AlanD

Please give some examples (there will be some of course...). I thought it worked pretty well - and although we had some complaints when it was first enforced - a careful look at what it was excluding - I seem to remember a Biology teacher complaining of lots of missing links - they were actually promoting alcohol and drugs and of very dubious class room use. Its not very helpful to have lots of links come up through a google search only to find that the web filter stops you going there....

I have often wondered whether I should do something about this.... I would say use MAC filtering on the switches - allowing school devices only ... Don't use DHCP - except for reserved MAC addresses - so they don't pick up an IP address when they plug in (...but of course they give it a static IP - which might be worse...especially if they set it to be the same as the local gateway....) Turn off ports not in use on the switch (doesn't stop them unplugging something to plug in their device....) - and adds the daily hassle when you need to connect up something new or something in a temporary location...

Perhaps your students are well behaved - or perhaps they don't know much about programming....If they have access to running any code it would be possible to do a lot of mischief for a laugh (even if its all seemingly locked down) ....or maybe it won't be such a laugh if you have to fix it afterwards. I've not had (or at least not known of) a concerted attempt by any student in recent years ...but that doesn't mean I trust them - the next generation of programming wizards. I think virtual boxes are the way to go - so that each time it starts they get a completely clean slate to load their code into. And I wouldn't give that box any access to the network....

Oh...I forgot about that...netgear has "lifetime warranty" too - so I would be surprised if they were not covered to some extent...In fact Netgear were really good when I bricked one switch doing a firmware upgrade...and they were ready to courier me a next day replacement - before I offered to reinstall the boot code via the serial cable...and that worked and I recovered a working switch.

We're all these in the same building? You didn't have anything naughty such as copper running between buildings? Can you swap power supplies between these switched?

I sort of feel that you need to gather some information before coming up with a plan. Is the data on a server? How much data is it? How much changes per day/week. Is there data on tablets (yuk) or in the cloud...or indeed in other random places..like pen drives(I strongly advise against these as a primary way of storing data...can't tell you how many times I've had students in tears after they have lost their course work cause their pen drive is corrupt....had staff in tears too after losing all their smart board lessons). Is this to be backup...to guard against some failure? Or archive to go back to something used last year and no longer stored? So it probably won't just be a "solution" but needs to be include rules where data is saved.... If it's stored centrally...I think windows server backup is really good...with some usb3 Drive adaptors and a cyclical swap of drives. Be prepared to be pro active...users need to understand they can still lose files between one backup and next...you need to check..daily...that backups are working...and they contain data that can be recovered. Give some thought to...saving everything in the cloud in office 365....which allows you to go back....

Actually...I think they are all generally awful. Symantec caused a server BSOD after a distributing a definition ...And we use Symantec mail security...and to be honest its interface and lack of flexibility is out of the ark. Well overdue for a major makeover. I would chane, especially if I could reduce the thousands a year it costs us, but have not seen anything that makes me think it's worth the effort of change. In the early days of migrating to win10 so perhaps we'll go with defender ....although the cost and learning curve of sccm is a dark cloud on that horizon.

I'm not arguing against RAID 6 (or 10 - although 10 wouldn't generally allow any two disk failure unless it happens to be a particular pair the disks)...but simply weighing up the odds against the cost of day to restore your disks. If - as in this case - there are no dependent services or other operations performed by the server - building from bare metal would take less than half a day - even including restoring the data. I agree - it would be an annoying waste of time - but as one disk failing is unlikely in 5 years - lets say 1 in 10. Then the chance of two disks failing should be 1 in 100 which is pretty low. If it was mission critical - and ran school office systems, etc then I wouldn't hesitate to recommend a RAID 6 - not least of all because its not a large part of the cost.

