pantscat

Another vote for Vaioni here...

One word: Veeam. Blimey... this is quite a thread resurrection.

Thanks @Ketlane

Thanks @AlexPilot - I really appreciate your replies and the information you've provided. It's all really useful for us as we're feeling our way a little! I love the idea of the half-built missile... someone had some real initiative.

@AlexPilot - thanks for the info, that's very useful. I'm sure I'll come up with lots of questions so I may bug you via PM! Yes, you're absolutely right - it's a new venture for us. I take it that we'd be marked down by OFSTED in regard to BYOD if we are unable to provide IT facilities to those students that need financial support? We have a lot of students who receive substantial bursaries so we would need to be able to provide equipment for them - we're currently discussing how we would do this. I agree in regard to 3G mobiles and dongles, we've got to get parent buy-in so that they're discouraged from bringing this type of equipment. I'm intrigued as to what bad IT behaviour you've seen - anything that can help us to avoid re-inventing the wheel would be very welcome! Thanks, Ant

Thanks for the input - much appreciated. @Chris_ I like the idea of using the Smoothwall SSL page for authentication - that could work pretty well. I've not used that mechanism for authentication before - I'll have to have a play with it and see. @Ketlane - hadn't got as far as considering the security aspects yet. Do you have boarders? How do you provide access to school resources and folders? Cheers all, Ant

Thanks @Netman (and @Ergo) That's exactly my plan - we're due to have a very small IT resource area in the Boarding House (with between 12 - 20 PCs) and an MFD. Netman - I'm intrigued as to your Smoothie setup (we use it here too) - do you utilise a second NIC for the other subnet? That idea had crossed my mind... As for file access, I've found a nice little webpart that sits in SharePoint (we use SLG2) that will allow access to students' home drives, and I've also been having a dabble with IPP for printing but I can't get it to work with authentication. (yet!) Ergo - yep, familiar with SteadyState, and with the GPOs we currently use for our machines they practically are that solid now.

Thanks Ben. My thoughts exactly... I can't really see BYOD going away any time soon and I think it's something that should be embraced. Ant

We're going be taking on some boarders next year and I'm currently having discussions about the best way to accommodate their IT requirements. I'm keen on BYOD, with a separate VLAN linked to a VDSL line with OpenDNS web-filtering. (This would also server the residential staff quite nicely too). It seems to me though that there are rumblings amongst some of the teaching staff responsible for the boarding house that they'd rather have School-provided IT equipment for the students as "they'll be less likely to get viruses that way, and won't be able to play games". Now... my thoughts are that BYOD would encourage a greater sense of responsibility for the students (surely, part of what is going to turn them into well rounded adults), they'd be able to use their platform of choice for keeping in touch with their family (rather than us having to install every flavour of instant messenger/skypetypething/whatever) and the fact that they can play games is not necessarily a bad thing and I see that as being a pastoral issue rather than anything else. Plus I envisage that the school-provided equipment wouldn't be loved and cherished... ;-) What do other people do? Cheers!

Right - I've had a chance to have a quick look. Try using the "ip udp-bcast-forward" command in your config. You may also need to tell the switch where to forward the broadcasts, but we'll worry about that if this doesn't work!

@MrBrow - I'll have a look at this and get back to you! Need more coffee to make sense of it...

Ah - ok. Thanks for the info.

Hi Taryn, Where is this role based? Thanks, Ant

For teaching staff we use their three letter (initials usually) teaching code as per SIMS.net. For support staff we use initial.surname. For students we use surname.first-two-letters-of-preferred-name No issues here...

You'll need to setup a firewall rule to allow ping traffic to the TMG. It's a firewall... and so by default it's locked down.

@MrBrow - what's the config on your core switch(es)?

Yep indeed.

You're absolutely correct. I'm only allowing "school machines" to VPN in... thus Win7 only. As far as I know there isn't any SSTP client support for anything other than Win7 (Win8!) and Win 2008.

Change to SSTP type VPN? That's what I'm about to try out here with Forefront... (SSTP uses port 443).

Just a quick question - is there any particular reason you're not using TMG as your VPN?

You're creating a network loop by linking the two switches AND linking them to your core switch. Is VLAN-50 tagged on port 24 of the two d-link switches? is it also tagged on your core switch?

Haven't had a chance to take a snap... but they're like this: HP ProLiant ML530 Generation 2 - North America/U.S. QuickSpecs

NPS is Network Policy Server (See here: Network Policy Server) I can't remember what I read that made me think all of this was a good idea (and it is, although I'm only really getting around to properly implementing it now.) - but this (Security Solutions: 802.1X And Guest VLANs - HP ProCurve Networking) looks like a good place to start.

Yep - I'll try and get round to taking a photo later today. I think each box has three nics... (not sure why!)

I'd rather get rid of the whole lot.