Primus

So it spoofs a MAC address - the very thing you said couldn't be done? MAC address spoofing is trivially easy, do not rely on it as it's not secure at all.

That would be for the MITM SSL interception certificate and at that point they're on the network so if they can't join the network they cannot get to that page. You could host the RADIUS certificate on your website and then people could download it over their 4G, trust it and then Android devices would allow connection as far as I'm aware.

It is trivially easy for an iPad to spoof a MAC address - that's literally what private WiFi addresses does. Advising people to move from RADIUS authentication to MAC authentication is an interesting one.

But MAC addresses are trivially easy to spoof?

I'm assuming you have Plus licences? I'm testing this at present and had to use the button the Classroom page to generate the link - then everything worked for my test parent account

It depends - with resilient networks and dynamic routing it's not always possible. I can predict where traffic from a given vLAN will emerge 99% of the time but if we have a failover of the node that traffic flows to then it will route to another node which is up - at which point it'll be knocking on the wrong Smoothwall. I find it strange that IDex replicates information within the nodes but the secret knocks don't.

Having a Mac Mini act as a caching server for OS updates, Apps etc can still be beneficial if you have large numbers of iPads.

So the secret knock tells the Smoothwall to ignore the requests coming from the device for the defined period so that it's not dual filtered (by the appliance and the extension) and it prevents double notifications from the on prem and the cloud safeguarding notifications. All Smoothwall would need to do is store the secret knock IPs in a database that could replicate - they already do this with IDex.

@tom_newton - I've flagged this to support before and it could easily be fixed by synchronising secret knocks in the same was IDex synchronises.

So because they don't share the secret knock they're not knocking on the correct Smoothwall to be able to have their temporary filtering exeption because they've got the cloud filter client/extension working is what I mean.

Is this because they don't share secret knocks like they do with IDex etc?

I mean you can listen or you can end up back in the same position again at some future, random and unpredictable point.

I'd urge you not to start using them - if this wasn't a lesson in what happens when you use EoL kit that relies on the cloud I don't know what is.

Yes I think you could help everyone by explicitly prompting them to involve their IT team!

We've ended up giving them access to settings - we restrict virtually everything anyways. Obviously test this before you do - but ours can't change much other than add and remove bluetooth devices. Our 1:1s can obviously add and remove personal WiFi SSIDs but they can't remove the pushed ones.

There are various ways of getting the certificate to people but you cannot push it out to a unmanaged device. What we do is we host an internal webpage with the certificate on it and as part of the instructions for using the WiFi it tells you to visit the page - the page then has instructions on how to download and install the certifcate on a range of different devices.

Fingers crossed - let me know how you get on.

Did this help at all?

Sorry I'm not sure what you mean about the first bit but if they've not got email turned on I think Classroom will show them invited classes on the Classroom homepage and they can click accept that way. Last one - that's up to your teachers/you. We archive all classes at the end of an academic year, our sync then runs against our timetables and creates new classes. If it were me I'd want a new class at the start of each year.

Either they join themselves using a teacher supplied code, the teacher manually invites them and they accept the invitation or you have some kind of sync software do it such as Salamander.

Have you tried backing the power off? We run: 2.4Ghz 20Mhz channels Low transmit power Minimum RSSI -75 5Ghz 40Mhz channels Medium transmit power Minimum RSSI -75 We've left all ours on auto channels - we're using hundreds of Unifi APs across 5 sites with no issues.

The OUs in Google Workspace have nothing to do with Classroom whatsoever.

Yup! We had one of our schools on hosted SIMS and did exactly this about 3 years ago!

RIP removal wasn’t ever documented and is vital for our WAN configuration. They got rid of the client as it’s meant to be a more compliant OpenVPN file Maiden produces/uses. You can turn the VPN service back on in the web GUI.

Yes I had two issues - one the service had been disabled (easy fix) and the second was routing issues due to RIP being removed from Maiden but not being documented - I had to rollback to Leeds.