ICT_GUY

My thoughts too.

Just been sent an email from the new head saying to give them full superadmin rights to our google workspace along with himself. This is for setting up goolge education plus. No its not phishing fromthe heads email. However it really does not sit well with me and any feedback welcome.

We have not done shared mode at the moment. For a number of reasons. Mainly down to having hours cut while work load increased. Also doing the systems managers role but being paid as a senior IT tech while having a primary school network the size of a secondary school with just myself doing everything term time only. Anyhow rant over. I will have to look into setting it up. I will look into SafetyNetGo as well. I take it that SafetyNetGo pulls the users apple id?

Not yet. Honestly I have been sent the mother of all BS excuse responses today. Funny enough asking me to run the speed tests directly on the router using a linux laptop as the low speeds are a windows networking thing. Well thats BS as at another school using much older and less capable kit I get full gig running any test still an RM connection. Also I have only ever used a linux laptop for testing direct to the router. Keeping in mind we were sent a brand new router a very nice one in fact. And no change in throughput. Though it can run internal tests at 1gbs. It is so obviously a configuration issue. Lastly we used to be able to run the tests internally at full 1GBs. So here is the nonsense I was sent. The Technical Reasons for the Speed Drop 1. PPPoE MTU and Packet Fragmentation PPPoE requires 8 bytes of data overhead. This drops your maximum packet size (MTU) from the standard 1500 bytes down to 1492 bytes. - Through the Router: If the router is not configured with proper MSS (Maximum Segment Size) clamping, it receives standard 1500-byte packets from Windows and must split them into smaller pieces to fit the 1492-byte PPPoE limit. This splitting (fragmentation) heavily taxes the router's CPU and slows down data delivery. - Direct to ONT: When Windows initiates the PPPoE connection directly, it automatically sets its own MTU to 1492. No splitting happens, resulting in clean, full-speed delivery. 2. Windows Network Throttling and TCP Window Auto-Tuning Windows uses an optimization feature called Receive Window Auto-Tuning to manage how much data it downloads before waiting for an acknowledgement from the server. - Windows auto-tuning algorithms are notoriously sensitive to packet variations caused by home routers (like slight latency spikes, packet reordering, or fragmentation). - When Windows detects these router variations, it preemptively shrinks its "TCP window size," capping your speed around 600 Mbps. - Direct PPPoE connections to the ONT offer a completely clean path, allowing Windows to scale the window size fully to 1 Gbps.

Still ongoing. The connection to the school tested with a laptop connected via PPOE is full gig. The new router can get full gig speeds. The vlans all are capped at 500mbs. Seems pretty obvious that there is a problem with the routing or traffic shaping. However this has been going on for 3 months now.

So currently ipads access the internet through a transparent proxy. It filters fairly well but they still find ways to access content they shouldn't. Being shared devices the monitoring history doesn't log users. On our lpatops we havbe user based filtering. I have thought about using securus web browser to log what they are searching and looking for. I have limited time being 27.5 hours a week and term time only with 500 pcs and 180 ipads. Also the head has historically not liked spoending money on non devices. So we are in a position were I need to get the filtering and monitoring up to where it should be. Monitoring of searches on the laptops is also very hit and miss. RM does block sites and does log sites visited. But I don't like how often the kids manage to access games sites. Also RM support for the internet has been somewhat terrible lately.

How do you deploy the software I take it it has an MIS installer? We are looking at solutions at the moment and they are vastly different prices.

This would also explain why the non curiculum range is getting 300mbs. over two months this has been going on.

Did that and it was the same throttled speeds. PPOE connection straight to the ONT box full speed. So it is a router config issue, probably a traffic shaping setting they changed randomly. though they are swearing they haven't implemented that. So lets see what they do next.

Actually now I have to set up a ppoe connection on my laptop to connect directly to the fiber to test. I am confused, when did I start working for RM? Ive not had a pay packet yet.

Will be doing so. So now we have an open reach engineer coming out to check the stable 500mbs connectioon for fiber signal issues.

Well the guy I am dealing with has an English Name. It is just rediculous the number of silly excuses given as to why it is our rather exspensive Meraki network that is at fault despite having a 10Gbs back bone and 2 year old switches. When the other school has 20 year old cat 5 and still gets faster internet speeds using the same settings. I could understand if the speed was 10 or 100 Mbs. But having a VERY consistent 500Mbs connection? Hmm that sounds very much like an ISP capped speed. Lets check what speeds Zen actually offers. Full fibre 900 Full Fibre 500 Full Fiber 150 Mmmmm looks like we might be on one of those speeds.

