AlanD

It's a good question. I never thought RM support was cheap, but to be fair I would have difficulty faulting the quality of what they provide. Whenever I had a problem, unless it was something I knew immediately how to fix, I made them my first port of call. Often they would connect remotely and fix deployment of updates, packages, deployment of workstations or whatever. Not worth a whole extra technician, but probably half a technician.. And one that really knows his stuff. The other plus, is that it offers a degree of security for the school, should you get a better offer and decide to leave them. The downside with RM stuff is always feeling you are trying to do a job with one arm tied behind your back... But that also stops you from making mistakes and messing things up.

There is simply no excuse not to have certificates installed - because without them you won't be able to produce any reports of which students (and staff?)went where or when. We are not (only) being asked to "BLOCK" sites...indeed it can often be more informative not to block some sites and analyse the results with a view to challenging and asking students (and possibly staff) why they thought it was acceptable or necessary to use these sites. No; clearly some classes of sites just need blocking. But others are a disciplinary offence.

OK - so now I hear some of the right questions being asked. There is some difference between what you can get out of expensive (annual charges) APs and cheaper Unify ones - but all my experiments with a class set of laptops required a stop watch to measure the difference. One AP per classroom isnt always the best solution - sometimes trimming back on the odd AP will allow you to use wider channels without overlap, but if you are serious about using class sets of laptops with AD logins - you probably need to start with that in mind. Multiple streams MIMO, and MU-MIMO as good as they might seem on paper need a really strong signal to noise ratio (so I wouldn't be backing off any power on 5GHz band - although I might turn off the 2.4GHz radios on every other AP especially if that gave me 3 non overlapping APs). Even with the top APs, distant signals on the weather radar frequencies are often interpreted as being weather radar and the APs slowly one by one stop using those frequencies - which is annoying - even if you are not close to an airport. And keep in mind that wireless is a single collision domain...and with 20 or more laptops its not a case of take the speed you had with a single laptop and divide by 20....because you will be lucky if you get half of that. Good classroom management helps. Don't get laptops out...and step by step get students to switch on and login. That will take 20 minutes (possibly longer as some will get fed up waiting and decide to reboot their machines). Get them to do this as soon as they start arriving through the door so that by the time the last student has arrived - there is only that laptop to login. Better still if its one to one and they can login once at the start of the day and carry their laptop with them. In the real world - you are unlikely to see a significant difference between using "N" APs with 5Ghz than using "AC" with 5GHz....because the chances are in a dense deployment you are limited to 40Mhz channels - and no improvement at all if your laptops only have 2.4GHz chip sets. Yes - if you have 2x2 MU-MIMO chips sets in your laptops then with an AP in that room - it should make a difference. But with a wall and gap of 20 m - no chance.

So many questions....but let’s be clear with a wall and distance of 20m you are NOT going to get any of the benefits of ac channels and you may struggle to get anything reasonable from 5ghz spectrum, so you will be stuck with 20mhz channel on 2.4ghz band...the same as you might get with historic wifi kit. Add to this the fact that many ac chip sets in a laptop are single stream only and you are lucky if you are getting 144mb/s. The lure of ghz plus wifi speeds quoted by access point suppliers comes with need to understand how they might be obtained. Yes, if you have an isolated barn, and can use a single AP with single client, you can have an 80Mhz, or even 160Mhz channel, with 3 or 4 streams given a suitable client chipset. Then you might get 1gb/s at distances of a couple of metres. But....if you want lots of clients...and you are going to have neighbouring APs which limit your channel width wifi is Going to struggle...particularly if you want to do something more than browsing. Logging on AD to a server with user profiles etc and class sets of laptops is going to be tediously slow. Don’t let ant wifi seller tell otherwise. The AP will need to be in classroom for best results. An AP out in the corridor with signal through a wall seriously starts to limit what can be delivered.

I don't see why you can't put the certificate on a website that just uses http and make it the default page for those connecting to meraki. You cant force them to load the certificate and they will get warnings about potential privacy... But you can explain in text on that page why thay need to both load it and enable it in ios devices before https websites will workm

I always used netgear...found them to be good value for money and often bought second hand units for peanuts. Yes the fans can be noisy...and sometimes need replacing..and yes the inconsistent web interfaces and java used on older modules could be irritating. I learnt to avoid the expensive netgear modules costing hundreds of pounds, because the Chinese modules for a tenner or two lasted seemingly forever unlike the genuine modules. By the way, please note the correct spellings of ... independent...and separate. :-)

Are you using the office apps on iOS ....or just a browser. The apps seem ok for me. And you don’t have to use safari...chrome and edge work on iOS...

