AlanD

Yes - the safeguarding report with smoothwall is good...better than anything else I saw when I looked at a range of firewall/filters a couple of years ago.... And yes, smoothwall is pretty comprehensive with its radius/BYOD/DHCP/DNS/reverse proxy/load balancing/ etc etc///...in fact the only thing it doesn't do is Single Sign On..... I particularly like the fact you can add AD groups to firewall rules.....Reports of Search terms used...and all the expected stuff for safe search and youtube etc. Buts its general reporting is not so good.....not complete rubbish...but certainly getting a report on a single user browsing history is....well a challenge that isn't satisfied. And the user interface is a like a cobbled together front end to DOS. ... And ticking a box to allow say "social Media" works for PCs...but won't work for wireless devices....when you have to visit several places, create various objects and rules for each and every application...and yes, that might include further separate firewall rules. Why there aren't sub categories for all the well known apps, and a box to tick for PC and another for wireless...and it automatically works, I don't know. Must keep their support staff really busy. Not that some of these things really matter because with increasing use of certificate pining and other techniques, mobile apps basically slice though any firewall invisibly if they work at all.

I don't have a problem with whatever the genuine "delivery" cost is. But I do complain when there is a "P & P" cost well above what I could send the same in the post office for a tracked delivery....or when you get charged P & P twice for ordering two items from Amazon or Ebay (from the same supplier)...because essentially they are "hiding" the cost of the item inside an inflated "p & P" charge.

...Oh and you can also advertise these services using DNS configurations - which would avoid using reflectors..but it would require manual entries for each device...and yes...its a bit complicated....but there are some web guides about how to do it.

OK ...but wouldn't - and don't use reflector...nor do I use wireless bonjour support (Aerohive - for example support bonjour across VLANs). And the reason we don't use it is that we have 40 or so teacher PCs with Airserver...so its a bit tedious to have a list of 40 clients appearing on your ipad and trying to choose the correct one...especially when the one you are looking for doesn't appear on your first attempt..... There are a free AirServer "apps" which you simply point at the QR code on the PC screen...and hey presto - it connects. No Bonjour across VLANs required...but yes - you do need routing between VLANs (which you need anyway). We use smoothwall for this routing - because its AD aware (unlike most switches) and so we have a rule that allows staff to connect ...but not for student to connect. And we do the same with printing - with a QR code pasted on the side of printers....puts an app on the devices....point at the QR code - and it connects to the printer....again without using bonjour....because again a large number of printers appearing in a dropdown list is really inconvenient. Bonjour is great for home use - and small networks...but not so good for enterprise...unless you have Bluetooth (or QR codes in our case) or something which can narrow down the selection to something manageable.

Only the hashes of passwords are stored in AD....so its not possible to get a copy of the original password into google without doing a password change and capturing the passwords on the fly... I get them to change their password to something easy - like ABC123xyz and then change it back to their original password. If its a password you set...you can run a script to do it for them....but the process of changing the password must happen. No sure why google doesn't do passthrough authentication - like Azure AD connect is capable of doing with Office 365 - so once users have signed on to a PC the google authentication would be automatic. Perhaps its because we still have an old version of GAPS (and GADS) but I always have a handful of users whose passwords won't sync after a changing them...until I manually intervene and set their password directly in google admin. Never understood what makes it work for 95 users and fail 5 users ...thought it might be a poor password...or mistyped...or something...but can't track down the common problem which makes it fail for these few exceptions.

Ah a like minded person...I wonder how many of us there are. I understand they reduced the cocoa content...and added more sugar....both of which added to my desire to avoid their products!

I think I'd be looking carefully at how smoothwall and the router are connected...And are you using wireless? How is that connected? Are you sure that wireless connection is not on the "wrong" side (router side) of smoothwall (which will support external filtering...). Or maybe router, both internal and external connections of smoothwall are all on the same physical cabling?

I don't think this model works very well for schools...web hosting a "controller" shouldn't be a significant cost...supplying a replacement guarantee for old APs isn't terribly helpful - as you'd probably have later APs as replacements (such as ac wave 2 models)….and they probably don't fail that often - of at all...and how many support calls do you typically make? Probably none at all...it just works...or should just work. And while the layer 7 stuff is great...its probably just duplicating what your web filter/firewall does (or should do). There are a number of enterprise WiFi solutions that don't have such on going costs..... We use aerohive - and their units are great...but I don't use or pay for any of their management stuff....and just program them via the CLI ...because they are fully autonomous - and know how to work with neighbouring units etc....but its not a solution for the feint hearted....and of course we don't have any fancy dashboard stuff...but it all works with 100 or so APs, with VLANS, radius authentication , etc etc....

Is this printer server a physical box..rather than a virtual one? I’d want to find out if it was actually printer traffic..by disconnecting them...

..I bought the package...works brilliantly with all tick boxes and registry settings waiting for you within the RM console. Do I think its worth £400?....probably not ….. but certainly worth £200....

1:1 for teachers...or class sets (shared devices) for students.... We use them....but keep in mind that they were essentially designed for one person to use their own device. So as soon as you start sharing them...compromises might have to be made - as one user may not store his data in the cloud (despite requests/guidance) and so it might disappear the next time they use it - or they can't find the same device with their material on...or they leave themselves logged on - so the next person uses the previous person's account...etc et. Yes there are addons like "shared ipad" and "classroom" which go someway to providing the kind of experience we take for granted with a PC logon, shared network storage and user profiles. But these take RAM...so make sure you have at least a 32GB of not 64GB device - otherwise you are going to run out of space very quickly if shared between lots of users. I'd use the "free" apple configurator and/or profile manager (an MDM) to start with (you need something like an ipads mini or mac book to manage them) ....but if you want to manage a lot of ipads you probably need an online MDM that you pay for - per device per year. Definitely don't want to be managing them with individual itune accounts...Apple will usually help you set it all up - especially if buying a class set of devices...

