Blue_Cookeh

Do you mind me asking, what RADIUS server are you using to assign the VLANs (it sounds like Windows)? I'm looking at doing something similar to try and get rid of our 'mobile' SSID that we stick all our iPads onto so I'm looking at doing something like this either via MAC address or maybe looking for a specific iPad AD user. At the moment we're feeding our main data SSID from Windows NPS but it looks as if something like FreeRADIUS might be more flexible so I'm interested in what others are using!

Bingo. Trunk port to the AP, untag whatever VLAN you want the AP to communicate on, tag the VLANs for SSIDs. We've bought ours through Millgate, 4Gon, and VeryPC before. UniFi only allow 4 SSIDs though - not a bad thing necessarily due to performance degradation with multiple SSIDs.

You're bang on with all that IMO - with the likes of certificate pinning coming in I don't see filtering as we have it today existing in 4-5 years time. Cell blockers wouldn't be any good either, we have alarms, machines etc that rely on the cellular network, plus they're a good emergency alternative.

You might be interested in this thread: http://www.edugeek.net/forums/internet-related-filtering-firewall/191937-janet.html

Don't know about Chrome specifically but we push out the wpad settings with our wireless network config in Meraki MDM and Chrome etc seems to work nicely. It also seems to let me set it to Automatic and leave the URL field blank.

I could certainly do with taking a couple of the 2530-24G-PoE+ J9773A off you!

We're petty strict on them - it gives parents and visitors who might not know everyone something to look for if they need a member of staff for some reason. Visitors get a printed badge courtesy of our Inventry sign in system.

You can't possibly process data from that many schools as an individual - we never received one of your requests (assuming because your data source isn't up to date) so your logic is flawed anyway.

We're still running the original first generation UniFi access points and haven't seen any of the problems people mention about new firmware etc. They're still getting updates and they're coming up to 6 years old now in our environment. I'm replacing them with UAP AC Lites this FY - only because we want 5GHz and AC, though. Would thoroughly recommend Ubiquiti over the big players nowadays, even if something goes wrong with the hardware they're cheap enough to have a couple sitting on a shelf to swap over. RADIUS authentication and VLANs work fine. I'm still not convinced on their security appliance or switches yet - we're using a mix of Juniper and HPE/Aruba for that. I'd be shocked if a school could saturate newer generation hardware - I don't see a need for 2.5/5Gbps access ports in schools yet, not in our LA anyway. In terms of the controller we run our's on site in a virtual machine but you can either use Ubiquiti's own cloud controller, or host it yourself up in Azure/AWS/Google Cloud etc. There is only very basic and community support out of the box, but Ubiquiti do now offer an 'Enterprise' support service that you can buy.

You do realise if you expect schools and other public bodies to expend time and energy responding to your FOI requests, we expect you to put some in too? At the end of the day the fact you fired off the same request to 20,000 establishments isn't our concern!

I can't say our school would ever reply to such a large FoI request such as this one through somebody else's web form as it is. Either provide an official means of communication (not a 'noreply' address) or don't bother at all. We need to be able to easily file our response away in the format that we sent it to you - a web form does not fulfil this requirement. You could easily have used an Excel or Word template that you had sent out to keep formatting relatively similar across sites which we would have been OK with providing they didn't do anything particularly fancy (which our mail system would block as it is).

You guys are all pinging 8.8.8.8 - this is a bad idea and wont give you a reliable indication of your connection working. Google drop non-DNS traffic to these IP addresses often and depending on their network load.

If it's any use their site gives me a certificate error on my home connection! Their site is using a self-signed certificate, so no one will trust it by default.

FWIW we found the SMART displays much more polished and user friendly (also cheaper) than the CleverTouch ones anyway. Haven't tried other brands. I think it might have actually been @VeryPC_Ross that originally sold our school on the newer SMART displays...

That's not a bad idea - I'll see if I can get one to play with!

