seawolf

; J9299A Configuration Editor; Created on release #J.14.01 hostname "f2-2520-01" max-vlans 32 interface 1 name "User Access" exit interface 2 name "User Access" exit interface 3 name "User Access" exit interface 4 name "User Access" exit interface 5 name "User Access" exit interface 6 name "User Access" exit interface 7 name "User Access" exit interface 8 name "User Access" exit interface 9 name "User Access" exit interface 10 name "User Access" exit interface 11 name "User Access" exit interface 12 name "User Access" exit interface 13 name "User Access" exit interface 14 name "User Access" exit interface 15 name "User Access" exit interface 16 name "User Access" exit interface 17 name "User Access" exit interface 18 name "User Access" exit interface 19 name "User Access" exit interface 20 name "User Access" exit interface 21 name "Diagnostic" exit interface 22 name "User Access" exit interface 23 name "User Access" exit interface 24 name "To e2-2520g-01 23" exit ip default-gateway 172.17.2.240 vlan 1 name "DEFAULT_VLAN" untagged 23-24 no untagged 1-22 no ip address exit vlan 2 name "NET" untagged 20-22 ip address 172.17.2.20 255.255.255.0 tagged 24 exit vlan 3 name "SERVER" tagged 24 no ip address ip igmp exit vlan 4 name "SECURITY" tagged 24 no ip address ip igmp exit vlan 10 name "A-LAN" tagged 24 no ip address ip igmp exit vlan 20 name "B-LAN" tagged 24 no ip address ip igmp exit vlan 22 name "B-VOIP" tagged 24 voice no ip address exit vlan 30 name "D-LAN" untagged 4,7,10-19 tagged 24 no ip address ip igmp exit vlan 32 name "D-VOIP" untagged 5,8 tagged 24 voice no ip address exit vlan 40 name "G-LAN" tagged 24 no ip address ip igmp exit vlan 50 name "I-LAN" tagged 24 no ip address ip igmp exit vlan 60 name "P-LAN" tagged 24 no ip address ip igmp exit vlan 62 name "P-VOIP" tagged 24 voice no ip address exit vlan 70 name "S-LAN" tagged 24 no ip address ip igmp exit vlan 5 name "PRINTER" untagged 6,9 tagged 24 no ip address exit vlan 9 name "ADMIN" untagged 1-3 tagged 24 no ip address ip igmp exit vlan 80 name "U-LAN" tagged 24 no ip address ip igmp exit vlan 82 name "U-VOIP" tagged 24 voice no ip address exit vlan 90 name "VCE-LAN" tagged 24 no ip address ip igmp exit vlan 100 name "ELC-LAN" tagged 24 no ip address ip igmp exit vlan 101 name "ELC-WIFI" tagged 24 no ip address exit vlan 200 name "WIFI200" tagged 20,24 no ip address exit vlan 204 name "WIFI204" tagged 20,24 no ip address exit vlan 208 name "WIFI208" tagged 20,24 no ip address exit vlan 212 name "WIFI212" tagged 20,24 no ip address exit vlan 52 name "I-VOIP" tagged 24 voice no ip address exit fault-finder bad-driver sensitivity high fault-finder bad-transceiver sensitivity high fault-finder bad-cable sensitivity high fault-finder too-long-cable sensitivity high fault-finder over-bandwidth sensitivity high fault-finder broadcast-storm sensitivity high fault-finder loss-of-link sensitivity high fault-finder duplex-mismatch-HDx sensitivity high fault-finder duplex-mismatch-FDx sensitivity high timesync sntp sntp unicast sntp server priority 1 172.17.3.101 sntp server priority 2 172.17.3.102 snmp-server community "public" Unrestricted snmp-server location "F Block" spanning-tree spanning-tree 1 bpdu-protection spanning-tree 2 bpdu-protection spanning-tree 3 bpdu-protection spanning-tree 4 bpdu-protection spanning-tree 5 bpdu-protection spanning-tree 6 bpdu-protection spanning-tree 7 bpdu-protection spanning-tree 8 bpdu-protection spanning-tree 9 bpdu-protection spanning-tree 10 bpdu-protection spanning-tree 11 bpdu-protection spanning-tree 12 bpdu-protection spanning-tree 13 bpdu-protection spanning-tree 14 bpdu-protection spanning-tree 15 bpdu-protection spanning-tree 16 bpdu-protection spanning-tree 17 bpdu-protection spanning-tree 18 bpdu-protection spanning-tree 19 bpdu-protection spanning-tree 20 bpdu-protection spanning-tree 21 bpdu-protection spanning-tree 22 bpdu-protection spanning-tree 23 bpdu-protection spanning-tree bpdu-protection-timeout 300 loop-protect 1-24 loop-protect disable-timer 300 password manager password operator

