SchoolsBroadband

The Fortinet filtering is pretty good but in our experience too difficult for the average primary school teacher to use hence why we offer the Fortigate & Light speed combo. The default reporting on Light speed is also very good and easier to use than Fortianalyzer. That said we can offer hosted Fortigate & Fortianalyzer if you prefer as we offer this to our business customers and won best use of business cloud at a recent Internet Service Provider Awards ceremony. Fortigate is a brilliant UTM / NGFW which is extremely powerful. Dave

@whs1000 @sister_annex @Blue_Cookeh @CyBeRkId2002 Our sincere apologies on the filter 11 issue. Filter 11 has now become filters 11,12 and 13 to take higher load and add processing power. A full report will be with you soon and we are going to call any school affected. Please note this has only affected a small subset of our customers who were using filter 11 and not our entire base. It's been a very frustrating issue, particularly when we've had multiple hardware failures in a very short period of time but we've been working with Lightspeed on a fix for it which was rolled out today and we're hopeful this will resolve the issue. Dave

Does anybody have an RM managed MPLS / VPLS Wide Area Network which isn't from the Local authority? e.g for your multi-academy trust? I'm just wondering if they actually do them or not. @Coaten can you help? Thanks Dave

Hi folks, hope you don't mind me slightly hi-jacking this but Lightspeed will do full Windows Active Directory integration per user push reporting and a whole host of other great filtering features. We bundle it in to all of our broadband connections as we think its the best on the market. There's no need for any extra onsite appliances as its all in the cloud. Prices start from a meagre £2,600pa all in with an FTTC based connection. We can even do 100Mbit leased lines from £4,600 nationwide all in too. See Web Filtering - Lightspeed Systems and Schools Broadband - Fast connectivity and filtering Schools Broadband If you'd like a quote do let me know. P.S The draytek doesn't do much on the reporting side but you can export to syslog.

port wise the below should do the trick IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKEv2 (IPSec control path) IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv2 (IPSec control path) IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path IP Protocol Type=50 <- Used by data path (ESP) Also make sure you use aggressive mode in the handshake Finally some firewalls need you to turn off the IPSEC functionality within them for port forwarding to work e.g. on Drayteks. Make sure you are doing that too. And super finally if one device is behind a nat'd firewall and the other isn't then try to get the VPN device that's behind the nat'd firewall to initiate the connection rather than the other way around. Good luck! Dave

are one of the VPN devices hidden behind a NAT device I presume? i.e the VPN devices do not have their own real world IP address assigned to their WAN port behind a nat'd firewall?

we can't wait to be there @RichCowell

Also you shouldn't really have a cat5 cable over 85m long as it may not work at all due to signal degradation

I wonder who that was?! ;-)

+1 Lightspeed

on top of the doc @GrumbleDook has I also suggest you ask potential suppliers the following Is the service offered Prevent Duty compliant? If so how? Does it offer SSL filtering? Does it integrate with Windows AD and other auth sources as standard? Is the firewall / filtering a single onsite box or is it cloud based and fully resilient? Do they require an auto failover backup line? Is the school going to be using cloud based applications a lot rather than on-premise? If so then a leased line with guaranteed bandwidth may be more prevalent than say an FTTC line. Does the firewall / filtering product offer full easy to use reporting as standard on a per user basis and how are these reports delivered to the e-safety officer at school? How easy is it to setup reports? Can the ISP offer full end to end QOS for different applications and can they do full application control? Does the firewall support / integrate with endpoint protection? Who manages the software revisions on the firewall / filtering product? Can you upgrade or downgrade your internet connection mid-contract term? If so what's the cost and does it tie you into a new term? Is the company providing the Internet connection an actual ISP with their own network they can control or are they just re-selling somebody else's services? is the company providing the filtering / firewall solution an accredited partner of the vendor and do they have qualified engineers that have passed their training / exams? Just a few off the top of my head Thanks Dave

Northamptonshire cc did a good one in the past. @GrumbleDook may have a copy?

PM'd with the solution via our cloud based platform

The Technical Product Manager is a new exciting, varied and challenging role at Talk Straight & Schools Broadband. The Managing Director is from a technical background and we require additional resource to help him deliver new products into the business. Initially you will assist him by technically vetting and testing of new products he believes the business should be investing in. Any products we then believe are saleable and will be to the benefit of our customers will then be rolled out by you throughout the business. When not investigating new products and implementing process you may also be required to do some technical pre-sales / consultative work when that department reaches capacity at busy times of the year. This is a senior role and you will report directly to the board. • Investigate new products on own / in conjunction with the Managing Director. • Work with all teams in the business to deliver new products to ensure each business division understands how to interact with the product & it’s supplier. • Work with all teams in the business to ensure the smooth delivery of new products from sales through to support. • Ensure an excellent end user experience for our customers using the new products brought into the business. • Own process, document existing processes and optimise product process throughout the current products base. • Technical pre-sales support to the sales team and partners. • Bid / Tender support for the sales team including writing, costing and presenting for prospective clients. • Training internal staff and partners on new products. • Have an understanding of automation and integration into CRM. • You will be expected to travel to various events (nationally and occasionally internationally) to investigate new products and market trends. To be considered for the role you must be • From a technical background (ideally ISP or MSP). • Have a sound knowledge of TCP/IP. • Exposure to multiple firewall technologies and understand the principals of IP security. • Have a good understanding of broadband technologies and their place within the market. • Be customer focused, understand their challenges and how to create / find a product to solve these. • Be able to create solutions from the products you have access to (connectivity and cloud services) to fit a customer’s requirement. • Be able to present your solutions in tender format and in front of customers when required. • Have a good understand of VoIP technology. • Have a good understanding of Infrastructure as a Service and service virtualisation. • Have an excellent understanding of selling and delivering cloud based services that can harness the power of an ISP’s network. • Have a good understanding of other cloud based products which could be in addition to our current portfolio. Other desirable skills are • Commercial acumen. • Project management. • CCNA / CCNP / FCNSP / FCNSA . • Ability to work and lead teams encompassing all aspects of the business. All CV's to [email protected]. Closing date is 31st May 2016. Thanks David