OK - so if you must have a leased line (and I'd want to take a close look at useage before I agreed that a leased line was the right option for a school) then this price sounds about right. Under £5000 and includes at least some kind of filtering (You'd need to check it links to your AD and is capable of producing suitable reports for "prevent" officer in school. Note Prevent does not require you to block or filter unsuitable sites - although that almost certainly would be necessary for some categories - but ideally you would leave some open if its likely to alert you to activities that might need you to take action)

Oh!!!! That explains everything. Thought they had really lost the plot. And turns out - they have. Still pushing out Silverlight version..... with only vague promises of an HTML 5 version. And their cloud hosted solution is So...S...L....O...W.... even with a gigabit link. Googlebye Eclipse....RIP.

OK. So this network is only for curriculum use by students (and few staff) ? So to some extent its not so "mission critical" as staff use a management network with MIS etc. Yes ideally RAID 6 provides a degree of extra redundancy. Its rare for a disk to fail - but they do fail. RAID 5 covers that. For a second rare failure to happen before the RAID is rebuilt - yes its possible. But surely that is what backups are for. If this "network" is only for curriculum use - I think I would consider just one high performance/proper server, and make the second a DC something cheap with SATA drives with no real role to play except to be able to recover the domain more easily should the first server fail. And I wouldn't bother with a SAN and virtualisation.

I prefer to ISP from filtering - or at least I would have some reservations that I was still getting good value for money. I certainly wouldn't want to tie myself to an ISP because they happened to include filtering for a inflated price. Filtering - is - relatively cheap. Draytek routers will do it for £40 a year with DNS filtering.... Sophos include it with end point protection...but it you need "monitoring" because you need meet the requirements of the prevent strategy you need something more substantial. And again firewalls are often incorporated into routers and things like pfsense are free - and are perfectly capable of being programmed with rules for what you want to allow in and out. If a leased line is right choice for you - and it might be - because you are part of multi site MAT in a shared domain or have cloud backup or are out in the sticks away from cabinets and cable connections then its worth aggressively shopping around - because Openreach have been reducing the prices - so 100Mb connections should be under £5000 a year now.

Yes, I agree Configurator and Configurator 2 would be among my "worst ever" pieces of software. Apple should be hung out for such awfully buggy and ill thought out software. Its fine for setting up new iPads - but as soon as you are handed a bunch of random ipads that need updating or applications adding you're better off wiping them and starting again. Apple needs to get some of their developers to work along side schools using and supporting stuff so they know where the problems are.

I'm sort of surprised how little space you use....perhaps our staff and pupils are more wasteful with space. I have seen a noticeable increase in media files for use in languages and our film club (who have been making short films) adding disproportionately to our requirements. In both of these cases - I would have resorted to some secondary NAS box if necessary. As a guesstimate I would be looking at least 3 times your current storage capacity. Like you - we are not currently virtualised. It practically doubled the cost 3 years ago and we found that too hard to justify - even though we would have liked it. SANs are cheaper now - and hyperV on Server 2016 is so good you don't need to look at VMware. And you can do clever stuff like using SSD/NVMe as "hot" cache and slower but cheaper 7200rpm as cold(er) storage. In a SAN you would get RAID 6 and be able to allocate disk sizes with more flexibility between the servers as your demand grows. You don't say if you have other servers - like MIS, or filtering, (cloud email?). Do you run GADs/GAPs/Azure Connect on existing servers? Consider what you are going to do about backups - capacity and timings (I'm a fan of windows backups - its not pretty but its free) and you will certainly want to ensure this includes some form of "Off line" backup like tapes or cloud. And consider your backbone/core switch. Not much point in a brand new wizzy server if you throttle all the data to your network. Maybe 10G server connections into switch are not unreasonable. We use 4 x 1GB LAG links from each server - which with a 4 disk RAID don't come close to saturating.

Oops. Sorry forgot the one off £14 or whatever it was for Apple's server. I confess I do not have large numbers of iPads - I'm not a massive fan of using them as a shared device - although absolutely wedded to one for personal use. I'm guessing Profile Manager is not so great if you are across a multi site MAT or something....but I can't see why it wouldn't work for 100 iPads.

