spc-rocket

Trunk port?

Hi, Yes i agree this is a good candidate for vlans as there are simply too many devices on a one flat network. With vlans on CC3 there were some build issues but these are sorted with few changes to the hosts file on the build server i.e. any of your CC3 DCs. I would say the broadcast of traffic is one of the plus side of it, but its security and ability to match your physical layours of where devices are to your logical network is another. As others have said, you can use ACLs are your core switch to restrict traffic to and from one vlan to another. Idially you will have a default route on your L3 switch to point all internet bound traffic to your internal proxy server or router. We are a CC3 site that uses vlan on an all cisco network infrastructure and it works very well. Few things to remeber: = don't rush the implementation = design the subnets so they capable of meeting the needs in few years time i.e. allow for more ip addresses per subnet = document everything and create standard procedure for changing ports from one vlan or another (i know this is for later on but well worth it) = Test, test and test especially if you are going to by dynamically assigning vlan to each device using a VMPS or Radius and doing 802.1x authentication. Go for it! Ash.

Is the app data redirected to a share on the server by any chance? Ash.

Check to if: - The encapsulation is correct on all the trunk links - there are allowed vlans list on the trunks all from the router to the switch that is having issues - is the dhcp server on another vlan, if so enable the ip helper command in the the router. Ash.

Hi, I get the feeling that this may not work because the computer is not part of a an AD domain so the computer account can't authenticate. The user authentication is righly done at the time when the user logs on so that is working correctly as per 802.1x. What you are after is the pre-logon connection which can only happen when the computer is part of an AD domain so in the back ground the computer can sent its computer password to the AD domain and authenticate. You are right with this regards to IAS, AD and Windows XP, this combination works really well. Without this its not possible to do computer authentication because puely where atre the computer accounts held? in an AD domain. Just thinking about how a look at the following info on this site: http://www.rmschneider.com/writing/xp_and_samba.html#_Toc73070424 Particular the bit about joining samba domain and also having a machine trust account created for the client on the samba server. HTH, Ash.

This may be a screen resolution issue, can you try again after the connect drops to see if this happens again? We had this with stations that have high resolution set but the latest ultravnc automatically resizes this so its no longer a problem. Just a suggestion. Ash.

Hi there, We are also all cisco in network inftrastructure as well. I think you may want the 2950 to keep going until they just expire as they are still good switches i think with the latest EMI IOS upgrade. The 3500 does have some limitations so you may want to replace these with either 2960s or 3550/3560s i would not bother with the 3750 as these are not really for access/edge later more of core/distribution thing. If yo are looking to replace the core then you have a choice of either 4500 chassis based or linking multiple of 3750s together as a cluster to give you the same functionality. Its also worth having a contract for the core to give you upgrades and also of course to cover for parts and support. I thik you need a support contract on one of the switches to be able to down the ios from cisco's website. At present we have a 6509, 4509 and many 2950s and few 2960 switches. In total we have around 45-50 switches across the school. HTH, Ash.

Some drivers are not well written and don't work as expected we found this out on some Linksys PCI wireless cards, the drivers were at fault. One thing you could try is applying this patch if its not already done. KB885453 I'm not sure if this will sort the problem out as it to do with PEAP by the looks of it. Have you tried to imort the CA's root certificate to the "Trusted Root Certification Authorities" store on the windows xp pc? Ash.

Hi, Yes this is possible however you need to make sure that the computer has a certificate allocated or that computer is a domain member of your AD domain. I recommend using the windows wifi utility to configure and not bother with third-party software. You need to make sure that the Root Certificate of the CA is in the computer's Trusted Certificate authority so your computer can trust the certificate that you created with the CA. You also need to tick the box where is says "authenticate as a computer when computer information is avauilable" this will automatically use the computer's password to authenticate with the computer account and you should be able to get an IP prior to the user logging on. There are many ways to distribute the Root Certificate of your CA, the popular way is doing it with a GPO for the whole domain so all your domain member pc and servers will trust the CA. The other is manually installing it in the "Trusted Root Certification Authorities" store using the mmc snap in. HTH, Ash.

FC is not required in schools in my opinion they don't use massive SQL databases to jusitfy putting the system in place or to fund it. I think to answer the original poster's question, iscsi will probably improve performance if the san network is isolated to its own network i.e. san switch connected to filer and then individual servers connected (1Gb at least) to the san switch. The servers will also have another NIC connected to the main network serving clients. Ash.

Hi, I'm proabbly getting it confused, but wouldn't the .Net Framework 3.5 compact redistributable do the job. http://www.microsoft.com/downloads/details.aspx?familyid=E3821449-3C6B-42F1-9FD9-0041345B3385&displaylang=en It comes in msi format as well so its easy to deploy. My guess is that this is only for testing apps? Ash.

Hi, First of all update the driver for the wireless card if there is a new driver available. To find out if WPA is supported, right-click on the wireless icon on the task bat (next to the clock bottom right hand corner) and select "View Available wireless network"). Now under "Related Tasks" select "Change the order of preffered networks" and click the "Add" button, and drop the menu down next to "Network Authentication" and see if an entry is listed fro WPA or WPA2 if its there then it supports WPA encryption. HTH, Ash.

This might be helpful. Import contacts from CSV file into Exchange 2007 - TechNet Forums Ash.

You should not be enabling stp on ports that connects to servers, set it to portfast or whatever is equivilent in 3com switches so it does not go through the usual STP checking for loops. Ash.

Can you not create a distribution group and add members to it and then try sending an e-mail to the email address of the distribution group from yahoo or hotmail account say for example. When you create a distribution group it will allow you to specify the alias as well as the email address for the distribution group. Make sure that the security of the distribution group is set to allow everyone to send e-mails to this distribution group otherwise external senders may be denied access. Ash.

