AlanD

It's a good question. I never thought RM support was cheap, but to be fair I would have difficulty faulting the quality of what they provide. Whenever I had a problem, unless it was something I knew immediately how to fix, I made them my first port of call. Often they would connect remotely and fix deployment of updates, packages, deployment of workstations or whatever. Not worth a whole extra technician, but probably half a technician.. And one that really knows his stuff. The other plus, is that it offers a degree of security for the school, should you get a better offer and decide to leave them. The downside with RM stuff is always feeling you are trying to do a job with one arm tied behind your back... But that also stops you from making mistakes and messing things up.

There is simply no excuse not to have certificates installed - because without them you won't be able to produce any reports of which students (and staff?)went where or when. We are not (only) being asked to "BLOCK" sites...indeed it can often be more informative not to block some sites and analyse the results with a view to challenging and asking students (and possibly staff) why they thought it was acceptable or necessary to use these sites. No; clearly some classes of sites just need blocking. But others are a disciplinary offence.

OK - so now I hear some of the right questions being asked. There is some difference between what you can get out of expensive (annual charges) APs and cheaper Unify ones - but all my experiments with a class set of laptops required a stop watch to measure the difference. One AP per classroom isnt always the best solution - sometimes trimming back on the odd AP will allow you to use wider channels without overlap, but if you are serious about using class sets of laptops with AD logins - you probably need to start with that in mind. Multiple streams MIMO, and MU-MIMO as good as they might seem on paper need a really strong signal to noise ratio (so I wouldn't be backing off any power on 5GHz band - although I might turn off the 2.4GHz radios on every other AP especially if that gave me 3 non overlapping APs). Even with the top APs, distant signals on the weather radar frequencies are often interpreted as being weather radar and the APs slowly one by one stop using those frequencies - which is annoying - even if you are not close to an airport. And keep in mind that wireless is a single collision domain...and with 20 or more laptops its not a case of take the speed you had with a single laptop and divide by 20....because you will be lucky if you get half of that. Good classroom management helps. Don't get laptops out...and step by step get students to switch on and login. That will take 20 minutes (possibly longer as some will get fed up waiting and decide to reboot their machines). Get them to do this as soon as they start arriving through the door so that by the time the last student has arrived - there is only that laptop to login. Better still if its one to one and they can login once at the start of the day and carry their laptop with them. In the real world - you are unlikely to see a significant difference between using "N" APs with 5Ghz than using "AC" with 5GHz....because the chances are in a dense deployment you are limited to 40Mhz channels - and no improvement at all if your laptops only have 2.4GHz chip sets. Yes - if you have 2x2 MU-MIMO chips sets in your laptops then with an AP in that room - it should make a difference. But with a wall and gap of 20 m - no chance.

So many questions....but let’s be clear with a wall and distance of 20m you are NOT going to get any of the benefits of ac channels and you may struggle to get anything reasonable from 5ghz spectrum, so you will be stuck with 20mhz channel on 2.4ghz band...the same as you might get with historic wifi kit. Add to this the fact that many ac chip sets in a laptop are single stream only and you are lucky if you are getting 144mb/s. The lure of ghz plus wifi speeds quoted by access point suppliers comes with need to understand how they might be obtained. Yes, if you have an isolated barn, and can use a single AP with single client, you can have an 80Mhz, or even 160Mhz channel, with 3 or 4 streams given a suitable client chipset. Then you might get 1gb/s at distances of a couple of metres. But....if you want lots of clients...and you are going to have neighbouring APs which limit your channel width wifi is Going to struggle...particularly if you want to do something more than browsing. Logging on AD to a server with user profiles etc and class sets of laptops is going to be tediously slow. Don’t let ant wifi seller tell otherwise. The AP will need to be in classroom for best results. An AP out in the corridor with signal through a wall seriously starts to limit what can be delivered.

I don't see why you can't put the certificate on a website that just uses http and make it the default page for those connecting to meraki. You cant force them to load the certificate and they will get warnings about potential privacy... But you can explain in text on that page why thay need to both load it and enable it in ios devices before https websites will workm

I always used netgear...found them to be good value for money and often bought second hand units for peanuts. Yes the fans can be noisy...and sometimes need replacing..and yes the inconsistent web interfaces and java used on older modules could be irritating. I learnt to avoid the expensive netgear modules costing hundreds of pounds, because the Chinese modules for a tenner or two lasted seemingly forever unlike the genuine modules. By the way, please note the correct spellings of ... independent...and separate. :-)

Are you using the office apps on iOS ....or just a browser. The apps seem ok for me. And you don’t have to use safari...chrome and edge work on iOS...