I agree, Ssd will be better than more ram. Although 2gb doesn’t work well with win10... I am concerned that you might not be doing yourself...or the school...any favours by propping up these 2nd gen i3 PCs. These are 10 years old. Even with lots of ram and a fast Ssd they are going to beep slow. Painfully slow. Slow enough to put off students and teachers from using them. Yes, faster than before installing the Ssd...a lot faster...15mph is a lot faster than walking at 3mph...but it’s still slow compared to 150mph that you would get with a current generation device. You will get the blame when these are still in use 3 years from now. There is money for stuff in schools..lots of it ...despite what they would have you believe, but they often choose to spend it differently...and you need to make sure the SMT understand that what you are offering to do with SSDs is not a long term solution...they still need to budget for replacements.

I think the whole chrome concept is brilliant. But....kids..and teachers, in my experience, hate everything unless it’s Apple iOS.

Raid 10 might give you best performance. I would probably set 2x drives in Raid 10 as a system/windows server drive. Then I would put 4x drives as Raid 5 to provide contingency and Maxine storage. I’m not sure I would use the 1TB Drive on its own...unless the school is happy with losing what is stored there. You would be unwise to use it as backup because it’s physically on the server....I’d use a usb ..or several of them in turn..fir backup...using windows server backup. Slightly surprised you didn’t plan what you wanted in advance! Rather than getting it first then deciding how to use it. If I wantedreal performance...which might not be critical for a primary school, I’d be wanting SSD as part of windows storage array to use as a cache. I’d also be thinking that it probably isn’t enough storage for a school given the demand of images and video in modern it applications. Perhaps you intend to have filestream for google or micro fats one drive for student material?

I don’t think...if this is an emergency backup, to have the supposed guarantee of EoFTTC... And I’d be looking at virgin, if you’re area is covered, because if a BT ...or rather openreach leases line went down..I wouldn’t want my backup to be from the same cabinet or exchange. If you went for something like virgin business 200mb/s or 300mb/s service and fed it into a load balancing router..or, fo example something like smoothwall, you would be able to use it all the time giving a welcome boost to bandwidth. You will need to think about allocation of IP addresses and SMTP and other externally advertised services to ensure if one line failed those services remained available. Perhaps they are already hosted externally, but chances are you then have vpn links to onsite school databases for sims or whatever.

I wouldn’t have more than one guest login SSID .and you capertainly don’t want any more SSIDs than absolutely necessary, because simply advertising their own presence consumes a disproportionate amount of WiFi bandwidth. In fact...the best solution by far might be a single SSID...and allocate AD usernames to guests... Use VLANs to make sure that a guest login doesn’t get to access any of your protected resources like servers. Guests...should be guests...not staff...who should get proper logins...and yes, their activity would be subject to monitoring. Note...that schools are required to monitor...and report...as well as filter. Over filtering can lead to a lack of monitoring.

Cynically...this just appears to be a "make over" in how they market their product...new web site....new talk....but the same stuff really. Smoothwall have always talked a lot...but in reality have been pretty slow to deliver what customers are asking for (better reporting....) but often get side tracked with other bits and pieces which customers are not asking for - and certainly don't have the money to spend on. Don't get me wrong - Smoothwall is basically a good product...one of the best..and one of the most expensive...and has good safeguarding reporting...and ticks a lots of boxes, acting as a filter/router/proxy/radius/BYOD/etc/etc ...but it increasingly seems somewhat clunky and limited...and therefore over priced.

I'd be surprised, albeit pleasantly surprised, if Apple's caching server worked with YouTube. Yes for apple updates, and regular web stuff. And most caching servers don't cache large files which tends to exclude videos from the outset.

