DGardiner

Mind you just to add, I didnt NEED firewall exceptions for meet to work - opening the ports to the media servers just bypasses the proxy so improves meet quality/latency

Easy way to test it, add a no https inspect for all traffic from a location that contains the ip of your test ipad. see if that helps, then do the same in guardian all traffic, that location "whitelisted" and if its connects its not a firewall/port issue its a url somewhere being messed with. Obviously, clean up after you have your results

Has this ipad logged in to its google account already or is this all pre login? Im running transparent, no auth for mine. i dont have those ports open specifically, i just set any to the meet media servers - probably should close that down but since google said theyre used exclusively for meet i was fine with it. Ive just tried an explicit proxy and its still working, though i have no auth enabled on it.

Youve missed something then. Ive got the 2 ip ranged listed on the kb article and a few something.google.com urls set to not inspect and my phone works fine. Quick check and nearly every url fell inside the Chromebook Connect category or the API and Web Libraries, just put a rule at the top of your ssl inspections for Websearch that is set to always inspect then underneath that apis/chromebook connect for dont inspect These seem to be the ones making noise from my phone - though if you havent made it past login its likely one of the accounts. urls https://hangouts.googleapis.com/ https://lh3.googleusercontent.com/ https://meetings.googleapis.com/ https://oauthaccountmanager.googleapis.com/ also depending on your authentication they may need excluded from that

If you run the live logs while trying the app. Avoid the root domain, but you can probably safely get away with the likes of accounts.google.com/co.uk etc apis.google.com etc justs needs a quick game of cat and mouse - this is an issue with pretty much and IOS app these days

The KB says its used exlusivelye for meet media? [h=4]Google Workspace IP address ranges[/h]These IP ranges are used exclusively for Meet to identify video meeting traffic used with your organization’s Google Workspace accounts and to deprioritize Meet traffic from consumer accounts. Allow access to Meet's media servers using the following set of IP ranges: IPv4: 74.125.250.0/24 IPv6: 2001:4860:4864:5::0/64 [h=4]Consumer IP address ranges[/h]The following IP ranges are used exclusively for media traffic coming from participants who are signed in to a personal Google Account or not signed in to any account. Allow access to Meet's media servers using the following set of IP ranges: IPv4: 142.250.82.0/24 IPv6: 2001:4860:4864:6::/64

Run the live weblock for your devices IP and see what its talking to its most likely the app using cert pinning somehwere along the line and then refusing to connect - the only thing i have open is the google ip block for this range https://support.google.com/a/answer/1279090?hl=en#zippy=%2Cstep-allow-access-to-uniform-resource-identifiers-uris%2Cstep-set-up-outbound-ports-for-media-traffic%2Cusing-proxies%2Cstep-allow-access-to-google-ip-address-ranges and then sat and selectively added some google urls to whitelist/no inspect, likely related to the login - connect for chromebooks might cover this

Smoothwall doesnt do v6 yet i dont think. As for the latter thats your issue to manage. As for unintended side effects, stopped my letsencrypt renewals working - Presumably the verification servers are not in the uk

Papercut can be a bit funny about the idrac if its connected as a network card - Gotta set the bind address manually iirc or disable the idrac>os interface

that said if youre not doing anything but basic image stuff, the serif stuff on osx is cheap and would probably do the job

Nope, doesnt work. Hasnt worked since catalina, i too had a cs6 licence so it wound me up a bit, id imagine running it in a vm is a bit crap performance wise

I just feel bad for The girl on the front desk.. I know ive been short with her a few times.. must be crap

1 Week later, no response...

Had a whinge at my account manager yesterday too.. must be having a good day there....

Id check the vlan if, it shouldnt be showing there i dont think - probably means youve set it as an external interface , none of mine show up anyway!

check your firewall rules, specifically check that the address object "internal networks" has populated with your vlan addresses. and the rules apply as you want. its possible youre rules have your main subnet set with ranges? if you can ping the sw interface its probably 99% firewall config just needing adjusting You will need to go into proxy > authentication policies and add a transpartent/explicit proxy for each of the new interface/vlan addresses unless youre routing between them. Also if you have the smoothwall being the "router" you wont need to mess with routes so clear anything youve manually added there - this might be misdirecting the traffic being sent back

Have you added an extra interface on the smoothwall in vlan mode? the default internal port is a basic port, wont do vlans - Im not sure of the hoop jumping to convert it since you will lose access when you delete the if...but you may be better puting the other 2 vlans on another interface? https://help.smoothwall.net/FilterFirewall/Content/3Network/1Configuration/1Interfaces/Add.htm

theres a completely free tier these days, offers an equivalent web based solution - but on that front google wins imo. https://www.microsoft.com/en-gb/microsoft-365/academic/compare-office-365-education-plans?activetab=tab%3aprimaryr1 Id kill for a teams equivalent.

the new gen2 ubiquiti switches have layer3 functionality - not used it yet but worth a look

Anyone have any info on how this works? theres no documentation on the KB/Release Notes Ive ticked everything but the UK - Is this firewall in general? the smoothwall portal? Smoothwall admin? ssh?

also one of them lists ps5/xbox compatable. if this is a requrement id make sure to check the reviews as they can be a bit funny - My brothers monitor wont let his ps5 turn on the increased refreshrate modes, not sure if thats the ps5 or the monitor playing funny though

if you only want 1080p sure, try and find one with 1440p atleast for that size

Your head needs to get on the phone. Academies can do as they wish. If your an authority school its gonna need to head to argue with them, i doubt your the first - Probably the LA trying to safeguard their contracts just like when they dispatch the safeguarding hit quads if you threaten to change internet provider.

i did ask them.

the dns service isnt accessable by schools but everything else is