Hang on a minute. Yes - it has some nice/welcome features....faster boot time, better hibernation/sleep and turbo control. And yes - Edge seems to work well as Chrome. Not sure they make it infinitely better though. It also comes with a load bloatware - including Cortana, APP store, Virtual desktops, Better gaming with DirectX 12. Not sure these have much or anything to offer educational use - and I don't make use of them at home either. Yes native support for NVMe can be useful - but they could have added that and some of these other things to Windows 7 - probably for a lot less than they invested in bringing tiles to Windows 10.

I am often (possibly sadly) pleased when these major ICT systems fail - be it banks, airlines, mobile operators (and perhaps less so the NHS). When these have armies of very highly paid, and indeed very highly skilled network employees and managers (...but perhaps that is part of the problem too) and their systems fail - I take some comfort for the very little downtime our school network has experienced in a decade. True - its a much smaller scale, and much less complicated - but nevertheless still vulnerable to all kinds of failure that I worry about daily. Are my UPS batteries OK? Are my redundant fibre links working via alternative paths around the school? Is the next Microsoft patch going to cripple something unexpectedly? If I wasn't worrying about some kit which is getting old, I worry about new replacement kit which often seems more prone to failure than the old stuff. The fact is - as I often tell the headmaster and governors - is that ICT systems do and will fail from time to time despite everyone's best effort and regardless of how much money you throw at it. And more money and sophistication doesn't always make your system more robust (as the Russian T34 tank proved in the second world war). I hope we do get to learn what went wrong for BA. My guess is that it will be something that no body takes responsibility for.

I still can't get my head around schools paying this kind of money. I pay £1200 a year. Now I do understand that schools once had to get leased lines - when ADSL provided 8Mb/s or 16Mb/s at best - and the upload speed was 256K. Usually school then paid for 10Mb/s leased line. As speeds increased to 100Mb/s for the same money schools thought they were getting something really good - but FTTC gives you 80Mb/s (and 20Mb/s upload) and that is fine for most things - including VoIP, Office 365, Google docs etc. In fact we have a 200Mb/s Virgin cable broadband as well - both originally fed into a draytek load balancing router - but now I feed them into smoothwall. If either go down (and FTTC modem locked up on a new version of firmware one day)...no one notices except it seems just a little slower. Ah what about contention I hear you ask. And the answer is that from 6:00am to 6pm its not noticeable on any speed test (Virgin continues to gives me speed tests of 2010MB/s) Only in evenings do we notice anything like a 10 to 20% reduction - which is still plenty. ISPs have massive available bandwidth during the days - its in the evening when people start using HD streaming it begins to tell. And - I hear you ask - what about guarantee of service. A lot of ignorance surrounds this. It does not mean they are guaranteeing you an internet supply. It means they are guaranteeing you a response (usually 4 hours) if the internet stops. If this is a failed router in the exchange it will take 24 or 48 hours to replace it. If its roadworks that have broken your connection it can be a week or more to restore your internet. And - by the way - you can pay for a similar guarantee for FTTC - it costs around £8 a month. When I hear school complaining of lack of funds and simply automatically renewing leased lines I loose sympathy with them. First step is to carefully analyse your usage. Our average upload floats around between 5 and 10Mb/s - even when using external services such as Office 365. Download on average below 50Mb/s - but yes, there are peaks - depending on the time period you average over - usually when I download an ISO image or something. And we use/allow BYOD too for students and staff. My guess is that a single FTTC or Virgin broadband line would be fine - but at that price having two connections gives wizzy speeds and redundancy protection.

Ah yes. The most important rule in school when doing exams. First read the question.... Is it not possible to point your DNS entry for school.com at school.sharepoint.com or add an alias in DNS?

