JRA

I am grateful indeed thanks for that. I may well steal some of those ideas especially Smoothie doing the DHCP for a couple of my VLANs to come! Ok, so you have things in your VLAN 1 and also VLAN 5 and they can ping each other, that right? And get addresses from DHCP on .5.11 from other VLANS, that also right? How did you do the, like, doing of that part if you have a mo? As far as I can brain it, it should just need (if the LOT is plugged into the core switch in the following example:) - DHCP server untagged in default VLAN 1 in port A1. - A PC untagged in the classroom VLAN 2 in port A2. Switch has ip routing enabled. DHCP helper address has been set in VLAN 2, being the address of the DHCP server in port A1. IP address and netmask also set up for VLAN 2. Can ping SVI of VLAN 2 from the switch CLI. So far so good I'd think, but... DHCP server has a scope set up on it (to ideally server leases to VLAN 2,) gateway is the IP of the SVI. However it can't ping it. PC in A2 gets no IP address and can't ping the server nor the SVI. DHCP relay is even on in the core switch: It is proving very smelly. The pictures are ace though.

OK well today's re-visit of things sees me not wanting to involve the Smoothwall at all in the inter-VLAN routing. If I can help it. The world here seems to be (for the most part) just on the default VLAN here, trying to set up my own one for the sake of VoIP, and then eventually move the lot over. I have the VLAN set up on the core switch. Also enabled ip routing on it. Also also made an SVI on that vlan to the address 10.x.x.1, with a corresponding mask to the one in the DHCP scope, and that SVI will ping from a console session on the switch itself. I have IP helper set to one of the DHCP servers. The gateway in that scope in DHCP itself is 10.x.x.1. However that address which does ping from the console session on the switch does not ping from the DHCP server. Any ideas where to start the rummage this afternoon? Thanks all!

I'm wondering if it's even just that DHCP relay... the "IP address alias thing" (which I think is a sub-interface rightly? IDK what clever people call that) which would form the gateway address in DHCP of my VLAN in the working scenario in my head does actually ping from the server on the flat network, so it is "there." I'll try that when I'm back on site tomorrow and cross fingers but thank you all loads and loads for the help so far! EDIT - and on a marginally related note this was amazing: https://www.practicalnetworking.net/stand-alone/routing-between-vlans/

Yep, gateway for that scope (which is the scope for the whole network) is the Smoothwall box. Also just noticed my diagram isn't right (I crossed two cables following them.) A1 only untagged on something called the DMZ VLAN and that also goes to-and-from the Smoothwall. Updated that below: That DMZ A1 VLAN is also tagged on the ports that feed the VMs. This sure is a curious one! Extremely glad to have the hand also thanks very much.

I have drawn my very very best diagram: DHCP Relay in Smoothie maybe? All the Smoothwall box is getting is the one untagged VLAN internally. Although it has the one free NIC on it.

FWIW gateway set to the (now second) address assigned to the internal NIC in Smoothwall. Shouldn't stop DHCP getting an address to a device but at least that part is done. Or looks to be! No joy though, can't seem to get an address to a client with a cable into a free port on the core switch. Weird. Ok so the client (which is the test device plugged into the core switch) in untagged in just the one VLAN. Server itself is in just the flat network that exists around the place. I think my answer is in there *somewhere* I'm just not able to brain it. Anyone got any thinking at all on it?

Oops didn't see you there - thanks for that also! It's not tagged in the VLAN no, scopes are on the DHCP server. Not changed anything in DNS.

You're a god amongst men thanks Davit2005! Ok this might be a daft question but I'm going to ask it anyway... How does the DHCP server "know" which pool/scope to assign to a client? Does something in it "see" which VLAN is being passed to it?

Morning all, Just failing hard at something, hoping I could ask the collective for a hand-hold. :/ Visiting a new network for today and trying to complete some unfinished work on DHCP scopes and VLANs with an HP ZL core switch. Just trying to get one scope working for the sake of VoIP, otherwise a flat network. VLANS all in place on the switch and made up a new DHCP scope for the VoIP clients, but getting no leases given, and no connectivity showing on my test client. IP helper is in for the test VLAN, scope looks ok. *Think* where I'm going wrong is sticking the router address "somewhere" in the core switch. I know what I'd like it to be, but actually "plugging that in" is a different matter. Or I could be going wrong somewhere entirely different. If anyone out there can assist it would really really save me, thanks much for anything!

Thanks muchly all! Just wandering back in. Yep still gone. It's there as a startup script. But thanks all for the hints. Lots to explore but also reassured the principle still works. The specific .msi has enough issues when we doubleclick the thing so we're now doing some to-and-fro with their support on it. Cheers much though all and happy Fridays.