Just to take a step back, is your inter-VLAN routing working? There are some settings in your RIP config that appear unusual to me. Might want to go thought this doco just to double check: http://www.hp.com/rnd/support/config_examples/5300xl_portbase.pdf http://www.hp.com/rnd/support/config_examples/5300xl_rip_routing.pdf Your core switch config overall looks rather unusual to me as well. any reason you are using both 172.x.x.x and 10.x.x.x. IP addressing in your network? The whole "INSIDE" and "OUTSIDE" VLAN configuration has me a bit confused about what you are trying to do with your VLAN segmentation. Here is the config from our core switch and an endpoint switch. We use a lot of VLANs and routing and default gateway has worked perfectly for 4 years like this. You'll notice that the default gateway for the endpoint switch is the core switch IP address. The default gateway for the core switch is our firewall. We use an Ubuntu server as the DHCP server on our network and the only "ip helper-address" setting points to this server as you'll note. p.s. the endpoint switch config is in a following post, I reached the maximum length of a post with both it appears. ; J4850A Configuration Editor; Created on release #E.11.10 hostname "a15-5304xl-01" snmp-server contact "ICT Manager" snmp-server location "Network Rack 1" max-vlans 48 module 1 type J4907A module 2 type J4907A module 3 type J4878B module 4 type J4878B interface A1 name "Server Access" exit interface A2 name "User Access" exit interface A3 name "User Access" exit interface A4 name "User Access" exit interface A5 name "User Access" exit interface A6 name "User Access" exit interface A7 name "Server" exit interface A8 name "User Access" exit interface A9 name "User Access" exit interface A10 name "User Access" exit interface A11 name "User Access" exit interface A12 name "User Access" exit interface A13 name "To a20-2610-01 26" exit interface A14 name "User Access" exit interface A15 name "Trunk To a15-4208vl-01 C2" no lacp exit interface A16 name "Trunk To a15-4208vl-01 C4" no lacp exit interface B1 name "Server Access" exit interface B2 name "Server Access" exit interface B3 name "Server Access" exit interface B4 name "Server Access" exit interface B5 name "Server Access" exit interface B6 name "Server Access" exit interface B7 name "Server Access" exit interface B8 name "Server Access" exit interface B9 name "Server Access" exit interface B10 name "Server Access" exit interface B11 name "Server Access" exit interface B12 name "Server Access" exit interface B13 name "Server Access" exit interface B14 name "User Access" exit interface B15 name "Trunk To a15-4208vl-01 D22" no lacp exit interface B16 name "Trunk To a15-4208vl-01 D24" no lacp exit interface C1 name "To s11-2810g-01 24" exit interface C2 name "To b2-2520g-01 24" exit interface C3 name "To i8-2810g-01 24" exit interface C4 name "To d2-2520g-01 21" exit interface D1 name "To u1-2520g-01 24" exit interface D2 name "To elc-hp2520g-01 24" exit interface D3 name "To g1-hp2510g-01 48" exit interface D4 name "To vce-hp2520g-01 24" exit trunk A15-A16,B15-B16 Trk1 LACP ip default-gateway 172.17.2.254 sntp server 172.17.3.35 sntp server 172.17.3.101 sntp server 172.17.3.102 ip routing timesync sntp sntp unicast snmp-server community "public" Unrestricted vlan 1 name "DEFAULT_VLAN" untagged C1-C4,D1-D4,Trk1 no ip address no untagged A1-A14,B1-B14 exit vlan 2 name "NET" ip address 172.17.2.240 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 3 name "SERVER" untagged A1-A3,A5-A14,B1-B14 ip address 172.17.3.254 255.255.255.0 tagged C1-C4,D1-D4,Trk1 ip igmp exit vlan 4 name "SECURITY" ip address 172.17.4.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 10 name "A-LAN" ip address 172.17.10.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 20 name "B-LAN" ip address 172.17.20.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 22 name "B-VOIP" ip address 172.17.22.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 voice exit vlan 30 name "D-LAN" ip address 172.17.30.