Wave9_Lee

Replacement for broadband/filtering/firewall or CC4 etc?

Appreciate you're looking for peer recommendations, but I'd be happy to arrange a demo/trial of our services if it's of interest. Our approach is slightly different than some others, happy to discuss the pros and cons. cheers

Hi - my two pence here - we offer a hosted telephony platform to our customers, which is pretty well received. I think the benefits of our hosted system are; Cloud -hosted very resilient (no downtime in the last 5 years) Patched/updated automatically Co-managed - we make all changes, or you can do them yourself. This means the school/trust is not left without management/support if the network manager leaves or becomes ill etc. Simple cost-effective billing model All-inclusive per-user plan in terms of minutes as well as features Handset warranty for the duration of the contract I think as the IT footprint in schools and Trusts expands and becomes more complex, it's sensible sometimes to think about what 'non-core' services can be outsourced effectively so as not to become a distraction of have a single point of failure for management etc. Of course it's got to be supported in a way that suits the customer, and be cost-effective, but do think that telephony sits in this space.

If you'd like a quote for connectivity/firewall and/or filtering/monitoring, happy to oblige anytime. drop me a PM or email me direct if it's of interest, cheers

It may be some time ago, but you should have recieved these on installation. Also just tell them to give the information - You are the customer...

If you have identity probe timeout set to 120, but have 'Restrict client traffic during identity probe" set to 'no', then it shouldn't matter. But if you have the latter set to yes, then you'll probably get issues every hour for 2mins (120secs). See the STAS article here and search for 'Restrict client traffic': https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/125318/sophos-firewall-best-practice-for-stas

Try creating a new Web->Exception list, called something like Office Endpoints or so, and enter the RegEx's from that article into it, rather than using the Import feature. We've found that not only creates a lot of unnecessary Web Exceptions when you can have a single list, but it may also cause issues. Also, as others have said, if you're using STAS then check Authentication->STAS and 'Restrict client traffic during identity probe'. Once you've got the RegEx's imported to a single Exception list, you can remove the other ones which were automatically created by the Import method and see if that's any better. Include the more general RegEx's too, specifically for office.com (from the article, linked in the chat): https://support.sophos.com/support/s/article/KB-000038173?language=en_US

Spoilsport!

No problem - drop me an email or book a meeting to suit you using the link below

Be sure to check the fair use policy on 'unlimited' SIM Plans. Even on a 'Business Rate' there is an expectation (limit) around usage. Additionally, dependent on your location and network coverage, I woudl opt for an externally mounted IP65 router (not just the antenna) to give the best possible experience, as well as some flexibility on installation location that an antenna only, might not provide.

Forgive the biased response, but 100% agree with this - I understand the price pressures schools are under, but it's so important when considering (any) services to look at response times for simple changes as well as issues etc. Regular comms/updates about the issue, and increasingly visibility about what is actually happening on your network. To meet the price needs of school customers, some suppliers race to the bottom, but then can't invest in infrastrcuture, people, processes to provide the service that should be expected. No supplier is perfect, but if customers only focus on price, your supplier may end up less perfect than most!

Just for info, there is an extended support option for CXIA / server 2012. It shouldn't be that expensive, but depends on your supplier

@MYK-IT it's on the roadmap along with secure DNS. Some interesting developments in 2024 especially around MDR etc.

There's a good chance you can get FttP - according to the DSL checker all your neighbours can. It's often the case that the checkers don't show commercial premises or schools as being in range, even when all residential around can. Not sure if it's BT doing it on purpose, as FttP is cannabalistic to their revenues (compared to leased line) or just a glitch in the matrix. A good broadband partner ; ) could possibly get your site re-tagged as FttP available. There might be a bit of work to extend to the site or up a drive, but worth a look. Ref 5G even commercial 'unlimited' packages carry a fair usage policy. There are real costs to the telco for transit, so they can't offer true unlimited (for the prices that anyone would pay). Our 5G includes fixed IP, so telephony will work generally. As you say, leased lines are pretty bullet proof and have a 6 hour target SLA, so you're unlikely to hit any limits. If we were providing both primary internet and the 5G backup, Wave 9 would be carry any overage or additional SIM costs as part of our SLA.

I'm sure those of you in Kent are already aware, but just in case - with pretty short notice Kent County Council broadband service for schools (Cantium) is being withdrawn effective 31st March 2024. Any Kent schools interested in a Wave 9 replacement service installed in time can contact me on here, or via details in my signature. We've lots of happy customers in Kent if references are required. cheers

I'm not sure where (adult visitor) guest access falls in KCSIE, but it would make sense to have the guest SSID filtered quite stringently anyway. The Filtering guidance says that filtering should take place at network level, so even if using an agent based filtering solution, you should have some protections in place for non-managed devices, servers, whiteboards, guests, etc in my view.

Supplier perspective here (not the one in question!) My reading is that the bearer should have the capacity to provide 1Gbps, so a lower bandwidth is acceptable, but upgrade should be pretty easy/seamless. I would assume this statement comes from the knowledge that leased lines are available (generally) in 3 flavours of bearer, 100Mbps, 1Gbps and 10Gbps. It's pretty much a moot point when it comes to 500Mbps because this is very often only slightly cheaper than 1Gbps. 5% ish uplift for double the bandwidth. Due to overhead, encapsulation etc, max throughput would probably be 980-990Mbps on a Gbps bearer, so perhaps it's all non-compliant! I agree though that the DFE should be clearer about what the standard should be.

Leased Line pricing is quite location dependant and varies by provider based on their exchange footprint, network pop etc. If the telecoms provider does not have their own equipment in your local BT exchange, then they will have an additional cost to extend your connection to their nearest exchange. There is a per metre charge for this. Of course, if the price includes firewall and/or web-filtering etc, the price will also vary depending on the service offered I'd be happy to provide a quote for comparison cheers

Agree - I think Fastvue is a good addition to any enterprise firewall

There's full reporting functionality included in the standard firewall licence (user ID, blocked web attempts, suspicious activity, all the usual), and more customisable/scheduling features available with Central Firewall Reporting (small extra charge) but fair to say that Fastvue is a better experience, especially for non-technical users such as safeguarding staff - much easier to navigate, the URL clean feature is great, and includes alerting. Pricing is much better through us than previous too.

Hi @HyperTech - my contact details are in my siganture, and you can book a quick Teams meeting anytime to suit you using the calendar link. Happy to talk through the service/options and price up as required. Thanks everyone else, tenner's in the post!

It's via an Alt-Net - have sent you a separate email/price. No reason not to buy, just a few things to look out for.

We provide an 'outsourced' service for monitor/alert too via Lightspeed - if anyone requires any info or pricing, let me know. Lightspeed includes options for Classroom management amongst other things.

Standard protect is good for most users (base licence, network protection, web protection) Xstream licences adds Zero day protection (sandbox) and Central Orhcestration, which makes config and management of SDWAN easier. There are a couple of add-ons available, webserver protection, mail protection, but these are used less these days - comparison here; https://support.sophos.com/support/s/article/KB-000038005?language=en_US I think many of the solutions discussed on here and in the 'education' market will do the job compliantly and effectively - Personally think that the level of expert advice/support and ongoing responsiveness is getting more important as systems become more complex, requirements change etc (as well as price obviously!) cheers

Appreciate you're really wanting colleague input, but after that, if you want any info/pricing on Lightspeed or Senso, do let me know cheers