DavidYoung

I work with @PaddyNewman at LGfL and wanted to update this thread with the fix in case there's any other LGfL (or other provider) customers experiencing a similar issue. Last year, a new technology called TLS-ECH (https://developers.cloudflare.com/ssl/edge-certificates/ech/) was rolled out by CloudFlare which hides the domain name from filters (all inline network-level filtering, not just ours). We quickly updated our DNS servers to counter this by removing the required HTTPS records delivered by clients and, more recently, blocking the underlying ECH domain (cloudflare-ech.com). This means that all LGfL customers using our DNS resolvers are fully protected from this bypass. Those not using our DNS servers (e.g. Google DNS, OpenDNS, etc.) will find sites that implement ECH aren't accessible as the protocol does not have a fallback. The solution here is for LGfL schools to make sure you're using our DNS forwarders (there are several depending on what YouTube mode you want). We also implement PDNS, safe search and other protections through our DNS servers. Making sure you are using HTTPS decryption is also important for proper filtering. Those using other network filtering platforms should check with your provider that they can properly filter ECH sites both when using decryption and when not. Hope this helps if anyone else has a similar issue. David

LiveRegister can do this. At my last trust, we had 2 secondary schools each with their own canteen but one catering company. We had 1 LiveRegister server which imported from both school MISs (SIMS then Arbor) and each school payment system (ParentPay then Arbor). Students and staff from both schools could purchase from each canteen. While the tills were separated into groups for each school, if they had just one physical canteen that would also have worked.

Hi, I would take a look at Bitfocus Companion: https://bitfocus.io/. It is a great bit of OOS for controlling lots of AV equipment. It's desginex around using the Elgato Streamdeck as a controller but also has timer based automation (triggers). Looks like there is a Sharp TV module: https://bitfocus.io/connections/sharp-tv. Hopefully will work with your model. David

Hi Koldov, Sorry to hear this is happening. Normal websites accessed through a browser shouldn't be showing as 'Host is an IP' which implies something Is going wrong with the SNI detection. Keeping Host is an IP blocked is always a good idea as it stops a whole load of potential backdoors, so I wouldn't unblock it to fix this. Do you have a case raised for this? If so can you post/DM the reference? Otherwise, drop me a email to SchoolProtect at LGfL . net. We'll get this sorted for you. David

Hi @Cat_Jam148 I'm leading on the SchoolProtect project. Can you drop me a DM with your school details. We'll get this sorted for you (and if I can't @PaddyNewman can when he's back on Monday). David

I checked on my iPad and got the same thing. It is definitely the Web Content Filter settings in Meraki as I took that off and was able to search for hot choc. Remember the filtering is managed by Apple so they may have simply added the term 'hot' to their denied list recently.

Sorry for not being so active on this thread recently. I changed jobs at the start of this year (not because of Arbor!) so haven't been as involved but I am trying to keep in touch with my former colleagues to see what's going on. We engaged with both suppliers (Arbor and Bromcom) extensively and had lots of demos from them. We did speak to some schools, including @supportman, who was very helpful, but I don't think we did a particularly good job of finding very similar organisations, i.e. MATs with primary and secondary and sixth form, ideally, with shared teaching across schools. I think this was mainly due to the time constraints placed upon us by a certain incumbent supplier... I think this is true and will become more true in the long-term. I maintain that this was the correct strategic decision and will pay off in the coming years. Just a word of caution that cloud-based MISs are coming at the problems from a very different angle and require schools to think about modern approaches to administration. And training, support, training and support for users.

Hi, I work for LGfL and look after some aspects of the web filtering. Can you drop me a DM with your email address and we'll take a look to see what we can do. Our schools have full control of their own filtering so are able to make exceptions for your app if it uses standard web protocols (i.e. https over TLS), however, if it uses non-standard ports then the school would need to make a firewall request for the port to be opened. Also, are you using your own domain name or an Amazon ones for all your communications? It's best if you have your own domain with subdomains as it only takes a single entry to allow the app. Drop me a message with your contact details and a link to the app and we can take a look. David

Ah, the Google policy probably doesn't process XHR requests then, only main/subframe requests which is actually the same as the on-device filter we operate for performance reasons. The other option would be to look at your network web filter. IF you have HTTPS decryption available, you could block that URL there.