Well you don't have to invest in Apple's profile manager (or at least not any money ...because its free). It works just fine....for all the basic stuff....although there are reports of problems when you get to hundreds of devices...which is not our case.....

..what is wrong with Apple's own profile manager...apart from the fact that its free? ...No I agree...its not as feature rich as some of the other mentioned...but it locks down the ipads,,allows you to deploy apps (from VPP), etc The real problem with it for most users - is that because its free - no one is going to hold their hand to set it up....which isn't rocket science...but does need a bit of investigation. But personally, I 'd start with it - for free...and then decide if I really wanted the other features the paid for models provided. And definately get yourself appleclassroom - which allows shared use of devices and monitoring etc....

Out of warranty doesn't mean server has to be replaced...does it? I don't replace my car when its out of warranty.... although I would pay to replace a component if it failed..... So I'd be buying a hard disk - urgently - next day delivery....to avoid the hassle of any restore from backup procedure. Do a quick google to find out how to take the existing disk off line - and get it to reconstruct the RAID in situ....which should happen without taking the server off line.

I'd agree with all of the above. Schoolbase was the only product which was actually capable of delivering what we wanted.. To be critical...its not pretty....and because it does most if not all things...inevitably that increase the layers of complexity and decisions ... And when you can't get it to do what you want...you can either write some SQL...or most the time phone them up and they will write it for you.

Is the problem that the encrypted emails can't be scanned - and are blocked by filtering?

Another DHCP scope would not provide traffic isolation between the Guest and existing wireless. Users..could for example just change their IP address... you are ALWAYS going to require a certificate to inspect and filter https. You can decide not to inspect...but then they can practically go anywhere, without visibility or monitoring or filtering.

Its difficult top see how we could comply with data information requests - and/or other GDPR if staff used their own dropboxes….and why would we when google drive and Office 365 are available.

Timing and signal timing limitations means that usb operates up to 5m .....you could use powered usb extensions...but I have seen timing problems with promethean boards using such extensions....

We have both....and not had any problems.....in fact I like both..

Does this really need yet a computer solution? Can this information not be recorded in part of schoolbase…. I can see that such a system may allow direct entry by staff...but we always do our reporting via safeguarding lead...who then puts information somewhere in schoolbase where the rest of us can't get to.

Ah sorry - yes...FTTC is with plusnet....and we pay extra for 4 hour guarantee of service (Beware....guarantee of service...does not mean guarantee of internet provision - it means someone will be on site....or contact within 4 hours...as anyone with a leased line that fails will tell you....you can still be without internet for a fortnight should your leased line go down...longer if it means fixing underground connections....but they will have met their 4 hour response time by sending someone to you to shake their head and agree with you that there is a problem that needs to be solved.) And the 300Mb/s is with Virgin...who seem to have some kind of contempt for public sectors - denying them the services and advantages that are available to "business". I never quite understood why they should be treated differently - especially when paying the same fee, but apparently its something to do with business services being "managed" outside the UK...but they are not allowed to do that for public services... And we use smoothwall to monitor (and less importantly filter)....which costs a fortune...but does have good prevent strategy reporting "out of the box". There is a bit of me wanting to say its the only thing that is good about it. Note again, that it is "monitoring" which is key. Any number of free solutions will filter - or you could get yourself a draytek router and pay £40 for their DNS filtering....PFsense is another widely used free product - unless you pay for support.... or use Open DNS ....but not all of these filters use the non published filter/want lists that government make available for the prevent strategy. Many opensource...or American based filters don't even know about the prevent strategy....and while you could complete a list of your own keywords to flag up in searches for radicalisation, self harm, grooming or whatever.....frankly you have not got time to do this....and probably not the expertise either. We needed a solution that would be a firewall as well and one which provided reverse proxy (because we have internal web sites that need to be accessed)...and quite liked the way smoothwall incorporates a radius server so it knows about BYOD users...I think the Sophos UTM does all this too - but not so good at the prevent monitoring....but does do SSO for reverse proxy....

We use a load balanced combination of a business fttc 80mb/s and a business 300 mb/s costing £50 and £80 a month. Contention is barely noticeable during the day...but perhaps a drop of 25% in evenings...so much faster than a leased 100mb line.... And a lot cheaper. While filtering and blocking unsuitable material would be be necessary... Its monitoring that schools need to do... And producing reports of which user searched for what... Can be a challenge because in a primary school you may not be accustomed to have students login. Perhaps it's enough for reports to say which device... And teachers log which child used which device... I think I'd be talking to Lea first... Because fees might include MIS use or other lea services.... And they will almost certainly require you to reconnect your MIS to their systems... Sounds as if you could save money and get a faster connection... But it wouldn't be a cost free change... Nor effort free...

...and managing SCCM is easier than using CC4?

RM offer a cc4 removal service.. Leaving you with a vanilla domain. Personally, I'd be looking closely at that... And yes it costs money. Don't underestimate time setting up a new network... Assume you are going win10 S win7 finishes next year...