Davit2005

My first job in education was 2009. They'd put RM in but then decided they could/would not pay the subscription/support or training. We replaced with vanilla AD. Was a good learning experience as I'd never dealt with Group Policies or AD before that.

You should be able to just add the IP helper address to the vlan on the core switch where the clients are located, you will probably have an existing ip helper for your dhcp server. Having both and even a netboot server IP address should not cause issues, the clients are intelligent enough to work out what they need

I don't think you need 66 or 67 unless SCCM/PXE server is on same server as DHCP server, could be wrong. Have you different vlans for clients at your site?

I like 5

Confused dot.com Why would anyone want to have RM CC network at home, INMO You are going to do far better by learning Vanilla windows in your own time. If you need to learn RM CC4 for work you really should look to get this training from your employer.

I cannot see any reason to let APs talk to the Internet. If you have a cloud based (an actual, cloud based in AWS etc.) controller you should only need specific ports and target addresses. If it is hard to get specific URLs or IPs, it becomes easier if you have an application layer firewall as these do not work with ports alone. Maybe I am been a bit sceptical but there is no reason to allow everything because just because something captures usage. It easy to see if devices dial home, just run a packet capture.

We had a Commodore PET at our secondary school, one IT room full of BBC model B on a local network, lol. Same commodore roots Vic20 > C64 > Amiga then a 386SX PC with a Modem.

I actually don't mind to log into a portal to get payslips, they only ended up in the shredder anyway. The less personal stuff I get in the mail the happier I am.

I was a qualified Mechanical Engineer in 2000 who was asked to look at why the companies web space was been chewed up after they found out I'd done a few of my own websites. I managed to reduce the size of the site from 15MB down to a floppy disk as well as making some improvements i.e. animated gifs after the IT manager left. I was asked to help out the guy who took over the IT manager tasks, we both managed busy production departments as our main role. The company had 3 sites connected via ISDN with a Citrix Winframe server in the head office where I was based so I got tasked with doing a lot of stuff on NT4.0, NT3.5 and Exchange 5.5 . Unfortunately the company went into liquidation soon after but the MD said to me "Why don't you get into IT" . I had no formal IT qualifications but in my next role as a lathe operator I took evening classes and passed a CCNA, from there I did home study and managed to get a MCP in Server 2003. Got a role as a junior field engineer doing real basic stuff in 2005. Spent the last 6 years holding senior tech roles in Schools, Colleges and Uni's. So 18 years as a Mechanical Engineer and 15 years in IT Support in multiple roles.

I had a Vic 20 at 12years of age for a B'day present. Remember playing text adventure games like Pirate Cove, lol.

I love that film

I just hope this is web based html5, no plugins and/or not an installed app that requires raised privileges.

Easy to blame and scare monger to those that do not understand, the media seem very good at that. But glad no injuries and good work by the staff concerned to get the children and other staff out safely.

I found before if I wanted policies to be applied to users that logged onto specific computers I had to add the Domain Computers Group with Loopback Policy set to Merge

Using VMware at home and I have a Silex USB server, it is very reliable since bought it 2-3 years ago. Plugs into the network and you run a bit of software on the server to connect to it, shows up just like a local drive. Use it to copy backups to a portable HDD for off site backups.

What is the IP 11.0.0.1 for? But above all I can see an issue there. You have ip routing setup on the switch but you only have an IP address set on vlan 2 and a route. But I cannot see how this will work as I cannot see how can the dhcp server route the IP address back to the client. Save your self any further time and see if Smoothwall tech can advise you on how to route/terminate the guest vlan at the firewall. This is how I done it at the previous college I worked for, a previous school and at home.

OK, so where have you setup the route. Could you paste the switch config but please remove anything sensitive. Also if there has been anything done on the Smoothwall detail that a bit but again remove anything sensitive i.e. IP addresses etc. You should just go down either avenue. 1. Take the vlan as layer 2 to the Smoothwall and seperate it to it's own network/zone/subnet 2. Route the vlan on the core switch You do not need to do both. If you want to use the smoothwall you will need to think about dhcp, dns and rules needed to allow traffic to internal services but I'm guessing for guests this will be minimal. If you want to route on your internal network you may only need the rules on the smoothwall to allow vlan traffic out to the internet and a route for the traffic coming back through the smoothwall to the internal network. Is the vlan that your dhcp server on at the moment routed at the core 3 switch?

Create the Guest SSID as a layer 2 vlan all the way to the Smoothwall. You are using a different vlan anyway for the guests aren't you?

I would still strongly suggest having the guest wifi routed on the firewall, is there no one at Smoothwall that you could reach out to for a bit of guidance to get it setup?

You should set the helper address to the IP address of your dhcp server. Ti rule out anything on the WiFi side you could untagg a port on a switch where you have the guest vlan configured, plug a laptop in and see if it gets an IP address etc. At least you can break it down to smaller chunks to see where the issue is. Even so far as temporarily giving the laptop a static configured IP address on the guest vlan and trying to ping the gateway and dhcp server (if you have allowed ping on the local firewall).

It depends, you need to put the IP helper address on where the VLAN is being routed or has its gateway IP address. If you were using a windows DHCP server you should only need to create the scope.

My recomendations as I have done this a few times and on Ruckus, but not used a smoothwall 1. Create SSID on Ruckus for guest as a vlan i.e. vlan 3 2. Add the vlan as a tagged port on the ports connected to APs 3. Tag the vlan all the way to the firewall as layer 2 and route the traffic there as a seperate zone/network 4. Either configure the firewall to provide DHCP or allow dhcp/dns traffic back into your core network, allowing dhcp/dns traffic to specific internal servers should not pose any security risk. I cannot see there been a big issue because the firewall is software based TBH. If you route the guest network in your internal network you will end up with the internal traffic being routable from the guest network unless you employ ACLs which are more difficult to manage than firewall rules.

Spanning tree is the way to go if you cannot go for stacked switches. To be honest I'd always setup spanning tree if my switches allowed.

Just block the AP's talking to external, what traffic should they need to the internet. I have my home network completely locked down, management vlans can only talk to specific external servers, wifi management is a seperate vlan with access only to internal services i.e. radius, DNS etc. except for the Unifi Controller is on the WiFi management network at the moment but that is likely to be changed soon. But even that has only external access to update servers for Ubuntu.

There is very little difference between GPS and my speedometer at 30mph. Verified with multiple GPS units and I do have a digital speedometer in my car.