Hello all, This might well be a Windows 10 thing that has TOTALLY passed me by and if it has then this might be a daft question. But here I go all the same lol. Back in the day, it used to be possible to knock up a batch file to run at startup that went something like: if not exist "%systemdrive%\Program Files\aprogram\theprogram.exe" msiexec /i \\mydomain\someshareoranother\setup.exe /qn And that'd look for some obscure little component of your desired program and if it wasn't there install it. You could also force a reinstall of your program by deleting that little executable (or whatever file it looks for) and then it'd dutifully reinstall on a workstation at eg startup. Trying this on W10 (I think for the first time) and it won't reinstall the application when restarted. It seems to need it to be uninstalled from the add/remove programs bit. Is this "a thing" now and have I just completely missed it? Thanks everyone!

Yeah always lurking in the background is the old WDS route. I tried it a couple of times and I couldn't get on with it. FOG and the auto domain-join and the familiarity won out lol. All fine now, newest ipxe (et al) files in /tftpboot and I could then PXE boot, whole new UEFI image for the UEFI-types and imaging fine now. Well it would be if I could stop cack-handing unattend.xml...

Thinking it's far far too new to boot my legacy FOG image so I'm knocking up another one for the swanky new UEFI devices. Urgh.

(I love it when folks post their resolutions to things so cheers. )

Morning all, As I say probably a long shot but imaging these new laptops with FOG and it won't see the disk afterwards. Assuming some combination of disabling secure boot/odd UEFI settings will be it, but if anyone's trodden the path before let me know? I'll be MEGA grateful! Thanks all.

Thank you both. Yes bit annoying, only a small place though so fine really. I'll stick in a CNAME. Cheers.

Probably a confusing title tbh... Story is new place and a school we support has just noticed (could have been that way forever as it goes) that their website doesn't load on-site, but adding WWW as an A record in to DNS to point to the server hosting the site was the last way I fixed this. Been a few years though! Anyone know a more graceful way though? Just have the feeling there's a more optimal solution out there. Thanks all!

Morning all, Got a situation where I need to block browsing for a device (Chromebook) and not a user. However they will need to be able to log in to Google Apps, just not "get internet" if you see. They will however need to log in for their subsequent lessons on regular PCs, just not on this particular Chromebook. Is there any way to achieve that in Smoothie? Thanks all!

Rummaging this morning I'm convinced they're not right in this being an Adobe utility doing it. I am certain GCDS is running ok but for all the world looks like some odd exclusion rules I didn't spot on first dissection of things, and Google and myself between us led each other down some rabbit holes. What I don't get though is why some users, who should be hitting exclusion rules in GCDS are still showing up in proposed changes for the test sync, and why task scheduler seems to let this run on it's schedule but still gives me a 0xFF when it runs. Carrying on digging but I'm grateful for all the assistance/sanity!

I mean very much certainly "could" have yes. It doesn't look like either of the DCs though have anything else in task scheduler, which is where I've done some rummaging. There's lots that isn't adding up obvs, but once Friday meeting is done I should have a bit more of a clue. I hope lol.

Yeah the whole thing is rather odd. Believe me I wouldn't want to either, just inherited something that has passed out of knowledge and un-picking a few of the undocumented bits at the new place. I had as I say *heard* Adobe had something that'd do this, and literally the following is from Google: It's all rather odd but I'm kinda closer than I was before you folks came along so thanks much both.

Ah right right, thanks. Gosh it's useful to have some names and some process thanks much. What my issue seems to be though is Google are seeing the gmail users created by Adobe and (as far as they're saying) not by GCDS. Do you know what sort of Adobe utility might be doing that? I'll check those links after lunch also thanks for that.

I have a web genius bar opportunity with an Adobe customer support experience facilitator or something like that Friday so if I get any news I'll fill you in. Cheers.

Morning all, story time... Arrived at a (quite lovely) new place who are a Google school and I assumed had GCDS doing the AD > Google sync. I didn't have much to go on but GCDS was proposing changes that never went away, would appear to create some accounts but never quite clear all what was pending in a test sync. A scheduled task ran it against the current .xml file and didn't run quite right, with a 0xFF in task scheduler. After much to and fro with Google (who were also quite lovely) they on their end determined that "Adobe" were creating the accounts and running some sort of sync to Google. Now I know of (in a limited sense) there is an Adobe utility that can do this, I think for the sake of making linked Adobe IDs. But oh my word trying to find a human being to talk this over with at Adobe is near impossible without endless amounts of Adobe portal experience sign in registration ad nauseum with info I plain don't have here. I guess what I'm asking (finally) is does anyone out there manage their AD > Google sync with any Adobe LDAP-ish system? And is willing to get the sock puppets and crayons out and walk me through it a bit? Thanks all.

Oh my word thank you! Yes we have Jamf. You made my life better thank you I will try this.