amfony

Hi Gang, Simple question -- SSL Gateway, as in, a single server/device that I can drop an SSL Wildcard Cert on and have it provide https:// for any number of internal websites which can be located on different hardware. How to do this, without ISA? And apparently current front end f/w doest support this either. Can anyone give hints, tips, assistance how ... do you do it? Cheers

Hi Ash, Thanks for the reply. I am aware that the groupings are restrictive by nature, and that the domain comp and domain user allows any computer in the domain to access the WiFi. My question is not so much: How can i only allow a select range of users to access the WiFi via Raduis authentication But Rather: How i stop non-domain joined devices from joining the WiFi via Radius authentication Example: A student brings in ipod/iphone and finds WLAN "Devices Network", when trying to join this network the i-device will state "this certificate is not trusted, accept anyway?", which they do, passing on their valid AD credentials. And there you go ... access. And to explain the "device network" has laptop trolley's etc. Thanks again

Hi Gang, I have a IAS config question. I have setup radius auth for wifi clients running over ruckus gear and it works all well. The config i followed was the "ashbys IAS" doc thats floating around here. Ill admit Radius-auth isnt my strngest suit so please bear with me. What i have is a WLAN that requires radius auth -- this required me to create a server certificate (from local CA) which clients then installed automatically. Clients then had to change EAP type to PEAP, select the CA cert to validate and hey-ho connection. On the radius server i setup the RAP to enable "domain computers" OR "domain users". Fantastic. Now i have students joining this WLAN with their Ipods/iphones/Mac's in general because when they authenticate against the WLAN it shows up "certificate not trusted" which they can accept and again hey-ho. Connection. Obviously i have setup the wifi auth incorrectly, or expecting the wrong result. What id like to do is to restrict access to this WLAN to computers and any user logged into that computer that are part of the domain. Opposed to "domain users" as it is now apparent to me this will include any device that passes correct AD credentals. Can any one shed some light or point to a more relevant auth scheme? Thanks in advance

Hey guys, Ive got a PITA problem i cant shake. Ive made an compiled script (autoit) that i want to run in labs and i want it to run automatically at system startup regardless of interactive logon. So ... service. I can do this locally via the srvany.exe/instsvr.exe method but id like to push this out before next image rollout. I have tried the sc.exe \\remote create method as well but here is where i fail. My service wont start with the sc method, but will with the srvany.exe method. What gives? I install the service as auto start, type interactive. Nothing appears in event log or sc query in regards to error codes so i am abit lost. Any tips or direction? TIA

Hi guys - long time no speak good to see eduGeek going from strngth to strength. If you wanted to find out which usb devices have been plugged into a computer download usbdeview.exe from nirsoft It will: List all devices (active/non-active/mass stor/HID etc) Allow you to delete old reg entries Run app on usb insert and most importantly ... it can do this remotley What you *could* do is run this remotley across all nodes, pipe out to csv or what evs you like and search for your usb serial number. "What is my usb serial number" i hear you ask -- run the same app on your local (day to day) machine where the usb would have been and see if you can remeber your volume tag etc. HTH mate

Hi Guys, Quick question - is there any compliance guide for educational institutions that we as IT mangers/Sys Admins we adhereing to? In specific email retention, file retention, external security requirments. Thanks

have you done a global check in yet? I dont use the eduJoomla package but i suggest you do both a global checkin and a reboot of the server (if wamp) or services (if lamp). Has this problem just occured? Or has it been encroaching? Or has it never worked?

Scripts for ISA Server and Forefront TMG

this is pretty awesome mate - thanks for the headsup

i use ghost gss - but ive heard some good things about image for windows

hi friend - not to sure with this switch in paticular but on my old 3com cores its not forward-broadcast rather its directed-broadcast which had to be configured. In addition on cisco gear ive used this was set in the web interface again with the term directed-broadcast hth somehow

i wrote a simple screen dumping app in autoIT that executed on every space bar/enter - that was so easy. im sure you could do that and customise as required.

What happened here mate? sorry for being daft (as u brits say) Also thanks for the input in the thread guys!

Hi Gang, Some what linked to my "whats up with 3com" thread in networking forum - has anyone heard/used/implemented the 3com x506 appliance as a web threat appliance. Ive no question in paticular but rather getting anyone's feeling on it as a product or previous experience. Cheers

Hi Guys, Just a curiosity itch I've never had scratched. What is up with 3com? All over this forum i read about primarily ProCurve gear, and if not that then Cisco. Is 3com a more unreliable/expensive/ brand then others? In addition to this whilst recently trying to source a 3com piece of equipment ive heard 2wice that "sorry we dont stock 3com gear anymore". Is 3com 'falling off' in the marketplace? Insert your 2 cents here. Cheers!