SSL inspection is probably what's killing your bandwidth unfortunately - most appliances will have this problem. I hated Smoothwall when we got a quote from them. It was 3x more expensive than everything else and their feature-set wasn't that brilliant. I like Sophos UTM/XG personally. Decent filtering, decent price, decent support.

The help desk fixed it very promptly after I told them it still wasn't right, thanks! As far as migrations are concerned I'm pretty pleased with it. Staff came in this morning after I'd flipped them back over to SchoolsBroadband last night and no one has complained about anything breaking. Computers are all proxying correctly and it looks like filter profiles out of the box are pretty good.

I was working on the assumption of hardware lasting 5 years - at the moment we might get 5 years out of laptops if we're lucky but they start to show their age pretty quickly when you're talking low end models like schools buy in bulk. In terms of Safe Harbour etc does it make any difference? I suppose it depends on the services you're using but I'm imagining MS Office suite integrated with Office365 (which is GDPR compliant as it is) - we disable all iCloud functionality in our MDM for both teachers and staff.

This is probably a highly controversial subject but I'm just wondering if there's anyone out there that has done this? We've got an ageing population of computers in a couple of our classrooms and it's going to be astronomical to replace them with anything decent. I've got around 50 machines that needs replacing that looks as if it'll cost around £15-17,000 to do in the best case scenario. Now I'm thinking that iPads with a keyboard would provide a better solution. They'd be slightly cheaper, they have an (arguably) longer life span, are instant-on in classrooms and there would be minimal licensing costs involved vs our current Microsoft Desktop pack. We're already using Office365 and redirect all documents etc into OneDrive. Has anyone done it? Do you have any gotchas? These wouldn't be a 1-to-1 deployment, but I'm thinking carts of iPads could in theory work a lot better than traditional Windows PCs, especially in schools with decreasing budgets. This would mean the only Windows machines we have to support are a couple of servers and the teacher's devices (I don't think iPads would cut it for teachers/admin staff). I'm almost certain this question has come up before!

I have to say we had two e-mails regarding Lightspeed upgrades - one at around 5pm on Monday 5th and an update at around 2pm on Wednesday 7th, so there was plenty of communication from our point of view. @SchoolsBroadband is this all we're supposed to be able to see in NetSweeper? I don't seem to be able to add any allowed or blocked URLs anywhere or modify our staff/pupil/default web filter groups:

I'm in PAC and WPAD hell at the moment Can't get our Win10 clients to actually use the PAC file despite everything seemingly being setup correctly.

Do your user's internal UPN match your Office365 mail domain? Also since you're on Office 2013 have you looked at this? https://support.office.com/en-ie/article/using-office-365-modern-authentication-with-office-clients-776c0036-66fd-41cb-8928-5495c0f9168a We're using SSO on Office365 using Azure AD Connect and it's working fine with little intervention but we're on Office 2016.

You'll have to manually add the certificate to any BYOD devices no matter what wireless system you're using. You could use a HTTP captive portal (Ubiquiti will support this) with a customised landing page that provides a download to the certificate with install instructions. Personally I don't like doing HTTPS inspection on BYOD networks so we control access with voucher codes (only to stop the kids connecting) and just let the browser display an error page on blocked HTTPS websites. I believe products like Ruckus' CloudPath and Aruba's ClearPass provides this sort of more user friendly functionality, though.

Can confirm, we got UAP AC Lites over the Summer holiday and they were 802.3af compliant, and backwards compatible with Ubiquiti's janky standard. The UVC-G3 cameras are now also shipping as 802.3af compliant whereas they weren't before. I can't wait for April, I'll be ripping out all our first generation UAPs for more AC Lites, meaning no more inline PoE adapters cluttering up our cabs! \o/

We went through our migration today - many teething issues and we still aren't quite there yet (just a few config problems left I think) but all praise for SchoolsBroadband here. I think I've spent about 4 hours on the phone with Sean today, he deserves his weekend! Also preliminary tests make it seem like our speeds have improved a bit over Lightspeed.