FN-GM

We hadn't had any community infections since April. We have been living life quite close to normal. A few days ago it managed to escape from the government quarantine and now we are in total lockdown for 6 days.

Sorry for the confusion. I didn’t know they had just been announced. Cheers

If you setup a new tenant under dev.domain.com (change to your domain) it will automatically licence itself to the same as your education account and you can use that as a sandbox.

Hello, There was some chatter about Unifi 6 being problematic. I am wondering if these issue have been resolved? Have you upgraded - if so how do you find it please? Thanks

What was the reason for putting this procedure in place? Find that root cause and overcome it. Eg: The reliability and problems connecting to classroom screens. Solution: Thunderbolt docks now make the seamless.

There is a topic about this somewhere. I haven’t found the pool needs anymore up addresses. In addition we shouldn’t really be authenticating against IP our MAC Address. It isn’t secure. I can understand needing firewall rules etc for an entire subnet but one specific device? As far as I am aware if the device roams to a different network with the same config on the SSID it retains the same Mac.

Are they on the same subnet? It is really hard to diagnose without more information such as a complete network map, IP schemes etc.

It can also cost to dispose of them!

I am 75% way through a rollout. We are installing new switches and WIFI. Along with this we are installing UPS(es) into each cabinet. This is across 19 sites - some are a plane journey away. Reasons: 1. Fairly common to have short term power issues. It has been helping increase our reliability of internet routers etc. 2. In a short term outage phones, data points and WIFI continue to operate. Laptops use their own battery. When there are bush fires power can be cut to an entire town so this short term power allows to make arrangements etc. 3. Protect against surges. We use Eaton UPS. They are lighter than APC and smaller so much easier to install and maintain. We get around 2 hours battery on each cabinet. When I worked in UK schools every cabinet had a UPS. Again it allowed short term power in an emergency or to ride out power outages. They did happen less and less so would reconsider if they were needed.

This is quite a simple network. from a technical point of view wouldn't really matter what design you choose. Personally though I would pick option 1. It's a more simple design and traffic between the 2 24 port switches wouldn't need to go via the core as it will be on the same switch.

Drawings and diagrams might be useful here. This is quite complex. Can you confirm that the main centre switch, DC01 & 02 are all in the same VLAN? How is the link between the sites configured? Is this an access port of 802.1q (trunk / tagged)?

Unfortunately this is normal. You can use special links to bypass the first Google login screen so you only type it once. Eg: https:// mail. Google.com/a/domain.com ADFS authenticates against Active Directory not Azure.

You could turn off the lights on the access points and hide the SSID... In all seriousness it’s not going to be a situation where any compromise will be acceptable.

Around 2 years ago I migrated our entire trust into G Suite and dumped Office 365. We didn’t see any pitfalls.

The core issue needs fixing here. This isn’t going to get any better. The technologies are pretty dead. I remember removing the last VGA device is 2013. It’s been redundant for a long time.

Sorry. I meant to the it doesn’t mention the level of monitoring.

Doesn’t mention monitoring. You can filter this out without the need for SSL inspection.

I said monitoring not filtering. 2 Different things.

But monitoring guest traffic is not a requirement. Staff and students yes. Guest no.

You are a couple of PaperCut versions behind. A quick look at the release notes indicates fixes with authentication. It might be worth applying these updates.

Have you configured the default gateway in the controllers? I don’t think what you’re doing is a good idea. You will be better off setting up a site to site VPN instead.

It isn't required though. I never did this as it isn't worth the hassle.

As promised this is a basic ACL to permit internet access only. This works providing your internal devices are on the private IP range. Lines 10 & 20 are for DHCP. You can add your own DHCP server in here. I used public DNS servers so I haven't added my internal DNS here. ip access-list extended INTERNET-ONLY 10 permit udp any host 10.115.0.1 eq bootpc 20 permit udp any host 10.115.0.2 eq bootpc 150 deny ip any 10.0.0.0 0.255.255.255 160 deny ip any 172.16.0.0 0.15.255.255 170 deny ip any 192.168.0.0 0.0.255.255 180 permit ip any any You need to apply this ACL to the VLAN interface. This example the ACL is applied to VLAN 521. interface Vlan521 ip access-group INTERNET-ONLY in

It will probably be the WOL. You can configure the switches to allow certain traffic when not authenticated. This will allow your WOL to work.

The other option might be better. The Access Control List isn’t too big of a deal. For this purpose it will be quite small and simple. I will post up an example for people to look at tomorrow.