Davit2005

Some school networks were setup with different admin and curriculum physical switches but this is not necessary INMO, wastes money and is overkill. vLANS (configured in best practice), subnets (and if need be ACLs) along with regular patching and client protection at the most should be enough in a school environment. It was setup like that at my first school I worked at.

It might of been setup that the VOIP is managed by an outside company and kept completely separate. It should not be necessary and using a different vlan for VOIP is perfectly acceptable but the company managing/supporting/implementing VOIP might of had a strong opinion.

Setup a packet capture on problem device and server. Look at implementing dhcp snooping to prevent DHCP issues caused by accidental (or malicious) rogue dhcp servers. I've seen 3 issues caused by contractors or staff (that should know better) plugging in personal or home routers. The staff member also thought would be smart and give out same addresses as the scope in that area, took us 2 weeks to track the intermittent issues down.

Always stuck with asset tag numbers myself for a few reasons. You don't have to worry about naming so much if a computer gets reimaged you don't have to think what number or name it is. Front of classroom PCs could always be prefixed with FC, etc. Group computers in AD OUs or your desktop monitoring/management system, I think that is more flexible if possible and easier to manage and keep track of.

Check event logs on effected PC too.

I'd check DHCP options which are sometimes needed. They should be documented in the VOIP server what you need to set. Can be either tftp or option 42 but will need info such as the VOIP server.

Is this wireless or wired, if limited to wireless can you let us know what wifi you use and it's firmware. I have had seen some issues with DHCP caused by switches.

Is this a typo It looks like you have gateway on wrong interface, NIC1 has network of 10.2.160.0/22 but no gateway, virtual switch has APIPA assigned address but gateway is not needed, apipa addresses are not routable. vSwitch has self assigned IP but a specified gateway for the other interface somehow. Ethernet Adapter NIC1: ipv4 address: 10.2.160.2 Subnet mask: 255.255.252.0 Default gateway: - Ethernet adapter vEthernet (Virtual_switch_1) Autoconfiguration IPv4 address: 169.254.189.169 Subnet mask: 255.255.0.0 Default gateway: 10.2.160.1 If it is a typo and you have the correct gateway on the Ethernet Adapter NIC1 then you could try pinging the gateway, pinging a upstream router, try pinging Google and see it it resolves IP etc.

It looks like you have gateway on wrong interface vSwitch has self assigned IP but a specified gateway for the other interface somehow. Ethernet Adapter NIC1: ipv4 address: 10.2.160.2 Subnet mask: 255.255.252.0 Default gateway: - Ethernet adapter vEthernet (Virtual_switch_1) Autoconfiguration IPv4 address: 169.254.189.169 Subnet mask: 255.255.0.0 Default gateway: 10.2.160.1

No problem, a route back from the firewall would be needed so it knows where to send the traffic back to. Routers only forward information if they have a route for it. Sometimes it can be setup to have OSPF, RIP, BGP so you don't have to manually create routes on the upstream router/firewall but that is prob overkill and needlessly complicated for your setup. I did have to setup ospfv3 on my home network to get IPv6 to work properly as could not work out what IP address to use as a next hop for the IPv6 traffic.

I picked up 4 TPLink HS110 smart plugs, they have energy monitoring, coupled with HomeAssistant I can see historical usage. I am about 550w under normal usage

Yes I don't know how they justify 30p per/min for a call to Ireland on VOIP. Still cheaper than the 50p per/min of a normal landline before it but still a bit excessive INMO.

My home phone was moved to a Cloud based VOIP provided by my ISP about 2-3 years ago. Normal phones and fax machines no longer work at home for me. I still run a 3cx server at home and have my own SIP trunk which works, my ISP is not charging me any extra for the cloud VOIP but the calls are like 30p per minute to to family abroad where as on my 3cx and SIP trunk they work out 1.7p per minute. Plus I have much better control on my own 3cx. Unknown numbers get routed to virtual receptionist and to voicemail, known numbers passed direct to me. The 3cx server runs as a VM on my NAS which I have on all the time anyway.

I'll use my (over complicated) home network as an example. Internal network (this is all wired connections) core is Stacked 2930 switches. All wired vlans are routed on this switch including hard wired clients, CCTV and VOIP and their gateway is on this core switch. Between the core switch I have a vlan that I jus use for routing traffic between the core and the firewall. This is a client network routed on my core switch ##### sh run vl 3032 Running configuration: vlan 3032 name "h-wired_3032" tagged 1/6,1/18,1/24,2/3,4/5,4/8,4/15,Trk10 untagged 4/22 ip helper-address 172.25.0.### ip helper-address 172.25.0.### ip helper-address 172.25.0.### ip address 10.30.32.1 255.255.255.0 exit This is the vlan I use for routing traffic between the core switch and the firewall. It only needs to be a small subnet of IP addresses so in my case there are a maximum of 14 addresses I can use which is too much in my case. I am using a completely different network range than I use for anywhere else. ##### sh run vl 255 Running configuration: vlan 255 name "int_routing" tagged 1/6,1/18,4/8,4/11,4/15,Trk10,Trk41 ip address 172.25.255.11 255.255.255.240 exit On the core switch I have a static route setup which the next hop is the vlan 255 interface on the firewall i.e. 0.0.0.0/0 gateway(next hop) 172.25.255.9 . This route means traffic for any networks not directly connected (routed on) the core switch gets directed to the firewall (to do with metrics, connected networks have metric of 0 and static routes have a metric of 1) the lower metric takes precedence for routing in most cases. On the firewall I have routes so the firewall knows where the network is i.e. 10.30.32.0 255.255.0.0 gateway 172.25.255.11 (the IP address used on the routing vlan on the core switch). This is so the firewall knows where the destination network is (in this case routed on another Layer 3 switch) I have routes to the wireless and IoT networks that are routed on my firewall on the core switch as I have my DHCP server on a network routed on the core switch. There is quite a bit of information there I know but once you get to understand how it works it gets a lot easier trust me and I hope I have not scared you off :-) I'd still recommend talking to Smoothwall support before you go down this route though