... and impossible which is implicit (sorry for skimming over this) and expand the broadcast domain x3? Would you recommend this in any production environment? Getting back on point i think that the OP has hit a critical mass on his/her network. This is the time to set things up the "right" way opposed to band aid fixes. However ofcourse its mid term (here i assume there aswell). Tough situation - maybe the subnet mask change IS the right choice here for a temporary solution?

Amfony FTW!

sounds like you need to incorporate some segmentation IE Vlans IE subnets IE routing .. sorry you will need this. If you are running out of IP's on a /24 network then you are only using max ~250 devices. Believe it or not this is not that many devices (as in, if you are using dhcp for clients then the static devices would probably take up %10 of your scope - therefore about 25 devices to manually configure, it could be worse!) Going from /24 network to a /16 just to get more ip addresses is - what i believe - the totally wrong way to skin this cat. What you need to do is segment your clients from your servers, your Wifi Clients from your wired etc. By segmenting you increase the number of network you are actually using. Using these new networks will ofcourse increase your available IP Pool by (if /24) ~250. I understand that this can be sticky (if your not comfortable with lan engineering so to speak it will be pretty tough troubleshooting) but routing/vlan-ing is the correct fix for this problem. Sorry for the "bad" news.

Hi Guys, I am having a hard time wrapping my head around the 3com OS thats installed in the 4500G. Since the only experience i have had with networking CLI has been the 3com OS in the superstack 3 series i am pretty lost. What i am trying to achieve is to VLAN my WLAN, which each AP (ruckus) that i am using will very nicely attach a VID to each relaitve WLAN. Ultimatley i am trying to achieve is to get different ip structures for each WLAN and better acl granularty. Now - all of my AP's (5) plug directly into this same 4500G. This switch has an uplink to a 'purple' interface on our secondary firewall to access internal and external resources. What i would imagine in my previous experience with the 3com OS would be to create vlan 10 (staff) and vlan 20 (Student) in addition to default vlan 1. Tag ports 1-5 with vlan 1,10 and 20 due to multiple vlans traffic going through each port (via each wlan .. via each AP). Now where i am getting a tad flumexed, is it seems on this new os i cannot do this? Or i cannot do this in a way where i think it is correct. In addition there is now an hybrid link type to muddy the waters. I attempted to make each port a trunk as i though correct but in doing this it removed itself from vlan membership. In addition to normal vlan practive where i canot make these ports part of more then 1 vlan unless they are infact .. trunked. Im a bit lost and it is fri afternoon here in Oz. Can anyone shed some light here with the commands or the tagging/untagging/hybriding in general. Thanks in advance gang

I too am interested on this answer. PacketFence works well with Nessus, but that requires credentials to interogate the foreign system i believe. Ive just had this same discussion but i could not find a solution that could provide compliance checking without some requirement for credntials (and rightly so).

if login is taking that long and host file manipulation is the answer then you have a DNS problem. You are either incorrectly configuring your clients to look at the appropriate dns server or the dns server itself has failed/is failing, or further still your dns might be operational but with incorrect AD information in it. As its role in the process the host file is the first point of call to check for name resolution for fqdn or non netBios names. Therefore if this file has the correct "answer" no other forms of name resolution are required and therefore a faster response. Whilst i havent actually tested the results i would suggest the time difference between host name resolution and dns server resolution in human-time would be marginal. If its not then check above DNS issues or if not again then check network congestion. HTH mate. More Questions just ask.

Whether they want it or not? haha sounds very state governement. To be honest the movement as a whole is abit of a joke as far as a national programme. But were running with it, enjoying its fruits while we can. Ofcourse everyone returns to the same point of: What happens when in 3 years the computers are write offs, who will buy/obtain these then?

define "help" - what do you have so far? If you have nothing then why do you require autoIT?

ahhhh i see - i was confused. but either way a good thing for us in the "broadband backwaters" of OZ. for thoes who dont know we have a fairly ridiculous monopoly on the nations network infrastructure via the telco telstra. The government deciding to create its own network and *totally* (i think) avoid this current network should create some waves in general. Exciting times!

i was under the impression that an entire county or group of schools were under the 1gb umbrella ... ill search the post where i read this