SchoolsBroadband

We can do 1 full 1Gbit leased line for that price to many locations in the country. PM me if you'd like a quick quote. Dave

Hi @azurenation I can't help with smoothwall or Cisco but if you'd consider our netsweeper platform which is now on the latest v6.1 release then we'd be happy to get a school to show you what they think of our product linked into our connectivity portfolio. Thanks Dave

Morning all, the upgrade to v6 went through fine on Wednesday evening. There's a nicer front end and a number of new features in there for you all to get stuck into Thanks Dave

That would be nice but alas they are not the cheapest things in the world for a single vdom. Still it's much cheaper than an onsite firewall and allows for expansion too. Dave

Hello everyone, it's not often I post in this particular Cloud Forum or "big ourselves up" but we're delighted we've just won the Internet Service Provider Award for Best Security for the 2nd year in a row. This is for our hosted Fortigate Security and Netsweeper filtering platform which protects over 1,500 schools in the country on the back of our connectivity products. The Judging criteria was: Real-world benefits to customers Ease of use and integration options Innovative use of technology Effect of product/service on customer networks Mitigation of attacks / time saved for end users Overall cost savings Reach measurement Compliance with regulations (eg GDPR, NIS) Education around cyber security And in the words of the expert panel of judges "Winning for the second year running, the judges felt that Talk Straight’s focus on schools, starting the education and awareness on the importance of cyber security as early as possible, along with impressive customer support, made them deserved winners." See https://www.ispreview.co.uk/index.php/2018/07/winners-of-the-ispas-2018-uk-isp-internet-industry-awards-unveiled.html and https://www.ispa.org.uk/ispa-awards/winners/ We really are unbelievably chuffed to win. Thanks to all our customers and staff for their continued support. We've a lot more being released this year on the platform which will further enhance functionality and experience Thanks Dave

Yes, its gone out to contacts this morning to customers currently using Netsweeper only. Dave

Everything should stay as is and your auth portal will continue to function. The upgrade puts us in good stead for more major work we're doing in the summer where we'll be rolling out a new major configuration option for schools (new and old) thanks Dave

Lots of juicy features The biggest is Googleauth and proper LDAP integration (no more dir sync). There's also a lot more to come over the summer too Dave

If you've an onsite Rocket then you'll need to create a static NAT from your firewall to your Lightspeed Rocket. Then in your DNS entry you can say have rocket.myschool.com pointing to the real world IP address you've just assigned your static NAT to. Make sure you only open the correct ports in your firewall rules as you don't want to allow everything. If you're running your rocket in transparent mode then I think you also need to set he static NAT to go to the management port of the Rocket. Best ask Lightspeed support as its not something I've done myself but they should be able to help. Thanks Dave

that is very odd. I can't really help here other than recommending you contact Smoothwall support........

I may be wrong (and I'm really not trying to attack a competitor here) but didn't Jisc / Janet have many long outages due to DDoS attacks against its network in the last 12 months? Dave

@localzuk is right here. it doesn't matter how good the DDoS protection is with an onsite firewall if you're line can only take so 100Mbit and a DDoS is sending say 2Gbit of traffic to it. ISPs can do multiple things to mitigate DDoS attacks. We do quite a bit which his FOC and as our firewalls are hosted rather than onsite then the DDoS effectively gets blocked in our network rather than onsite so won't saturate your line. There are paid for services such as DDoS scrubbing which is a useful tool but is something you should pay for as ISP's do. It basically allows you to move your real world IP's from the ISP network to a VERY big network that has a dedicated anti DDoS network which will filter bad traffic and send on good traffic. Whilst the DDoS is still occurring you can then try find out why it's happening without your leased lines / network melting. The above is just for a volumetric attack of course. There are plenty of other types of DDoS which can target specific applications which can send router or server CPU's to max out. WAFs (Web application firewalls) are normally best for this if you've a device which is Internet facing rather than a LAN behind a normal firewall which is just running NAT. Have BT told you what type of DDoS you are experiencing? Can you get any logs from your smoothwall box to show what type of attack it is? DNS reflection is a common DDoS which BT may still be able to help you with without special anti-DDoS provision. See https://www.incapsula.com/ddos/attack-glossary/dns-amplification.html for an overview. Good luck Dave