I would suggest that is a bad idea and not great advice from Google! I have done a quick test with google search and it seems that trending searches are served from https://www.google.com/complete/search. If you add that address to the URL Blocklist setting in the admin console it should block the trending searches. Please test this before rolling it out as I have just quickly found it and don't know what impact it may have on other things but blocking it doesn't seem to break search. Information about the URLblocklist setting can be found here: https://support.google.com/chrome/a/answer/7532419?hl=en David

You can just use DKIM but the important part is Arbor need to turn on signing for your domain at their end. Once that is done it should all work.

When we set this up, we only added the DKIM records (the first 3 from your initial post) but we then needed Arbor to enable signing on their end once the records are in place. If Arbor don't make the change then the records won't mean anything. Once they have made the change you can simply revert the SPF record to what it was (just the Google one) as you only need either SPF or DKIM to pass (DKIM is better and more secure, if you haven't set up DKIM for Google I would suggest you do.). I would recommend signing up for MailCheck from NCSC: https://www.ncsc.gov.uk/information/mailcheck and setting up DMARC on your domain following their instructions. This will allow you to monitor all email coming from your domain to see what is failing (though it will take a few days for data to start being processed).

Hi @Chuckster I am an LGfL customer but am also working as a consultant for them with a focus on web filtering, so can see from both sides of this. It is annoying that you have to fit in with the IP addressing scheme and appreciate for new customers this can be a lot of work to change over. There are, however advantages of doing this. The main one is my area of expertise, Webscreen which need to be able to identify the traffic from the individual IP address to deliver per-user/per-device filtering and detailed logging. You absolutely can run VLANs on the LGfL network, 2 of my larger schools do. You just need to work with the support desk to let them know what the address of your internal router/L3 switch for the 'next hop'. Hopefully this makes sense. David

Hi Richard, Your story sounds very similar to us but about 1 1/2 years ahead. We're particularly interested in your journey with Edval and what you are using now (Timetabler?). We are struggling to get a working timetable out of Edval, regardless of the integration problems. Your comment about primary school functionality being prioritised over secondary school is fair and much of the system feels very much like it is focussed on how primaries work and the complexity of secondaries doesn't fit that well. I think part of this issue is that there are 6 times the number of primary customers (~3,000) compared with secondary (~500) so relevant features will get higher upvotes. It is also my issue with the survey linked in my first post from The Key as it does not split the data out by phase or perform any statistical weighting based on staff/pupil numbers, so the view from primary schools will always hold more weight. I also became so frustrated with being directed to the roadmap where functionality doesn't work (not feature requests but simply broken or implemented in an unworkable manner) that I preempted this response on one of my support tickets with our support provider (we are partner supported) that I would 'loose it' if Arbor came back telling us to raise something on the roadmap (I think that may have been around the time I started this thread...). I too had to do the post-16 census for two schools this year and it took days and days of work. I have never done it in SIMS (I am told it was a pain there too) but there are many ways that the Programmes of Study area in Arbor could be improved. We virtually had to manually go into each sixth form student to check and fix their programme enrolments. We are also finding the system unresponsive when dealing with large amounts of data, with more and more being added now we are entering assessment and behaviour data. I see the 'Sorry, something went wrong' message probably about 5 times an hour when using Arbor and I don't use it that much! Arbor as the solution to replacing external solutions is a sore point with us as they market the system as being able to replace all of the third party add-ons (we dropped ParentPay, Edulink One and Behaviourwatch), there is even a section in the onboarding process when they'll go through the apps and tell you which ones not to renew, but when we met with James a few weeks ago, the message was that they were not trying to be the best payments platform, parent app or behaviour management system, they are trying to be the best MIS (though with a fair way to go) and recommend integrating with external providers for 'best-in-breed' functionality. I'm going to send you a DM if you don't mind, it would be great if we could connect directly. David

That's weird, Wagent should send the logged in username to Webadmin to associate a client. What client name does it show on the block page, also, what Wagent settings do you have listed in the Google Admin console where the extension is installed?