I would use enterprise WPA for login, with a radius set that authenticates from a AD server using their normal login credentials. That means there is no further login challenges for filtering, and usually once students enter the data in their device it remembers it forever. There are schools that ban BYOD, but the reality is that students even in these schools are making regular use of their phones, beneath desks and behind books and toilets become an Internet cafe. With data packages of 20GB, 100GB or more for less than £20 per month they don’t even need to use a WiFi. And in any case most schools are completely unaware that clever students are able to crack WPA2 SSID passwords quite easily with free online tools. And staff rarely even hide the fact they are using Facebook during lessons... My philosophy is to embrace BYOD. Encourage them to use WIFi and at least monitor their use as well as possible. There are loads of good apps that can be used...and perversely students hate it when they discover that you are going to make them use their devices for something useful in the lesson. Students have always passed notes, and blown them in biro shells across the classroom. Using devices, is just the modern way. Pick up a device on the pretext that something is amiss and embarrass them by drawing attention to some Instagram message you find...that usually makes them pretty wary not to have inappropriate messages when they know you are likely to do this,

I doubt you will get a supplier to quote for ubiquity... Because the margins are too small... And the installation prices would be relatively high. Its an off the shelf, configure it yourself solution in general. Without k owing the scale of your solution it would be difficult to advise...but ubiquity probably doesn't have the layer 3 support for core switching... But it would depend on your requirements..

... So, I would guess that studs t experience is compromised by having too many devices in one broadcast domain....

I think users need to learn their own discipline when it comes to messaging...especially ouylt of hours. Some like to get an early heads up about an issue when others prefer to not see stuff until the next day. Having worked as a teacher in a boarding school.. It is kind of expected or assumed you are always on duty.. And in return you get longer holidays... But I know this can be difficult when youhl have families and other non school activities and commitments.

The Cisco Press CCDA book has this documented in the design section. Generally these are the guidelines. IP - 500 IPX - 300 AT -200 Hybrid (IP/IPX/AT) - 200 If you can, verify traffic loads with a Sniffer. That would show the client their traffic patterns and backup your recommendation of VLANing the network. I think you will find cpu load begins to get increasingly hammered when you get above 250 devices... Especially if these are wireless with printing and bonjour services... I'd probably split the user devices into year groups...

I remember thinking desktops will never want more than 64kb/s, then surely not more than 10mb/s....then thinking they won't want more than 100mb/s... In the end its the trunking that has lasted longest... Personnally, I'd put in something that would support 10gb/s at least to teacher desk, wireless AP, printers, and projectors... And I would have a few extra sockets for u foreseen extras.

I'm not saying you won't be able to do this yourself... But there are potential pitfalls.. And turns and twists on the way... I would recommend you get... And yes that means paying... For your local apple support to help you through this. It's one thing being a lead to deliver ICT skills it's another to blunder through a maze of operations that you have no experience of. There is danger.. that you would end up with a configuration that either doesn't work... Or worst.. Doesn't work well and causes frustration.

You could use apple's classroom metbod https://developer.apple.com/education/shared-ipad/ There is a paragraph concerning how you would force content to be deleted whe user logs out. IPads are not originally designed to be shared... The more you expect them to behave like shared desktops the more you end up with profiles, gpo, servers and all the other stuff..

Are there more distant APs which support 5ghz? Is it possible the newer cardin this lap supports 5ghz? Do you have band steering enabled? A known issue is a laptop connecting at 2.4g, on a busy AP. Deciding it would be better on 5ghz, but the signal is too weak, because 5ghz rarely works well through walls. Another issue I have seen on the edge of our campus next to a church was that neither ch6 nor 11 worked well at times. Discovered these times were whe the church used some non standard wireless mics they imported from China!

Multiple SSIDs are generally a Very bad idea, because the repeated broadcasting of their presence at the lower 'b' data rates uses an alarming high percentage of your overall bandwidth. It's not unusual for it to be 20 or 30 percent unless you configure your AP S away from their default settings. One SSID would be good if you are concerned about giving users maximum bandwidth. But sometimes it's necessary to have a second. I would use radius authentication to allocate different user groups to different Vlans ets. A second SSID which does not use enterprise radius might be necessary for guests... But WPA authentication is crackable by students.. Not as easily done as WEP but quite possible for students with a little determination and knowledge of how to Google it. Some schools... Simply have no Idea their students are connecting...

Are you sure its updates.. and not telemetry... Which seems to be microsfts equivalent for tracking everyone and everything...