I agree, Ssd will be better than more ram. Although 2gb doesn’t work well with win10... I am concerned that you might not be doing yourself...or the school...any favours by propping up these 2nd gen i3 PCs. These are 10 years old. Even with lots of ram and a fast Ssd they are going to beep slow. Painfully slow. Slow enough to put off students and teachers from using them. Yes, faster than before installing the Ssd...a lot faster...15mph is a lot faster than walking at 3mph...but it’s still slow compared to 150mph that you would get with a current generation device. You will get the blame when these are still in use 3 years from now. There is money for stuff in schools..lots of it ...despite what they would have you believe, but they often choose to spend it differently...and you need to make sure the SMT understand that what you are offering to do with SSDs is not a long term solution...they still need to budget for replacements.

I think the whole chrome concept is brilliant. But....kids..and teachers, in my experience, hate everything unless it’s Apple iOS.

Raid 10 might give you best performance. I would probably set 2x drives in Raid 10 as a system/windows server drive. Then I would put 4x drives as Raid 5 to provide contingency and Maxine storage. I’m not sure I would use the 1TB Drive on its own...unless the school is happy with losing what is stored there. You would be unwise to use it as backup because it’s physically on the server....I’d use a usb ..or several of them in turn..fir backup...using windows server backup. Slightly surprised you didn’t plan what you wanted in advance! Rather than getting it first then deciding how to use it. If I wantedreal performance...which might not be critical for a primary school, I’d be wanting SSD as part of windows storage array to use as a cache. I’d also be thinking that it probably isn’t enough storage for a school given the demand of images and video in modern it applications. Perhaps you intend to have filestream for google or micro fats one drive for student material?

I don’t think...if this is an emergency backup, to have the supposed guarantee of EoFTTC... And I’d be looking at virgin, if you’re area is covered, because if a BT ...or rather openreach leases line went down..I wouldn’t want my backup to be from the same cabinet or exchange. If you went for something like virgin business 200mb/s or 300mb/s service and fed it into a load balancing router..or, fo example something like smoothwall, you would be able to use it all the time giving a welcome boost to bandwidth. You will need to think about allocation of IP addresses and SMTP and other externally advertised services to ensure if one line failed those services remained available. Perhaps they are already hosted externally, but chances are you then have vpn links to onsite school databases for sims or whatever.

I wouldn’t have more than one guest login SSID .and you capertainly don’t want any more SSIDs than absolutely necessary, because simply advertising their own presence consumes a disproportionate amount of WiFi bandwidth. In fact...the best solution by far might be a single SSID...and allocate AD usernames to guests... Use VLANs to make sure that a guest login doesn’t get to access any of your protected resources like servers. Guests...should be guests...not staff...who should get proper logins...and yes, their activity would be subject to monitoring. Note...that schools are required to monitor...and report...as well as filter. Over filtering can lead to a lack of monitoring.

Cynically...this just appears to be a "make over" in how they market their product...new web site....new talk....but the same stuff really. Smoothwall have always talked a lot...but in reality have been pretty slow to deliver what customers are asking for (better reporting....) but often get side tracked with other bits and pieces which customers are not asking for - and certainly don't have the money to spend on. Don't get me wrong - Smoothwall is basically a good product...one of the best..and one of the most expensive...and has good safeguarding reporting...and ticks a lots of boxes, acting as a filter/router/proxy/radius/BYOD/etc/etc ...but it increasingly seems somewhat clunky and limited...and therefore over priced.

I'd be surprised, albeit pleasantly surprised, if Apple's caching server worked with YouTube. Yes for apple updates, and regular web stuff. And most caching servers don't cache large files which tends to exclude videos from the outset.

I would use enterprise WPA for login, with a radius set that authenticates from a AD server using their normal login credentials. That means there is no further login challenges for filtering, and usually once students enter the data in their device it remembers it forever. There are schools that ban BYOD, but the reality is that students even in these schools are making regular use of their phones, beneath desks and behind books and toilets become an Internet cafe. With data packages of 20GB, 100GB or more for less than £20 per month they don’t even need to use a WiFi. And in any case most schools are completely unaware that clever students are able to crack WPA2 SSID passwords quite easily with free online tools. And staff rarely even hide the fact they are using Facebook during lessons... My philosophy is to embrace BYOD. Encourage them to use WIFi and at least monitor their use as well as possible. There are loads of good apps that can be used...and perversely students hate it when they discover that you are going to make them use their devices for something useful in the lesson. Students have always passed notes, and blown them in biro shells across the classroom. Using devices, is just the modern way. Pick up a device on the pretext that something is amiss and embarrass them by drawing attention to some Instagram message you find...that usually makes them pretty wary not to have inappropriate messages when they know you are likely to do this,