Yes. It's been a little while since I've done it but you can still do an IPSEC to IPSEC tunnel with one end behind NAT so long as it makes the initial outgoing connection, you use aggressive mode in the setup and you port forward the required ports such as 500 for IKE key exchange. If your default gateway isn't going to be the IPSEC terminator then you'll also have to put in static routes on each PC or a static route on the current gateway device to point to the IPSEC gateway device for the remote IP subnet otherwise it won't work too. Thanks Dave

Interestingly you can also run a Fortinet vm on azure if you wanted to protect your remote servers in the same way as our lan with them. Email your account manager if you want pricing. Thanks Dave

@snagrat yes you 100% can. It's just a site to site ipsec vpn. Quite easy to setup. Call the support guys or alternatively why not beta test our iaas/ vm platform to do the same thing? No need for vpns. It's all layer 2 and on net! Dave

:-) Good stuff

Yes you can get the service provider to go to the DSO's office. If you are a customer of BT Openreach direct then this is something you can do too (although I suspect you'll go via your service provider). However BT Openreach can be picky about the reasons given from a customer for them to be accepted. Issues such as damaging OR's brand because of it (e.g. a school doesn't get its leased line and pupils can't access the Internet) are all viable, but if its just that your business has decided that it want's to change the way it works and now requires a leased line then this may struggle to get through. Still if you don't ask then you don't get. Things are changing with BT Openreach and new targets are about to be introduced and new processes to speed things up. This also includes compensation (although your service provider may just keep this themselves). We are a commercial partner / customer of BT Openreach so any more questions do let me know. Thanks Dave

I'd recommend a site to site VPN then, client won't really do it because of NAT which will occur via the IPSEC or SSL interface on the client so traffic can only be initiated 1 way. IPSEC tunnels have been about for nearly as long as I've been in the industry so I can't understand why the GFL couldn't support this. Dave

Hi Fiza, if the ISP in questions is us then you can do a client IPSEC VPN using Forticlient or SSL (recommended). You can assign different users in AD as VPN users or create your own user group on the Fortigate. The downside of doing this is you'll need to click connect on the Forticlient VPN software each time you turn your PC on or want to dial-in to the remote network. Also by default it'll be a "one way tunnel" meaning you can only instigate connections from the clients, not the other way around. If you were to do a proper site to site IPSEC VPN then you can allow any IP from one site to access any IP from another site or create access list rules and UTM profiles to protect both sites. Not sure why the GFL won't support this. Pretty standard stuff we already work with other GFL's and LA's. Let me know if I can help any more. Thanks Dave

yes use a Draytek they are quite cheap and brilliant to use when it comes to QOS and bandwidth management.

If its basically a re-badged Virgin Media cable modem service that uses DOCSIS then it's never going to give the same service as a proper leased line. Big differences between Virgin's DOCSIS cable modem and Virgin's direct fibre leased lines are Cable Modem is a contended service, leased lines are 1:1, guaranteed speed 24x7x365 Cable modem SLA is nowhere near as good as full fibre in speed, fix time. Ask yourself if this breaks and they can't fix it for 3 days (or longer) how is it going to impact my schools ability to function? What account management do you get that can actually do anything about your circuit? With Leased lines (whichever provider you use) you should get a dedicated account manager that knows what he's taking about. Can that really be afforded in an £80 per month circuit? Cable modems have a slower upload speed than download Leased lines can be upgraded to near enough any speed normally in 100mbit increments on a 1Gbit bearer. It's very similar to the FTTC vs Leased Line argument. My view is that normal FTTC is fine for small to mid sized primary schools so long as you up the care level on the phone line and broadband, but never for a secondary school or a primary of over 300 pupils. Alternatively if you'd like a quote on a proper leased line with integrated content filtering and security then do let me know as we are a wholesale partner of Virgin Thanks Dave

Hi @Blue_Cookeh have you a support ticket open with us? If not let me know and I'll get an engineer to give you a call. Thanks Dave

So long as your past the first year of a contract on a 100/100 you can actually upgrade to a 1gbit bearer for a set cost and increase in rental at that point. The upgrade fee is normally about £2,500 when using a BT based circuit. This can work out cheaper than getting a 100/1Gbit connection from day 1. Thanks Dave