that depends what functionality you want and at what speed. We are a Fortinet Gold MSSP so we can get you a quote for one, or you can use our hosted virtualised Fortigate firewalls if you take connectivity from us too which work out much more cost effective. I'm just going into a meeting but will send you a PM later around your requirements if you like? Thanks Dave

you just can't beat a Fortigate v6 of FortiOS which has just been released is really really good

agree with @exa_mark here. We too have some universities and local authorities that lease dark fibre and waves from us giving a layer 1 rather than a layer 2 based service. Dave

Yes I don't disagree with that. To be clear it's not our policy to install filtering without ssl decryption as standard because of the issues you highlight. Some schools have turned this feature off themselves or asked for it to be turned off. We do not dictate policy on this but give schools the tools to setup their filtering as they see fit. Dave Dave

I don't know Exa's system well enough to comment on what you can and can't do with it. I can tell though you can on Fortigates, Lightspeed and Netsweeper all when in transparent mode as you do a policy to an interface or an IP range. If you're on a proxy based solution (as we currently are on Netsweeper) then we just create another port on the proxy for BYOD networks and set that to not decrypt if that's what a customer wants. Easy.... Good luck @Fazza Dave

You could take a decision not to do SSL inspection on your BYOD network. Yes use a captive portal for auth so you know who is who but you could take the decision not to decrypt everything for ease of use. Dave

Is it a talk talk managed router or a wave 9 managed router that terminates the leased line as talk talk can offer managed or wires only?

One other thought, have you used wireshark and deep inspected whats happening with packet captures? Dave

Hi @synaesthesia, sometimes DNS can act a bit weirdly, particularly if you've got cached sites so you might want to flush your dns or try using another one such as googles 8.8.8.8. Bar that MTU is a good one to try but that would be a more constant issue. Talk Talk when you take a layer 3 connection from them (not layer 2 like we took from them when we serviced you) does use all sorts of caching wizardry going on in their network. if you VPN your connection and thus DNS requests and HTTP(s) traffic so it doesn't touch Talk Talks caches then this could take it out of the equation hence why you start to see improved speeds and no web issues. Wave 9 will need to speak to the right people at Talk Talk to get this fixed as from what you describe i'd lean towards that as the issue, particularly if the same thing happens if you just plug a laptop into the leased line with no Sophos box in the middle. I'm not meaning to sound bad on Wave 9 (as this is the same for all companies with their model) but that's a big difference between layer 3 (re-sellers) and layer 2 (wholesale providers with their own ISP network) as the later has full control of the network and can do what ever they want with the traffic, where as a layer 3 provider has to simply pass on issues to their supplier as they can't fix any network / ISP related issues themselves. Still here to help with any other suggestions if I can. Good luck! Dave

Janet / Jisc had direct funding from the government which meant that they could supply universities with very fast connectivity for prices lower than what was generally available on the commercial market. This though is now due to change as they are having their funding pulled so they have to commercialise the Janet network. I expect prices to go up at some point so JISC can recoup the funding they were receiving. Dave

The standard Netsweeper transparent solution does not work in our environment. The reason being is that we have numerous schools that have the same internal IP address range and Netsweeper in its current form can't support this requirement. As indicated though we are looking into a number of options at the moment to give our customers what they are asking for (Google Auth integration, Radius support and other features). Please watch this space on further update developments some of which I'm hoping I can divulge in the next few weeks depending on results of alpha / beta testing. I do not want to categorically confirm any solution until its fully tested as I don't want to set expectations incorrectly. I'm hopeful we will have a worlds 1st with our Netsweeper solution coming very soon so again watch this space Dave

Morning azureusnation, I'll get our product manager @RobMason on the case. I suspect this can be done and I'm even thinking of potentially putting a local version of netsweeper on a server in your dc..... I'll speak to Rob on Monday and we'll get back in touch shortly. Thanks Dave

Hi there. All of our policies are in place. We are going to be sending them to all customers I believe very shortly. Feel free to contact the helpdesk earlier if you wish. Dave