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 32 name "D-VOIP" ip address 172.17.32.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 voice exit vlan 40 name "G-LAN" ip address 172.17.40.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 50 name "I-LAN" ip address 172.17.50.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 60 name "P-LAN" ip address 172.17.60.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 62 name "P-VOIP" ip address 172.17.62.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 voice exit vlan 70 name "S-LAN" ip address 172.17.70.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 5 name "PRINTER" ip address 172.17.5.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 9 name "ADMIN" ip address 172.17.9.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 80 name "U-LAN" ip address 172.17.80.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 82 name "U-VOIP" ip address 172.17.82.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 voice exit vlan 90 name "VCE-LAN" ip address 172.17.90.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 100 name "ELC-LAN" ip address 172.17.100.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 ip igmp exit vlan 101 name "ELC-WIFI" ip address 172.17.101.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 200 name "WIFI200" ip address 172.17.200.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 52 name "I-VOIP" ip address 172.17.52.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 voice exit vlan 208 name "WIFI208" ip address 172.17.215.254 255.255.252.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 202 name "WIFI202" ip address 172.17.205.254 255.255.254.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 206 name "WIFI206" untagged A4 ip address 172.17.208.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 214 name "WIFI214" ip address 172.17.216.254 255.255.255.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit vlan 216 name "WIFI216" ip address 172.17.223.254 255.255.252.0 ip helper-address 172.17.3.100 tagged A13,C1-C4,D1-D4,Trk1 exit fault-finder bad-driver sensitivity high fault-finder bad-transceiver sensitivity high fault-finder bad-cable sensitivity high fault-finder too-long-cable sensitivity high fault-finder over-bandwidth sensitivity high fault-finder broadcast-storm sensitivity high fault-finder loss-of-link sensitivity high fault-finder duplex-mismatch-HDx sensitivity high fault-finder duplex-mismatch-FDx sensitivity high ip route 0.0.0.0 0.0.0.0 172.17.2.253 spanning-tree spanning-tree A1 bpdu-protection spanning-tree A2 bpdu-protection spanning-tree A3 bpdu-protection spanning-tree A4 bpdu-protection spanning-tree A5 bpdu-protection spanning-tree A6 bpdu-protection spanning-tree A7 bpdu-protection spanning-tree A8 bpdu-protection spanning-tree A9 bpdu-protection spanning-tree A10 bpdu-protection spanning-tree A11 bpdu-protection spanning-tree A12 bpdu-protection spanning-tree A14 bpdu-protection spanning-tree B1 bpdu-protection spanning-tree B2 bpdu-protection spanning-tree B3 bpdu-protection spanning-tree B4 bpdu-protection spanning-tree B5 bpdu-protection spanning-tree B6 bpdu-protection spanning-tree B7 bpdu-protection spanning-tree B8 bpdu-protection spanning-tree B9 bpdu-protection spanning-tree B10 bpdu-protection spanning-tree B11 bpdu-protection spanning-tree B12 bpdu-protection spanning-tree B13 bpdu-protection spanning-tree B14 bpdu-protection spanning-tree Trk1 priority 4 spanning-tree bpdu-protection-timeout 300 priority 4 force-version RSTP-operation ip multicast-routing ip ssh router rip exit router pim exit vlan 3 ip pim all exit vlan 9 ip pim all exit vlan 10 ip pim all exit vlan 20 ip pim all exit vlan 30 ip pim all exit vlan 40 ip pim all exit vlan 50 ip pim all exit vlan 60 ip pim all exit vlan 70 ip pim all exit vlan 80 ip pim all exit vlan 90 ip pim all exit vlan 100 ip pim all exit loop-protect A1,A3,A5-A6,A8,A10-A14,B1-B14,C1-C4,D1-D4,Trk1 loop-protect disable-timer 300 password manager password operator ------------------–-----------