And the dance continues. So now I have had to hard reset the ont box. No change. Now I have been told to run the connection test again directly on the school router. I mean I couldunder stand if the connection speed was capped at 10/100 speeds but switches do not negotiate a stable 500Mbs connection if there is a bad cable somewhere. SO this is an issue that has been ongoing for two months and has had me waste 10s of hours resetting, changing cables, running test after test that I can run on another school network with full speeds with way worse hardware. I mean every excuse under the sun rather than admiotting the ISP has throttled us to a 500Mbs connection which is exactly what every test has shown. frustrated is an understatment

It worked flawlessly since install. Connected a laptop directly to the juniper box speeds still capped by the ISP. This on a port set up to bypass the proxies. Same laptop at home on my network of shame gave full 1gbs speed during testing. Testing at the weekend still showed the same capped speeds. RM out source the connection to an ISP Virgin Or EE typically. ItlLooks like they decided to cap our speeds to a 500mbs connection and lied to RM about doing so. One of the RM guys I talked to on the phone said this happenes more often than it should do. Rm monitoring shows the maximum load to the internet is capped at 500mbs, though normally hovers around 300mbs on general use. Also the servers don't really access the internet for anything other than updates. Even DNS goes through our pihole ad filter.

No Qos installed. Now the admin networks have gone from 300mbs to 500mbs the same as the rest of the network. Ran the tests on a laptop a very high spec n150 with 4gb of ram running mint linux. Same capped speeds. Ran the tests at home on my home network and I got full 1Gbs speeds. Funny that, it is alsmost like after a month of dancing around the issue that either the juniper box as broken (reallyunlikely) or the ISP they outsource to is capping the speeds, but that never ever happens right? Oh wait.

Brave still works for us. You do have to make sure the update urls are unblocked. Also they do ADMX files for AD that are pretty decent for managing it. Just a shame theres no official MSI.

I have done now. Lets see what happens.

Now this would seem to fit the issue. Yes we have multiple ip ranges. Unfiltered proxy range Two curiculum ranges. And two admin network ranges. It was working fine with the meraki switches doing all the internet routing to the juniper box. It would not surprise me at all that they are throttling each network as the admin network connection is significantly lower bandwidth than the curiculum even though it used to be the same 1GBS I think you may have found the issue lets see if they own it.

I look after two schools both have rm internet FTTP Both are on 1Gbs connections. One school gets consitently 1Gbs download speeds. This is the one with the very marginal network. I mean it runs on very old cat5e The other much higher spec network with a 10gbs backbone and meraki switches was fine with a reliable 1gbs stable connection. It has been capped to a 500mbs connection for over a month which is how long my support request has been going on. I have run tests on a server with a 10gbs connection to the meraki switches. The latest suggestion is this. Hello ICT Guy, I have configured ********** on the Juniper interface ge-0/0/2. Could you please try to patch the server to this port and try a speedtest from fast.com and proof.ovh.net. How about not disconnecting the DC from the network to run a speed test? Also the server room and the juniper box are 300m away from each other. I am not setting up a vlan and routing to run a test either. If we still get slow speeds change the upstrem DNS to google DNS? Because dns can cause internet speed issues apprently. Just because the speed test is running consistently doesn't mean dns has resolved correctly. Even though both schools use RM dns servers. Also I must use a cat6 cable and a high spec laptop as well to get the full 1gbs speed! A high spec laptop you say? in a primary school? This has been going on for a whole month. It has been taking a week for them to respond to support ticket updates. This is not the level of service I exspect from a managed internet connection. Just because the ISP is saying it is a 1gbs connection doesn't mean they are not throttling it. ISPs lie especially the cheap ones. Anyhow just wanted to vent.

I installed brave on all the staff machines because it was the only way to make you tube kind of classroom safe. It auto updates but requires a manual install no MSI. As for what type of advert who the hell know, the teacher was terrified he was going to be in trouble. Thankfully it was open on the second monitor not the IWB.

Well the number of inappropriate adverts popping up without the adblocking is insane. We had a very upset teacher worrying because an advert about a prist having intimate alone time popped up while he was showing a video. Hence using brave browser for youtube is now mandatory. Pihole does do a great job of reducing the number of adverts generally, but it is not bullet proof. RM is pretty decent but again not completely bullet proof. I have found a multi layered approach seems to work.

We have a media server running jellyfin as well. It is also possible to have a mint linux machine running a free video downloader that you can obtain ad free offline versions of popular videos should you so wish.

Brave Browser on the staff machines still works. Pihole to reduce as much of the adverts on websites in general not you tube. Works like a charm.

I have been using usb drives for years. I have an auto unnatend file that you can create using an online website. Then I have a bunch of scripts to install office, ask you what you want to rename the machine to, reboot. On reboot it joins the domain automatically, set a load of other settings, installs the wifi password automatically if on laptops. I can image 20 laptops in an hour, no impact on the network and it is so simple my site manager helps me. Software is all installed via group policies. This has worked for me ever since windows 10 came out. I think this is the site I used to generate auto unattend. https://schneegans.de/windows/unattend-generator/ Also you can inject drivers if you have some weird non standard hardware.

Well a quick update to an old thread. So two years on its still working. Still on the same microsd card. When it dies ill swap out for a high use one rather than the extreme one thats in there. It does a pretty decent job of reducing adverts on the whole school network with over 500 machines. These lists work fairly well for us which might be of use to someone. https://gitlab.com/hagezi/mirror/-/raw/main/dns-blocklists/adblock/fake.txt https://gitlab.com/hagezi/mirror/-/raw/main/dns-blocklists/adblock/pro.txt https://gitlab.com/hagezi/mirror/-/raw/main/dns-blocklists/adblock/multi.txt