What I have seen and done is have internal wired routed on the core switch, servers routed on the firewall and WiFi routed on the firewall. That would be best option INMO if your firewall can handle it. Create a vlan between your core switch and the smoothwall for routing, put an IP address at either end. You can then use these IP addresses to route traffic. i.e. 0.0.0.0/0 route on the core switch using the routing vlan IP address set on the sub-interface on the smoothwall as a default route. Then for traffic going back create a route for that subnet on the smoothwall using the routing vlans IP address set on the core switch as the next hop. But I would tagg the vlan used for routing and don't use vlan 1 for the routing vlan either. But if you can aim for something like that I think it should give a good building block for the future. You will also prob need to do rules on the smoothwall etc. but I cannot really help on that as I've never used them.

Where is the gateway for the DC currently, is it on the smoothie? Do you have any vlans with their gateways on the core switch apart from the VOIP one you are testing with?

Where is the DHCP server in relation to the client that is on the core switch? I've normally had the vlan where the dhcp server located routed on the core switch. It should not be impossible to setup if the dhcp server is on a different vlan with it's gateway on a different router but jus takes a few more steps. A diagram of the basic network but remove anything that is identifiable such as IPs, fqdns, etc. might be of use.

That I don't know to be honest, I can only imaging it works it out from the ip gateway address/subnet/broadcast picked up from the the core switch.

If you are routing that vlan on the core switch then put the ip address of the subnet gateway on that vlan Below example vlan 11 name "test" ip address 192.168.3.1 255.255.255.0 * this will be the default gateway for the clients on the vlan ip helper-address 192.168.1.10 * this is you dhcp server where you have a scope for the clients on the vlan

It won't be the site manager going round sorting the computer issues logged when staff cannot turn on their PCs. Been there, done that, how many times I've been called to a PC or connected device that was either not plugged in or switched off at the wall outlet

Is it possible to adjust USB support to a different version in the BIOS?

I use a Prusa MK3 at home but for a primary I'd look at getting an fully enclosed model whatever happens such as Ultimaker. Also need to check the slicer that is used to generate the g-code for the printer, some slicers proprietary which can be a good or bad thing depending on the slicer :-) Cost/time to print is going to vary depending on filament, infill, etc. I've had small prints costing a 50p taking a few hours to larger costing £5 and taking 12+ hours I'd engage the teaching staff who are going to be using them. Also consider that some filaments when used will need to be enclosed and fumes extracted and/or filtered. Storage of filament can be a make or failure of prints too. But they are great learning tools, jus been able to create something on a screen then handle and see it physically as well. Plus they are handy for doing the odd unusual part you may be looking for :-)

I don't see a problem with a VPN as long as lateral movement limitation and other security practices are in place including necessary patches on services etc. Also you may be looking at a scenarios where there is specific software that someone needs to run as a fat client on a workstation. Both RDP and VPN have uses. Tightening down with MFA either way on top of other security mitigations is important.

Console port is out of band ?? :-) I do have a 2530 on my desk which I'm having issues connecting to the console port too, I used to be able to but now I cannot, lol. Same experience, as OP, blank screen and pressing keys do not bring up usual prompt. It is the HP (non Aruba branded) but has the Micro USB port. Connecting with Pluggable USB/Serial convertor. Saying that I have another switch which I also was able to connect but now cannot.

My home network runs at 400w coonstantly at the moment. That includes 2 low powered hypervisors, a few layer 3 switches, modems, routers, 2 Synology desktop NAS units (one of those is full of SSDs), Smart Home hubs and APs. But cannot really compare a home network to a work network. Running my few VMs still works out cheaper than hosting them in any cloud I've looked into for personal use whilst I have got an Azure subscription with one lab VM as pay as you go. Also do not have to think about cooling at home for 9-10 months of the year, where I live anyway :-) Also systems used for productivity need to be available in the most part 24/7 and protected from downtime (and damage) caused by heat and humidity. Cloud/third party hosting for an org could prob work out a cheaper option with a solution with SaaS if possible, PaaS or if need be IaaS for custom or where there is not a SaaS/PaaS solution.