Are you running Wagent on the Chromebooks? We have generally found this to be pretty reliable (not SBB, but Netsweeper), more so than on Windows (by the way, if you deploy the MSI as a service it is much better than login scripts).

Hi James, Thanks for getting involved. I appreciate the concern you have for your customers and, as I think I said earlier, have generally received good support from your team. It is just frustrating when the product seems to put barriers rather than solutions to certain issues that would have been simpler in SIMS or other platforms. I think we have managed to rearrange our meeting so you can join and I look forward to speaking to you. David

Thanks. We did work out that it was possible through the web version and have been telling parents this but, by default many people will look for the convenience of an app. It generally isn't a good look.

I'm not sure I quite understand this. Many things in Arbor such as memberships to courses, etc. are set up with date ranges and the report writer lets you set date ranges for different data types. Also, just a way that it is different to SIMS is that everything exists within an academic year. Has pros and cons, but just a different way of working.

Thanks. I think feedback is likely higher from primary schools, there are just so many more of them, secondary schools only make up 13% of Arbor's customers. I would have like to have seen that survey broken down by phase, and possibly also weighted by school size, I think the numbers would look very different.

It's reassuring to hear we are not the only ones, like you, I don't want to be negative, but we do need to see rapid improvement to the product. I can't really fault the team, we have had some good discussions around improvement (though the way they work with their 3rd party support partners leaves a little to be desired). My concern is whether they have the resources to fix the things that are needed and whether they would prioritise usability issues in current functionality over announcing new features. We haven't spoken to Edval yet but will do this half term. One of our timetablers ended up creating the timetable in Nova and then manually inputting it into Edval to import into Arbor which obviously very much defeats the purpose. Arbor works so differently to SIMS in terms of timetabling, in many ways this is a positive as it add so much more flexibility (we have a split timetable between KS3&4/5 which was not reflected in SIMS but is in Arbor), but sometimes too much flexibility is a bad thing as it is very complicated and manual! I have a long document of all the complaints from parents. The student portal is frustrating too as our sixth form in particular rely on it for timetables, etc. Simple things like the teacher name doesn't appear on the timetable so they don't know which homework they need to have ready where a class is shared between two teachers. Also, we often get students come in and say the app isn't working because they have downloaded it from the app store and can't log in and we have to explain to them that the app is only for parents. This is one of those things that we didn't look at too closely during the evaluation as I, clearly foolishly, assumed that having all that data in a single system would make it easy to report on. I was shocked to find that the reporting was worse than Edulink (which wasn't great for clubs but at least we could download the data into Excel/Sheets). We have worked to retrain our admin teams, in particular our attendance officers and in many cases you are correct that the SIMS mindset needs to change, but, those old ways of working need to be replaced with something better, not worse Likewise, I have recommended Arbor to other primary schools and wouldn't have much hesitation in continuing to recommend the product to primaries but can't at the moment recommend it to secondary schools. The time cost for us, which, particularly when dealing with things like timetabling or census issues have fallen on very senior members of staff has been high. All that said, staying on SIMS was not a good option, I just wish the move hadn't had such an impact on our stakeholders.