Ask them for one of these - http://www.griffintechnology.com/business/multidock I have one in the office to sync the iPads we have in the library. It does 10 at a time and costs barely more than a single iPad. To be frank, if the school doesn't have enough money for that, then I wouldn't be sticking around for long as they seem willing to waste your time and can't do a simple cost-benefit analysis based on the amount of hours it will save you multiplied by your hourly rate. The opportunity cost of those lost hours along....sheesh.

In that case, I would create a "Change Request" document and procedure that stipulates a minimum three week timeframe (only making changes during term breaks is better) for considering, testing, and installing any new apps or app updates onto the iPads. Since you have to do them all manually and the school probably won't want to give them up during class hours for you to manually backup, test. and update them - so you'll have to do it after hours, or during school breaks. If they don't like that, then say "fine, but the iPads will be out of service for a minimum of three days whenever updates or new apps need to be added - or you can pay for a sync cart and we won't have that issue. Your choice".

Doesn't help you right now, but plan an upgrade to Win2008R2 (or fresh install and migration being better approach) and then you can do it all with GPOs and no scripts required. Some will tell you to go for 2012 R2 instead, but I can't really recommend something that I haven't tested extensively especially when 2008R2 is rock solid.

Use Apple Configurator and a VPP account to manage them and install apps. You can create an SOE image and load that on all the iPads. If you have a charge and sync cart, you can do them all at once including installing apps. Anything you can manage with MDM you can do with Configurator. With MDM you'd have to manually enroll each iPad and install each app anyway so Configurator is actually quicker. You have to use Configurator to place the iPads in supervised mode for MDM to be able to use some features as well. So, again there is no reason at all to use MDM in your circumstances. I wouldn't. Backup/restore is also taken care of with Configurator. We have the iPads bar coded and cataloged in our library management system and they are checked out just like a book. That way they can be reserved and reminders come up when they are due, fines, etc.

You can set MCX finder preferences to "Always" so they can't edit those preferences. I would stay away from simple finder unless these are really young students, it's just TOO simple, and limiting. As for the network home on the dock, I believe that's a consequence of using the network home for the logged in account. If you turned on the option to show "Connected Servers" n the desktop in Finder preferences then they would be able to see the network home mount on the desktop. I think you are probably trying to force OSX into the model often used for Windows (and that we use for Windows), but I've found that we don't have nearly as much problem with students trying to mess around with the settings or saving docs to the wrong place with the Mac compared to Windows. Some students don't even realise they can click the triangle when saving to choose a destination other than Desktop, Documents, Movies, Pictures, or Music. And that's actually a good thing. The searching on the Mac is so good there isn't a need to use the traditional hierarchical folder structure. Most of the time, students make a mess of this anyway and forget where they saved something. If they save everything at the top level of the directory and learn to search with spotlight it works out better.

Sounds like you didn't set the users up to use a Network Home then. To do that, untick "Force local home directory on startup disk" when you bind the computer . Here's another tip about redirecting the cache folder to the local disk to improve performance http://houseofmac.wordpress.com/2010/11/03/os-x-network-home-folder-redirection/

Have you actually tried to save data to the local drive? The only location a non-admin user has permission to change or write to is the Users/Shared location and their own User directory IF they are not using a network home. If you are using network homes, the only place they could save anything locally is the /Users/Shared location. If users do that, they would know they aren't saving to the network and they would really have to go looking for it. So, I would be inclined to say bad luck to them. Of course, you could always set your images to restrict access to the Shared directory to prevent even that. Just make sure you don't use any apps that rely on using the Shared directory to function properly. There shouldn't be nay or many properly written ones that do. sudo chmod 664 on that directory should do it. Or Cmd+I on the directory to make the change through the GUI.

