Davit2005

If your DHCP server has its gateway on the same L3 switch then that makes it a hell of a lot easier 🙂. vLANS don't add security on their own though and would consider either ACLs or enabling firewall on servers so you can lock down traffic from clients to the servers and even server to server 🙂

This is why I prefer as much home smart stuff to be local not relying on cloud at all. I use Home Assistant. The only issue I have is with WiFi smart plugs where I have not found anything as reliable as Hive, the three types I have tried mostly the relay fails or WiFi is PITA. I've tried Zigbee too and they fail. It must be the compact components?

They don't need to. The NPS/Radius server does it and whatever you have i.e. Captive Portal which is configured to point to the NPS as long as the NPS server is authorized in AD, jus a click on the drop down on NPS server 🙂 If you want total seperation you can put DHCP and DNS on the smoothwall too. If you want internal servers to handle DHCP and DNS you will need to set a DHCP relay option and typically allow the DNS and DHCP ports through. I have always jus allowed ports 67 and 68 both ways but it might only need 67 and 68 specific ways i.e. client to server and server to client.

If either of them understood this there should be an inbuilt method to remove unused profiles after certain amount of days with the flexibility to ignore specific profiles if required.

100% you want to limit the SSIDs. You could do this with 2 at minimum I suggest. The reason I'd suggest 2 is that you can hide the org (managed devices) WiFi to stop confusion then have one for BYOD/Guests SSID. The BYOD/guest can authenticate against captive portal and depending on whether staff/student or guest could be separated still. The managed devices can have a device certificate and the 802.1x SSID set in group policies. We had this setup at a previous org and it worked very well. Jus be on top of the certificate renewals for the managed devices. The video below is an example. https://www.youtube.com/watch?v=2G8rpnVFnAc

We used to get this when users sent huge files for print. Trying to print a very high resolution print job instead of compressing the image first which we got the students to do under teacher guidance and that sorted the issue.

The captive portal sends requests to the radius server and the radius server authenticates users against AD. BYOD should not need to talk to the DCs directly.

I'm too confused. I think you need to split this up a bit?? On the one hand you have what machines are allowed to join the network and on the other the user authentication i.e. what the user can get to on the network. Is this a 1:1 device org?

vLans in themselves on their own are not necessarily secure. Most layer 3 switches route traffic between all subnets unfiltered and without ACL as standard. You don't need to necessarily have one PSK, there is an MPSK version which can have a PSK per device. Strongly against PSK as too many devices make this easy to share and one it gets out there you would need to change any devices using PSK. For Wifi you will be hard to beat 802.1x with a self-signed cert for domain/managed devices. Any devices joined via captive portal could be treated differently depending on whether staff/student/guest?

Yep. Obviously a bit more work. The flat network should not be impacted as it is jus layer 2 with an IP interface only on the XGS. Any new vlans can be created on the core switch and as long as you have them in the bigger 10.10.0.0/16 range you should not need to do any more than create them on the core and edge switches. I'd also create the static route with a metric of 10 for a bit of flexibility. Directly connected interfaces will normally have a metric of 0 with the normal default metric of 1 for static routes. This is much lower than any dynamic routing protocols but that is another story completely and for a small network with minor changes not worth the hassle to create a dynamic routing protocol. Not only that dynamic routing protocols can take up system resources.

The unreachable would indicate it is getting to the core but not any further which could be a lot of causes i.e. vlan or ip routing. The core switch needs to know where to route default traffic too and the XGS needs to know where to send it back. A static route will still work to a VRRP IP address as long as you use the virtual address of the vrrp instance for the static route, therefore giving you redundancy. We have same setup between our current cores and our firewall. Stacking unless it is logical is always going to be a PITA. Although in our case the firewalls we use are active/passive and the passive firewalls interfaces are shutdown leaving only the active firewall interfaces up. But the core to firewall still uses a vrrp for the route from firewall to core. You could create a subnet jus for routing, this would be more advisable in my opinion, a subnet not used anywhere else. It jus needs to be a 255.255.255.248 (/29) network which gives enough addresses for the VRRP on the core and the XGS. It should still give you the flexibility although you still have a point of failure as in one firewall but less is best. So for instance: core to XGS vlan255 vrrp ip: 172.16.0.1 SW1 ip:172.16.0.2 SW2 ip: 172.16.0.3 XGS ip: 172.16.0.6 Put a route on the XGS for the 10.10.12.0 (vlan 30).

