fine.

Yeah I think it's Ruckus only... although judging by their website that might have changed, their video suggests it works across 'different vendor networks' so might be worth talking to them. The way it worked when I deployed it years ago was users would download the XpressConnect app which would join their device to a hidden Enrolment network, the user could then login with their usual credentials, then the app went off and requested a device certificate from your internal CA and setup a connection profile on the device before removing the Enrolment network - that way the device was setup with barely any user interaction and they were always fully authenticated on your network. Aruba ClearPass contains similar functionality (amongst a ton more) that I've heard is very good. It wouldn't surprise me if Cisco/Meraki had one either but I don't have any experience with the software side of them unfortunately.

Meraki make you pay for their shiny management interface Cisco use their name to buff their price up Aruba have extra features like ClearPass Ruckus is touting their centralised controller solution as being the best and being worth of $$$ UniFi is bare bones, limited support, yet the same hardware as everyone else. Wireless networking is rarely about the hardware these days but more about the software features and underlying firmware implementation - most of them use the same Wireless hardware from the same first party manufacturers underneath. UniFi are cheap enough to keep a 5 pack of spares on the shelf and are a young enough company that they can rapidly develop their software unlike the other dinosaurs.

I blame @Simcfc73!

I think we need to see a bigger picture of your network - if you could amend your diagram to add any other switches and a client PC as an example that would be helpful. We have two WANs like you but we terminate both ISPs into a Sophos UTM (via separate VLANs) so the clients never have to change their routes - our UTM manages it automatically when it detects a WAN link is down. The way you'd introduce redundancy into that is to get a second UTM/router and enable the proprietary HA or use virtual IPs/HSRP. The only way I can see your method of working at the moment is if all your clients pointed to a L3 switch or another router which could then make the decision on whether to send traffic via the Smoothwall or USG. Don't forget that both Smoothwall and the USG are going to need to know how to get back to your internal subnet if you actually do have a L3 switch in there, so you need routes on the L3 switch *and* the routers.

tbf I got a USB OTG cable from one of their stores for about £3.50 (down from about £12!!)... certainly beat waiting 6 weeks for one from China!

We found that Xibo, Screenly etc never quite did what we wanted or seemed to be overly complicated. Nowadays with the sort of technology available on the web it seemed silly not to just do it ourselves. I setup a web page on one of our webservers exactly how we wanted it, using Javascript and PHP to pull in data from all sources like Integris, BBC news, weather etc. Now we just have Chrome automatically open on boot and display this site If you know HTML/CSS/JS/PHP it's the way to go IMO, it removes all the reliance on external services.

We've got a 2530-48G-PoE+ in our cabinet in our main office - it's not silent by any means but it's far quieter than the 2920-48G we've got in our main hall cabinet. If I added some foam sound proofing to the door of the cab it'd probably make it near silent.

Basically... nope. Apple have such tight control over the hardware now it's basically impossible to do anything like that unless someone finds an iBoot exploit.

Why? I don't expect gov.uk to be hosting porn anytime soon, pick your battles and all that

This was going to be my suggestion. I would look at using something like https://www.ruckuswireless.com/products/smart-wireless-services/cloudpath - I really like the enrolment process that XpressConnect gives users.

Have to just chime in and say our experience of SB has been *far* better so far now that we're on Netsweeper.

You get what you pay for... we found Lenovo X/T/Yoga series are built like tanks, warranty support is amazing, and they're dead easy to manage. Depending on the model we would expect to pay 7-800 for a laptop with 5 year warranty, i5 or better, 8GB RAM, 250GB+ SSD and 13 or 14" screen (possibly touch). Parts are incredibly easy to source out of warranty too.

Yeah - technically it's too damn awkward to solve on iPads, especially with the likes of certificate pinning in apps now. Generally teachers assign an iPad's asset tag to a student at the beginning of the year. We're all talking about meeting PREVENT etc on Edugeek but I do wonder how those small primary schools in all the villages are meeting it since most of them won't have dedicated IT techs or education-focused IT companies.

The government don't know what they're doing. I don't mean to offend anyone but they're all old farts that don't have a clue about how the technology works, and they refuse to take any advice from people that do. No government should be meddling in the fundamental ways in which the Internet and the Web works (it's inherently impossible to do, the Internet is a global network) - perhaps parents should learn to parent properly instead of keeping little Johnny quiet all evening by sticking an iPad in front of him?

How are you expecting the iOS clients to authenticate to the authportal, out of interest? It was my understanding that the authportal would only work with clients that supported Windows SSO. We just stuck all our iPads on their own subnet which is then forced onto a pupil-level filter with no authentication, connectivity is instant.

Have you used the Log Viewer on the Sophos XG with a filter for a test client's IP? This should tell you exactly what is being blocked and by which firewall rules.

I just recently got my self a Hyundai i20 Premium Nav 1.4 auto - I'm very pleased with it and would highly recommend so far. I think you'd be very happy with an i30 or similar

Everyone on same domain - users with old addresses have them added as aliases so they continue to receive old mail but anything new going out is sent via mat.co.uk

This is what I'm thinking of doing - I created an AD user called ipads-student and then created a new WiFi profile in Meraki MDM that included the username/pass and details for our RADIUS SSID - my test iPad seemed to pick it up and automatically connect OK. I just haven't gotten around to implementing the VLAN bit yet! I haven't got an Android device to try out yet though, and I'm a bit conscious of the password for the iPad user account getting out, expiring, or being changed. If the password ever expires then all the iPads are going to lose connectivity and it's going to be a manual job to go around fixing them all. On our computers they authenticate using user details or fall back to machine authentication.