Putting the Macs into their own VLAN won't do the trick unless you're blocking all non-unicast traffic from crossing VLANs (it doesn't here). But, if you do that, then you'll create issues with imaging across VLANs, etc. Turning off NetBIOS might have the desired effect, but I'm not so sure since I haven't tested that.

Here's a good little overview of the options that are available in Finder. Finder tabs and tagging and other tweaks are coming in 10.9 Mavericks, but until then this is pretty comprehensive. http://mac.tutsplus.com/tutorials/os-x/10-tips-for-a-better-finder-experience/

Sorry, I've never tried to kill the network browsing feature myself, so I'm not positive about this one. I can't find anything about removing this at afp548, krypted, etc. so I it doesn't look like it can be done, but I might be wrong. There is usually a way with plists and MCX, but there are some things Apple just wont let you change in the interface. Do you not want students to be able to access network shares at all on the Macs? Normally, I wouldn't remove the network drives from the finder so the students could access the network shares. Just trying to understand the use case to make sure there isn't another way to achieve what you want.

http://deploystudio.wikispaces.com/ - a good resource for all things DeployStudio. The other free options out there are Munki (or Simian) and Puppet. I haven't tried these myself, but they have a good rep. Beyond these, Casper Suite can do just about anything you could want in managing Macs. Costs money, but reasonable for Edu.

ARD is well worth the (very small) investment and it can do far more than just deploy software packages. Highly recommended. You can also use DeployStudio to deploy packages (apps) and it makes a great free Mac imaging tool as well. It can do Mac only or dual and triple boot deployments as well.

You have do do a secure bind of clients to OD when you have a magic triangle setup for computers to appear in WGM. BTW - this is probably the most up to date instructions for setting up magic triangle I've seen lately - current as of 10.8.4 http://www.papercut.com/kb/Main/MacOSXMagicTriangle

You're welcome. Did the same thing myself with a new WLAN on the Ruckus once last summer. You'll find the Ruckus config is pretty logically organised and bugs that cause illogical behaviour are few and far between. I've only hit a significant bug in one firmware release (Zero-IT config stopped working on OSX 10.8) and they fixed it a couple of weeks after I logged it with new firmware.

p.s. AirServer works better than Reflector in all of our testing. We are using Mac Minis on our IWBs though so I haven't done testing of each solutions Windows version, so if that's what you'll be using it on I would test both in YOUR environment before deciding.

Let me give you the straight scoop on doing this as simply and troublefree as possible. First, the fact that you have eight WiFi VLANs isn't really a problem. You don't need MDM for a trolley full of iPads, in fact I'd recommend against it as it doesn't give you any advantages only more work. In a 1:1 or BYOD environment MDM is a necessity. So, here's what I would do if I were you: 1. Use Apple Configurator and a VPP account to manage them and install apps. You can create an SOE image and load that on all the iPads. If you have a charge and sync cart, you can do them all at once including installing apps. Anything you can manage with MDM you can do with Configurator. With MDM you'd have to manually enroll each iPad and install each app anyway so Configurator is actually quicker. You have to use Configurator to place the iPads in supervised mode for MDM to be able to use some features. So, again there is no reason at all to use MDM in your circumstances. I wouldn't. 2. Use Printopia Pro to enable AirPrint across all of your VLANs. It works a charm and can also be used to setup printer access by VLANS. So, if you want some printers accessible only by teachers, but others accessible by everyone you can do that. The cost is VERY reasonable for Printopia Pro and its very easy to use. 3. The AirPlay issue is easily solved by placing the projector PCs on the same VLANS as the teacher iPads (yes, even a WiFi VLANS). I would not try the various tricks some vendors have tried to make it work across VLANs as you risk mDNS traffic swamping your network or have unreliable AirPlay coverage. 4. Enabling file access is the hardest bit, but can be achieved at a cost with MobilEcho installed on your Windows file server. It works brilliantly and can be used by multiple users - they just logon and off the app like they would a PC to access their files. You could also use Google Drive, OwnCloud, DropBox, or WebDav, but these require you to change how you do things whereas MobilEcho doesn't (and MobilEcho integrates with SharePoint). You said the Head had a magical pot of money for the campus WiFi, so tell him to do what he wants with the iPads he'll need to dip not it again for MobilEcho. p.s. I haven't used Foldr, but it requires a separate VM server and charges a per user license fee. In a large environment that could easily be much more expensive than MobilEcho, which has an unlimited user and server license for Edu. MobilEcho might be more expensive for very small environments, but if you go over 500 students + staff Foldr will start to get very expensive. If you setup the management server component of MobilEcho you have easy setup for BYOD and can revoke access easily as well. The only advantage I see to Foldr is the web interface to provide kind of a Dropbox like experience for your file server. Whichever you go with, it will be worth the money if you want to get max benefit it of the iPads (or Android). 5. Web filtering can be done either by setting a default filter by VLAN or using a capture page to make the user login for filtering. We use a default VLAN here and this approach works well as it is the least disruptive and transparent. That, in a nutshell is all that needs to be done to achieve what is wanted. It is a proven solution. Don't make it more complicated than it is.