No. You do not need to migrate to a new tenancy. I don't know the correct language to describe the process - but its possibly to add a domain. You need to go through a process to "prove" that you own the domain - by adding TXT records to DNS - and then you can assign users to that domain name within the tenancy. I started with a school.onmicrosoft.com (I assumed most did it this way), then added/registered our school.co.uk domain and went through the user list in blocks choosing the new domain name from a drop down box. You definitely don't need a new tenancy...unless you are restricted by RMunify or some other such sync product.

Apple's profile manager - which is an MDM - and free. Is it as good as Meraki? No - but Meraki is not free for new signups. It does the job. Using Apple's configurator was my first experience of using Apple Kit - and it wasn't a pleasant experience. Configurator 2 is fine for setting up a new set of tablets - but if you connect a random bunch at some later stage that may need different updates and different apps installing - its prone to getting completely screwed up.

There is nothing anywhere that equates pupil count with what you need. What you need is a good look at your usage graphs/data. For example our outgoing data averages out at around 5Mb/s throughout most of the day. There are a few peaks of twice this - usually when the office decides to send out an email to all parents containing graphics rather than a link to letter uploaded to the website which they are supposed to do. Download averages out at around 50Mb/s. And yes - we use Office 365 and google docs ..and various online stuff such as kerboodle and MyMaths. - but we are a smaller school at around 800 students from the age of 3 to 18. - Oh - and we have both staff and students with BYOD. To serve this we have an FTTC line 80/20 Mb/s which also provides some fixed IPs for security cameras, Heating Boilers, credit card machines and VoIP. And just in case that goes down we have a Virgin 200/15 Mb/s cable broadband. Both used to feed into a dual WAN router - Draytek - but now feed into smothwall for load balancing and fail over. Yes - becuase its broadband its contended - so yes there is some impact on download speeds - but I've never seen it have more than a 5% decrease - except in the evenings when I have seen a 20% knock. Thats still plenty of bandwidth though. Generally ISPs have lots of bandwidth during working hours - their problem is providing HD streaming in evenings so they have to over specify - which means lots of nice bandwidth during the day. So that costs us around £1200 per annum all up. Schools used to require leased lines because ADSL (at up to 8 or 16 Mb/s as never good enough as upload speeds were usually around 256K unless you paid for an Annex M service) - and many have just continued with them because they now get 100Mbs/s for the same money. But in reality normal broadband is now just fine for most schools - and certainly a lot cheaper. I guess the exception might be is were schools are sharing domain resources and access to common servers. My guess is that if you signed up for Virgin and ran it along side your leased line - and swapped it over the only thing you would notice is how much faster it was...and how much money you saved. Our 200Mb/s gives us around 210Mb/s on speed test at any time during the day.

No - If you are using smoothwall - you need to have smoothwall as your radius server and DHCP server for the wireless network. This is because it then knows who it has handed which IP address to as part of the authentication when they connect a device to the wireless. Yes - in theory you can use a different Radius server ...but things then sstart to get a bit more complicated if you want smoothwall to know who that user is - and which AD group they belong to etc.

Same here. We don't use NPS either (..we used to when we had a TMG box ...but never actually applied any meaningful policies with it as far as I remember). And we keep BYOD separated in the same way - using smoothwall's DHCP and Radius server the the BYOD network. And while we have routing/bridging we have some tight restrctions on which servers and protocols are allowed to access anything in our DMZ zone (basically the same as is allowed from an exterrnal access...except for access to bonjour/airplay/print for staff).

I suggest you join and ask on the aerohive community forum. I don't understand the response you had from Aerohive - or why they would give such a response. I suspect whoever gave the response doesn't understand the situation. It probably doesn't help by describing your role as "looking after" the WLAN.... I think you should describe it as "managing" the school wireless. I can understand their reluctance to allow anyone access to management rights on the basis of just asking for it. So maybe you need to get them to contact the Headmaster - or for the headmaster to contact them. I presume you are are paying for cloud management - so that must be organised through some agency - and they should be able to work with Aerohive to sort through something with Aerohive through their channels.