What would happen after 2 years? does the renew for education is also free? i.e. beyond 2 years? Ash.

Does the heads need cleaning? worth a try and also look at updating the firmware on the drive as well as the PV. Ash.

The storevault s500 and s550 will support jumbo frames in future release of the software and this has been included as a feature request. I don't know when they will release the next version. The FC kit should be installable and yes it does seem a bit daft if its not. You might want to contact one of their reseller for and see what they say. Unless you need the performance i think its an expensive option where iscsi would be enough. Ash.

It does support the FC but you have to buy the kit or specify this when you purchase the unit. This can be added in later on if required, im not too sure about the ports but what's bugging me at the moment (not too much of a problem currently) is the lack of jumbo frames support on S500 and S550, the S300 does have jumbo frames. As for the using it as NAS and SAN at the same is possible as you can have shared created on it which connects to your main network (so it can be seen as a NAS device) and the other to connect to your iscsi or FC network. This is the kind of features i like with storevault as it ticks the boxes for various scenarios. Ash.

If the server that is running the backupexec 11d then it is possible to backup this bu either using just the scsi or LAN. You just configure the NDMP option on storevault and then replecate the settings on BE11d and it should be fine. he storevault works as both iscsi target and also NAS so its possible to configure shares and apply NTFS permssions on the shares. However we are not using the NDMP as we want to backup how the server sees it. i.e. SAN----> iscsi lun ----> server -----> lan -----> backup server ---> autoloader Ash.

Hi there, If you want to backup the data directly from SAN then you need to use the NDMP and get an NDMP agent symantec backup exec 11d. This works fine, however if you want to backup the server then the usual method of remote agents deployed to servers will work. We have a store s500 SAN used as an iscsi LUNs to server and we backup the servers so it easier to restore the data to the server. This backs things up as the servers see it rather than directly from SAN. HTH, Ash.

If you have licenses for Office 2007 then you can use the downgrade rights to install a copy of Office 2003. As far as the media is concerned you may need to contact resellers such as Ramesys to get hold of media. I think its around £20 for the media of office 2003 pro on Ramesys. Ash.

@Tony, Thanks for all the info you provide its very helpful to myself and all other edugeek members. When i mentioned the three core products, i was referring to these as stanadrd and base line package but unfortunately we have found that some of the 3 core products are not up to the mark and this is seen by customers of various RBCs. I do accept that they are the minimum but what i think the problem is the reliablity of them and that's why i mentioned about concentrating on these a bit more rather than forgetting them becuase they have been implemented and are bog standard stuff offered by RBC. Another grip which i think a lot of feel is that the SLAs are with LA? Now is the LA going to compensate the school for not having internet access for 2 days if that were to happen. Answer is no. they will still change i presume the annual charge for the service. Now weather they charge the company is another matter and if they do then that cost/compensation should be passed on the school. This is why I think it is very necessary to have the SLA's with the schools rather than LAs. @Geoff, 100mb to school is fine but this is between the central point and the school right? this does not mean that school is getting 100mb Net access speed. That is fine the schools don't need 100Mb line for net access (not yet anyway) but can i ask from central CLEO servers is it 100mb to everyschool that CLEO covers? or just to concentrators or distribution points etc? Unfortnuately there are various threads here that just make you feel is it right to go with an RBC or go alone or with a Becta Accredited Internet supplier i.e. Redstone. I'm not having a go at the RBCs, just stating what the problems with them at present and some feedback in the hope that they incoporate what is said in these forums and take note of it. @Tony You do an excellent job of informing everybody as to what is happening with EMBC and the general details of RBCs, so thank you for providing the information that sometime should come from the LA but doesn't. Good stuff. Ash.

This is what i'm trying to find out about the last 3 years and still not near any definitative answer. What i like to know is that if a school goes with another supplier(s) and do not have access to NEN then - - What are they losing out right now? - Are they in breach of any regulation/requirement by not on or having access yo NEN - what kinds of stuff is up comming (ie. 1-2 years time) on NEN to persuade headteachers and NM advising headteacher(s) to go with a provider that can allow NEN access? For me the RBCs should be concentrating on delivering core services i.e. three basic ones - 1) Reliable internet access, 2) Reliable web filtering 3)Reliable e-mail filtering. The rest i.e. VLEs can be looked at further down the line if required. The single big grip that i have with RBCs is the reliable internet access and web filtering which is not good enough to support the school's AD or other Directory services account's to make the decision to allow access to site/resource or not. This is the real single sign on (SSO) that needs to happen before the grand and wonderful projects (SSO) to link up RBCs to RBCs and seamless access to resouces across the RBCs. I think there are too many people with idealistic ideas that are trying to get their ideas implemented and this often leads to rushed solutions that are not robust enough and neither does it meet all the requirements of schools. Ash.

I believe Redstone ticks all the boxes regarding NEN, free access to JANET and yes links to other RBCs. Their solution (includes the bundle of all web filtering, email filtering, leased internet line etc) is not bad and not as expensive as some people make it out to be. If the RBC are only allowed NEN access then how do Redstone get away with it??? I'm sceptical about the whole NEN things being only available within RBC access because clearly that is not the case - yes i have checked and checked and have come up with at least 2 companies who will give you SLAs (to the schools) and the whole educational bundle. On the RBC side of things, i do think they try to provide the best access they can and its not always possible to please everybody. They have to take a lot of things into consideration and sometime the flexibility that we all want may not be possible becuase of various reasons, one of the big one is security. Ash.