OpenDNS is good, but only if it is set at the router level in not on the devices themselves or it can be easily overridden. OpenDNS also doesn't help at all with filtering google image searches. I think the best solution is to use the iBoss Home combined with OpenDNS configured as a second layer filter for the really bad stuff in case either is circumvented. The iBoss is an awesome device in the granularity of filtering and reporting. It enables you to block social media sites very granularly (view but not post to Facebook, etc,) and has clean image searching redirects to lock in safe search on any browser on any device. http://www.iboss.com/home_overview.html Of course, this does nothing to stop someone from using 3G/4G to circumvent filtering at home, school, or work. This is why some level of ISP based filtering would be a good thing.

Seems to be strong support in the UK for EMC. Not so much here. Maybe EMC doesn't care much about the Aussie market, much as it sounds Oracle doesn't in UK. Well, that's why I always suggest people get demo units before they commit, especially with equipment that costs north of 15k.

So glad to hear a rational argument. And of course my Sun/Oracle kit breaks down every other week, that's part of the fun in owning it ;-)

I'm interested when you last used the 7000s because the issues with iSCSI and SMB performance are gone. I have a 7320 and recently tested a 7120 and performance is fantastic - much better than the HPs for equivalent cost. The DNS issue was a pain in the....but that is gone as well. I've had good support from Oracle, but I also have good a Oracle supplier that I work with. It sounds like UK support isn't good. Down here, I've been told by several people to stay away from EMC as the support was terrible and expensive. At one point when I was considering EMC as a vendor I was told by their distributor in Oz that no EMC SAN units were available in country for at least 2 months. That was ridiculous, so they got no look from me. Clearly support and availability are much better in the UK for EMC.

But then you would be arguing that we should have a distaste for ALL SAN vendors, because they have all released buggy firmware at some point in a product lifecycle, and all SANs will have some bugs in current firmware. The buggy firmware for the 7000s came early in the introduction of the product and whenSun was on the market.

The only drawback is that WGM will probably disappear in 10.9, but the underlying MCX settings will likely still work. And with profiles users don't have to logout/in for changes to apply.

John, if your only experience with the Sun SANs is the 7110 and you purchased it in 2009 when the firmware was quite buggy I can see where you're coming from. The second gen models and firmware from late 2010 onward is a different story. The 7120 and 7320 units are rock solid with great performance, and high reliability. there aren't a lot of SANs you could just go pull the plug on and then expect it to just come up no worries. I have that confidence in the Sun SANs (current gen). I do keep hearing how expensive support is for the Sun kit in the UK, but I have to say that is surprising because I don't find it expensive here in Oz. quite the opposite compared to many other vendors actually. Oracle must be doing something different in the UK? The Sun Ray announcement was a bit of a shock and disappointing, but I doubt the SANs are going anywhere since Oracle's Exadata products use them extensively as backup devices. https://oracleus.activeevents.com/connect/sessionDetail.ww?SESSION_ID=4410 And as I've said before, I've heard horror stories for EMC and HP SANs and have personally seen issues with a couple of HP SANs and saw a million dollar fibre channel Hitachi SAN die on a major Australian retailer about 9 years ago taking the backed databases for two retail chains down with it. Good backups and DR strategy are the key no matter what you're using.