Wave9_Matt

Hi, based on what you say the alert is because the dashboard thinks there should be 8 switches configured in the stack when there are only 7 online. You may wish to: 1. Remove the offline switch from the stack configuration in the dashboard 2. factory reset it with a paperclip, remove the stack cables from the back as it reboots 3. then plug it into a spare switchport in the stack via standard Cat5e/Cat6 cable. Set the native VLAN of the stack switch port to the management vlan (assuming you have a mgmt. VLAN and it has DHCP enabled) 4. In the dashboard look at the connecting switchport for the LLDP / IP as the “faulty” switch boots. Check it reports an IP and watch the booting switch status LED 5. Also check the fw logs to see the outbound comms from the faulty switch IP. 6. It should come back up on the dashboard as a standalone switch with an IP from the mgmt. VLAN. 7. Once it does and all happy: a. add it to the stack in the dashboard, b. wait for the config to update and it to alert in the dashboard then c. power it down and cable it back up the stack d. power it back up and it should come up ok as a stack member. I assume your core is STP root? Meraki tend to take the start from scratch / by the book approach as it’s a good way to identify if there is a faulty switch and then zone in on the fault. As you point out though – sometimes that’s not practical during the school day. I hope this helps

Have you tried to use the console port on the front the cisco switches? A lot of engineers will put passwords on VTY interfaces but not the console. It worth trying if you haven't yet.

Hi snagrat. Have you looked at the Meraki MS425-16's? These are 1u, 16 port SFP+ based and stackable via 2x QSFP ports. For 10gig Server connectivity then the MS-355-24X (also stackable) offers 8x mGig copper ports along with 16x GigE ports. Both support LAG for increased uplink capacity and resilience. PM if you'd like to discuss. Thanks

If you have a mix of UEFI and Legacy BIOS machines you cannot use DHCP Scope Options to forward PXE requests to the Boot WIM on the SCCM DP / WDS server. You'll need to configure IP Helpers on the UTM to point at the WDS on the site at the other end of the VPN. As smarties11 said though it might be better to put a PXE enabled distribution point on the remote site, 100Mbps could take some time if you have a sizable windows image to transfer.

If you are looking for a replacement for the Aruba / HP 2530 range of switches and want the benefits of a single pane of glass management then its would be worth while looking at the new Meraki MS120 range of switches. Layer2, 24 / 48 ports with af/at PoE, SFP uplinks and all the benefits of the best cloud management platform, automatic software updating, hardware warranty + advance replacement etc etc. Definitely worth taking a look at: https://meraki.cisco.com/products/switches/ms120-24 If anyone is interested, wants a chat or a demo, drop me a line.

Hi Liam As has been mentioned there is a lot of interest in this kind of approach, especially from MAT's who are coming together and are seeking to bring services under a level of centralised control. The best architecture will be dependent on many factors including (but not limited to), the number of schools you have in your MAT, how large it is envisaged to grow, staff mobility requirements, how IT will be managed within the MAT, device and application strategy, backup and DR strategies, existing IT infrastructure within each school, finance and budgets etc. Most of these points constitute a much more involved discussion than can be encompassed within the scope of this thread. To provide you with some thoughts on your questions: A) Would this work? From a high level perspective yes, but the devil is always in the detail, as has been picked up on by some of the other respondents. If you have the ability to rebuild each of the schools AD then you have the option to create child domains from your Azure AD DS VM forest root. You'll need to be careful around the limitations of the Azure VPN gateway for the number of site to site VPN's and NAT Traversal etc, though most of this can be circumvented by using a third party Firewall VM (Sophos XG , Barracuda etc) hosted in Azure. Where you can't rebuild AD then trust relationships can be established between disparate schools and your forest root in Azure. In certain circumstances it is worth looking at a 2 DC per school with one on prem and the other in Azure - provides for a backup and DR quite nicely, though clearly each school would be picking up the cost of running that VM. It is worth considering elements of System Centre if you are going to have a light IT team supporting multiple primaries etc. We are increasingly seeing SCCM Primary site servers hosted in Azure with distribution points on local infrastructure within the school, it give you a central point of control for applications, updates and operating system deployment. Love or hate it, there is also SCEP which can be managed via SCCM for your entire MAT and the CAL's are wrapped up your O.VS Education Desktop CAL pac .If you go down the route of a Config Mgr hierarchy then you need to consider the network addressing at each school site to ensure that your addressing and consequently boundary groups are unique B) Has anyone done anything like this? Yes :-) C) If you have done it what have are the costs? This isn't a simple question to answer as it depends on the number and provisioning of VM's, qty and type of storage, ingress / egress traffic through VPN Gateway etc etc. The best way to approach this is scope the scale of Azure services for the size of your MAT and cost them up based on the publicly available pricing. The important consideration is how will it be paid, what is the MAT model, paid centrally or each school pays a proportion, does each member school pay centrally for all IT services?? Budgeting for Azure, as a consumption based service is more tricky as there are variables which will alter charges daily. Also be careful 'cloud lock in' wrt price changes and your IT budgets - Azure hiked its prices 15-20% Jan this year to 'align the GBP'. D) Do i have other alternatives - with the exception of site to site VPN or PWAN Communication from remote sites need to be secured, if you remove the option for site to site VPN over the public internet or a private WAN service such as MPLS and / or Express route then there isn't much left. Again this comes down to the shape of the MAT, if you have one secondary (combined with multiple feeder primaries) with a decent fibre connection and server room then you can do a lot of it yourself with your MAT / Team. Site to Site VPN's are easy enough to setup and if you select the right solution then you can manage the entire estate of UTM's centrally, useful for giving you visibility of remote site uptime as well as controlling trust wide filtering. You also have the option to work with a service provider who can deliver you a private cloud solution, this can give you more flexibility and a more predicable cost model than Azure alone. Anyway, I hope there is something in this response that is of value to you. Regards Matt

Hi, There are quite a few ways that you could achieve your goal though you can narrow the options down based upon budget, geography and terrain. A simple approach would be as shown in the diagram, when the civil works are done put in chambers and splice in and run out to the remote locations. This would create a hub and spoke network centered on one of your end locations using a L3 switch. You could run the whole network routed by putting L3 equipment at the end locations or L2 and terminate the VLAN's on the 'core' later 3 switch. You could also run the whole lot as one flat network but you'd have broadcast traffic everywhere. You could also create a logical ring using the same physical setup but this would only protect against equipment failure at one site - it would require more kit and you'd be best off with two core switches. As dhicks says, you could also run a physically separated ring between the locations but your dig costs could be quite significant. If the terrain is flat and your sites have decent elevation then you may get a lower cost solution from point to point microwave - that will happily scale up to Gigabit speeds should you need it. Hope this helps

Are you running anything like 802.1x where user vlan is assigned by virtue of logon credentials and group membership? Can you ping the server when logged on as a user and admin - assuming the later will work ok? Do you know what ports the client uses to communicate with the server application and are their any intermediate security devices / policies which may affect communication?

What you are referring to are called 'midspan injectors'. I've known them be used in a few networks, particularly for integrating AP's in to an existing network. The key considerations are, as Localzuk points out, standards compliance and making sure the PoE standard is correct for the equipment you use. Other factors are the introduction of an unmanaged device into your network and cost. If you are aggregating a quite a few AP's back into individual wiring closets / cabinets then midspans can start to look cost competitive with PoE switches.