Yep looks like it. Not familiar with FS switches but in an earlier output the core shows following Gateway of last resort is no set You should be able to ping the core from the XGS, not familiar with those either but do you need to specify source interface or IP for the ping? It might be vlan tagging on either the XGS or core?

Yep you should of covered it with the /16 we do similar. You still need a route on the core switch thou? Do a tracert on the client that has a static IP to the DHCP server and see how far it gets.

The XGS will need to know how to get to the 10.10.12.0/22 network. Routers do not forward traffic unless they know where to forward it to. It will not be aware of 10.10.12.0/22 because it does not have an interface relating to that on it's system.

Try putting a route on the XGS to the vlan 30 subnet that you configured on the core switch. You will prob need that anyway to enable the XGS to know how to get to the vlan 30 subnet to route traffic back to the clients on vlan 30. assuming there is no firewall rules between the 2 interfaces on the XGS. i.e. route 10.10.12.0/22 via the core switch IP. I'm assuming you can ping the core switch from the XGS. Also it looks like you have no gateway/route set on the core. I think if your DHCP server was routed on the core switch you'd probably been cooking on gas by now 🙂

Is your DHCP server also routed on the same core switch i.e. has it's gateway on the same core switch? As @FN-GM mentions. set a static IP in the correct range, see if you can ping the default gateway of the new vlan, then see if you can ping the DHCP server (assuming the windows firewall on the DHCP server is set to allow). Trace the MAC address of the client to the core switch, if this does not work the could be a vlan config issue on an edge switch or anywhere in between. Breakdown into basic steps 🙂

+1 for TrueNAS. Was an avid Synology fan but the cost of *their* RAM then the debacle over the Supported HDDs I've gone TrueNAS. You can get a 2nd hand server relatively low power dirt cheap, put 10Gb cards depending on the availability of slots, etc. and much more expandability. If you don't need the feature rich apps of the Synology certainly worth a look.

Euro Truck Simulator 2 is taking a lot of my free time. Got a Stream Deck and mapped all the functions requiring a Keyboard and mounted that to the stand for my Logitech G920 with a 3D printed adapter. There is Truckers Tim channel on YouTube where he has built a full rig with a truck cab with 4 large monitors mounted on the windscreen, very impressive. https://www.youtube.com/watch?v=9K3p3j4lLQU

3cx makes adding phones a breeze as long as they are supported. You might have to add dhcp options on the dhcp scope though. https://www.3cx.com/sip-phones/dhcp-option-66/

Very quite with SSDs. One is in my bedroom and I don't notice it at all and a light sleeper 🙂

Dell or Fujitsu would be my go to. I'd personally steer clear of HP although they are pretty solid but due to the downloading of firmware without a support contract. Look at a minimum max RAM of 64GB depending on the VMs you are using, currently have 15VMs spread across 3 nodes in ProxMox but capacity for more. I've got 3 TX1320's in my setup 1 x M1 and 2 x M3's. The M3's have a non-Xeon CPU with options for Xeon (but watch for CPUs without onboard graphics) and quite power savvy. The M3's are very hard to get hold of sometimes. You can be stuck with 2.5" drives and the SFF M3 only normally has 4 bays attached via a single mini SAS although there are 2 SATA ports on the m'board. You can get a SATA card if you need more then jus either 3d print some drive caddies if you cannot source the originals (which I have found expensive).

Yes please keep that to the EV thread 😉

This is where the DSG and possibly others stand out. Due to the way the DSG changes gear. It pre-selects gears depending on whether you are breaking or accelerating so don't confuse it 🙂 The one thing I'd still say though if you want a greater driving involvement for fun stick to a manual. I have a Seat Leon Cupra but I think the old MK3 XR3i was more fun. Modern cars deal with a lot more things than old cars. i.e. I used to get awful torque steer in the XR3i but the Leon jus deals with it. Can put foot flat on the floor when pulling away from a junction into a road and it jus deals with it due to a trick LSD similar to what the Golf R has between front and rear wheels.

Autos these days have come a long way. If you do lots of town driving I'd defo go Auto. Autos can often be more economical than manual i.e. the DSG is a great gearbox. But not all autos are the same. The fiat 500 is jus an automated manual I think and behaves differently than a normal auto. Autos are generally easier to park, you can mostly get enough pull on an auto to reverse at low speed and therefore you only need to use the break peddle to control the speed. They may need extra maintenance too, do some research on the car you get.

What permissions have you given the account used to join to the Domain to the OU? I used delegated roles and not a domain admin then jus gave it the permissions to the relevant OU. Are the permissions still enough? What happens if you remove a PC from the domain and re-add. Do you still get the issue?