ChrisC

As said above, worth checking which DCs are used for DNS on the appliance. Also, maybe if you have a quiet time during half term to test this again by taking the DC offline, (and without making too many assumptions that this wasn't tried at the time) would a reboot or logging back on to clients authenticate against one of the other DCs? Was everyone affected? Would Core auth/IDex work for your implementation? The main caveat being that user switching can cause misidentification as it uses login events on the DCs.

What authentication method are you using?

Is your firewall config allowing port 5228 outbound from the clients? Have you checked the firewall logs as well as the filter? You might need to temporarily enable logging on any relevant deny rules. If you try temporarily setting a guardian source exclusion for the IP while you test it, that will either confirm or rule out the filter causing it rather than the firewall. Remember to remove the exclusion once you've finished testing! Chris

I'd certainly raise it with support, if they have remote access available to the appliance they can hop on and run some checks in the background.

What model/age smoothwall appliance are you going through? Do you have any bandwidth management applied in the proxy settings? I saw an issue with an older S8 appliance a while back where we saw packet loss specifically during video calls which didn't cause any adverse affect with general browsing/streaming etc. After some investigation with Smoothwall support, they suggested there was an alternative Intel driver, that fixed the issue instantly!

I remember a few years ago (2018 according to the photo) M&S did a roast beef with horseradish mayo roll with a Yorkshire pudding in the middle, lovely!

I may be off the mark making assumptions, but are you struggling with it since MS depreciated basic auth? This may help: https://www.papercut.com/kb/Main/EmailBasicAuthenticationChanges

Thanks for the offer Lee, to be honest the school is starting to move towards another vendor at the end of the current agreement (likely to be Smoothwall). The only thing that was a stumbling block was a legacy setup of REDs implemented off-site, but this need has been replaced by an RD Gateway with MFA.

Just thought I should add that I've had experience with Fortigate, Cisco ASA/Firepower, Opendium and Watchguard as well as Sophos and Smoothwall, so I like to think I vaguely know my way around things.

A school I have inherited looking after has a virtualized Sophos XG setup. I don't know whether it's just the setup there specifically, but I find the config far more convoluted compared to Smoothwall (this could also be down to my familiarity with the products). All the firewall and filtering rules seem to be overly intertwined and there are a lot of nested options with ambiguous names that you'd think would just change something in the firewall or filter independently, which actually have an affect on other aspects (but you have to trawl through a hell of a lot of out of date support articles to find out). I can see that the firewall offering is more feature rich on Sophos, but to be honest in the majority of school deployments (not saying all) there's a lot there that people aren't going to need that can't be recreated with a solid config on a smoothwall. I know you can manage in the cloud with central, but do they offer cloud filtering for mobile devices?

Do you have a source exception in guardian for the caching server? I'm assuming you don't see a huge volume of your traffic actually coming from that box according to usage reports etc on the smoothwall?

If that seems to have helped, (if you haven't already) it could be worth adding sophos.com to a do not filter rule along with other related URLs/domains it could be calling as part of the real-time scanning. If every URL is being passed to/looked up by sophos then I theory I guess you're at least doubling the amount of processing required by the smoothwall per address visited?

I've seen some appliances update to Leeds 62 overnight and it's in the update notes that under certain conditions the guardian service could error out/stop responding. Could be worth trying to update?

With the last bit under services > directories > idex if you hit diagnose I'm guessing the number of groups/users looks correct? Also all the user groups are mapped to local ones in the directory?

I'm sure this has already been covered, but for sanity sake I'll ask if a few of the basics have been checked: The idex agent has been installed on all your DCs. A smoothwall access rule has been setup to allow the idex port (TCP 2948) from the DCs. Windows firewall isn't blocking said port from DCs to smoothwall. All the DCs policy is set to audit successful account login events and successful login events. When installing the idex agent on your DCs, did you specify the host by name or IP? Is replication all good between DCs if you have a DNS record locally for the smoothwall and it can be resolved from each DC? You've mentioned the file server, are there any service accounts running on it, and if so could you add a $ to end end of the account name so idex ignores it (or could this be causing it?). Have you installed the idex client (not agent) on any machines where multiple users login simultaneously such as RD session hosts? When you manually sync idex from the DCs using syncaddatanow (or whatever the exe is in program files) do they each report back successfully sent data? Have you enabled verbose logging? https://kb.smoothwall.com/hc/en-us/articles/360002135744-Turning-on-the-Diagnostics-for-the-IDex-Agent And if so, does it give you any clues? I'm guessing the idex directory in services is reporting back the correct numbers of users and groups?

I would echo it being DNS. It you manually set DNS on your device to cloudflare/Google does it have the same behaviour?

There's another tickbox setting in the DHCP global? settings to enable DHCP on that interface (even though it's all configured in the other page).

How old is the appliance? I saw a school that had some horrible teams packet loss in the call quality dashboard that was really affecting things. In the end it seemed to be down to a failing disk and the issue was only being picked up during teams calls due to the noticeable drops in the audio/video quality.

We saw an update last Wednesday/Thursday that seemed to cause 2 S8s (that we noticed) to become unresponsive. They were both the darker blue caswell appliances with the ports on the front. Do you have auto update enabled?

Yea, since the fraud while keeping the line open became prevelant, things were changed so that the line closes if either end disconnects. I have had it where my android (I think the call app) hangs when a call ended and wouldn't respond. I ended up just restarting the phone.

Hi Bugzi, What are you having trouble with specifically?

Do your mobiles have WiFi calling capability? I get next to no signal at home, so WiFi calling really helps!

No problem!

Guessing you're trying to set this in the CLI? Have you tried going into "menu" in the CLI and Changing it in the switch config from there, I think you might be able to overwrite it rather than adding the new one and removing the old....

It's not a C9 is it? I recently purchased one and find I occasionally have to turn the TV off and on to get the HDMIs to pick up