I have been hesitating over whether to post this for quite some time now but I have searched the forum and can't find much discussion on Arbor. The consensus seems to be a positive one with survey results such as this: https://thekeysupport.com/blog/what-do-schools-feel-about-their-mis seeming the norm (I'm sure there's no potential for bias in that article...) We are a MAT of 5 schools, 3 primary and 2 secondary and moved to Arbor at April, partly due to the SIMS contract changes, though it was something we were planning to do anyway, that simply changed the timescales slightly. Arbor's primary customer base seems to be primary schools and to be fair to them, for our primaries, the reception has been fairly positive. The problem comes with our two secondary schools. SIMS may have been an outdated beast but one thing it has going is that it is a mature product, tested and used by thousands of secondary schools. Arbor, on the other hand, seems incredibly new to the secondary market and feels poorly designed for the complex needs of secondary schools (we also have an additional complexity with our shared sixth-form). The main areas we have found the platform to be lacking is: Timetabling, Course Enrolment and New Year Setup - We moved from Nova T6 to Edval, partly with the recommendation from Arbor (Edval has been a nightmare too but different story) but the integration is incredibly poor and requires a huge amount of work in both systems to get the classes and courses linked up so the timetable can be applied (which in itself takes around 2.5 hours assuming it doesn't fail halfway through). Once the timetable is in, however, assigning students to courses and running the academic year promotion is very manual and very prone to human error. SIMS understood the underlying timetable model and generally only allowed students to be enrolled into courses that fit. Arbor will let you enrol anyone into anything (you can enrol a Y7 student into Y13 classes, for example) and then you have to work very hard to fix it. Parent App & Communications - This was an area we had high hopes for as we wanted a single portal for parents to access all their school data rather than several third-party systems. Unfortunately, the Arbor app/portal is incredibly poorly designed with little thought into usability. An example of this is that, in the app, parents can see the current lesson and the next lesson but not the whole timetable. Anyone stopping to think for a few minutes would realise this information is useless to parents as generally, they want to see what lessons their child has tomorrow, not what they currently have. There are many other failings that have made our parents feel it is a big step backwards. We were on Edulink One before with SIMS which wasn't perfect but was very intuitive and widely used. Communications is also not great as the method of selecting recipients is cumbersome and easy to pick the wrong person, has already led to minor data breaches. Also, internal communications is not great, for example when communication records are added, there's no email notifications and behaviour notifications can only go to a single member of staff. Payments - We also moved away from ParentPay shortly after moving to Arbor and have faced a lot of problems here such as no low-balance notifications, no auto top-up, not easy to see previous payments, it doesn't remember card details, staff can't use payments (except for lunches), various problems from finance around reconciliation. All-in-all, I have a list of around 70 items that I have sent to our account manager at Arbor which they are going to respond to. I think the team at Arbor are trying their best and we have had several discussions with account managers, product managers and the support team around our struggles and needs and they are receptive to feedback. I appreciate the extra pressure they are all under as their customer-base has grown by over 50% in the last few months. I have high hopes for what Arbor will hopefully one day become. I think the platform has a lot of promise, it just needs a lot of work as things stand. I often wonder if we made the right choice as we were also evaluating Bromcom at the same time, though I can see they have had their share of issues. I think the move away from SIMS was the correct one (though it would certainly have been easier to stay with it) and fits into our cloud-first strategy, I think I was just hoping that there would be significant usability benefits for our end-users, they just are yet to be seen. We are getting some further training for some of the advanced functionality (not related to the above negative points) and these have been good so far. I think my point here is the question posed in the title is anyone else struggling with Arbor?, as it feels quite lonely here when everyone else seems to be saying it's the best thing since sliced bread while our staff for the most part hate it! But also, a cautionary tale that the grass is not always greener on the other side and, while we expected a certain amount of pain, the benefits we were hoping were going to offset this are yet to be realised.

My case with Google is still open and I have tried to escalate it several times with little effect. I have generally found Google Support to be helpful but in this case they have confirmed it is a 'known issue' and their engineers are working on it. I've had the same message every time I have asked for the last month. The most affected user is one of our head teachers and it is happening to him several times a day causing much frustration and lost time. If it is a known issue, surely it should be listed on the Workspace Status Page but it apparently doesn't meet the criteria for this. Probably because if they listed it then their uptime SLAs would be decimated.

I've raised a support case with Google and sent them a screen recording. As it seems to be a wide-ranging issue, it would probably help if everyone affected could also raise a case.

We have seen this too on several accounts on multiple tenancies. Has anyone raised a case with Google support?