Bruce123

Interesting solution, the default of 20 mins sounds unnecessarily long anyway. Dropping to 5 mins should probably resolve the immediate problem (for a while - until more clients are added). And it would increase the frequency of ARP broadcasts (unlikely to have any noticeable effect on network performance). If you’re looking for a more long-term solution and don’t have much cash (you should speak to someone about that) you could do worse than purchase this switch (a refurbished with warranty): Cisco 3750X It comes in many variations. Get the 24/48 port 1Gbit version with POE (as per your existing switch spec). It’s a full later 3 switch. I don’t know what the max ARP table size is but will probably be at least 4,000. If you’re not familiar with Cisco CLI, you’d need someone to setup the initial config but it doesn’t sound like there is very much to translate over. Thanks, Bruce.

I’m a bit confused when you say you’re backing up using the bare metal agent. I’ve not used DPM 2019 before (only 2010 and 2012), but the term bare metal usually refers to backing up Windows (and system files) installed onto a physical host. On DPM 2012 it executes Windows Server backup to do this. But for virtual machines this would be pointless, as the normal and best way to backup VMs is to backup the host and select the individual VMs you’d like to backup, where DPM creates a live snapshot of each VM. I think this is what you probably mean? Thanks, Bruce.

Hi, I just wonder what firewall rules people have to allow Skype video conferencing in Skype for Business 2016? And also, what about internal Skype to Skype calls? (re ACLs on the core). An online search shows contradictory information. Thanks, Bruce.

The way to do it in MS DPM world is to have two DPM servers; one primary DPM server backing up your production servers and another (off-site) DPM backing up the primary DPM server. You can't backup to tape naively, only using some third-party software, which does leave a bit of a problem as regards longer-term backups. Thanks, Bruce.

As per ADMaster, running a consistency check and manually creating a recovery point for each protected source resolved the issue (effectively triggered the scheduled backups back into action). But I guess there's no hope that upgrading to DPM 2016 will resolve the the issue as the OP reported the same issue in 2016. So same issue present in 2010 (assume also present in 2007), 2012, 2016 1801 (RTM 2018) and not identified/resolved. Come on Microsoft 8 years to acknowledge and fix a serious bug! Stopping introducing new features and focus on fixing the issues. Thanks, Bruce.

We've having a very similar problem with DPM 2012. The Protection Groups show as OK and there is a green tick next to the Group and all it's members , but when you select an individual protected source (e.g. D:\ or E:\), it shows Lastest Recovery point of around 2 weeks ago. Essentially, DPM stopped backing up these volumes without even reporting there was a problem (!) never mind giving any reason. Microsoft, this is really bad™. I've seen the same issue many years ago when supporting DPM2010, but hoped the MS team responsible for developing DPM would have resolved it by now, maybe expecting too much... Yesterday, I installed the latest Update Rollup 14 and rebooted the server, and when I check again this morning the protection groups were exactly the same (as in reporting OK but with a latest recover point over two weeks old). When this happened in DPM2010, I did some research and found some a real horror story of where a company had depended on DPM 2010 to backup critical MS SQL DBs, and DPM was reporting that everything was fine. Until it came to needing to do a restore, when they found that backups hadn't been working for weeks (corrupt replica), but guess what, DPM hadn't noticed. I think it was due to problems like this, that they introduced the option of a running scheduled full consistency check into the Protection group options. In theory performing a regular full consistency check should pickup on problems with the backups/replicas, but they can be very slow and might not fit well with the backup window. So to answer the question, can you depend on DPM for your backups when you REALLY need it? The answer is No. There are loads of other issues with the way DPM has been designed (which make it unsuitable for Disaster Recovery), which I won't go into here.... Thanks, Bruce.

Is anyone using Smoothwall and eSafe together? We've been trialling eSafe (from http://www.esafeglobal.com) for some time (in conjunction with our Smoothwall for filtering), but are encountering difficulties in getting them to work together. At first we had a problem the root cert produced by an earlier version of Smoothwall (which didn't comply with the relevant standards), which caused it to fail eSafe SSL validation. We upgraded to a newer version of SM (Leeds) and produced a new root cert, pushed it out and all seemed OK with eSafe. But then we started get the cert errors again (seemingly at random). By chance, I tried pushing out the Intermediate SM cert (the interception cert) to the intermediate store on the PCs, and this seemed to resolve the issue (not sure if the issue was with SM or eSafe). However, having got around this, we are encountering an issue with certain sites, where if the user opens the site it fails to render properly in the browser and slows the PC down to the crawl while the tab remains open (in IE or Chrome). What we found is that the site (e.g. http://www.classcharts.com) typically makes use of a content delivery network for web objects (such as pictures, css etc.) and the browser isn't able to access those sites/objects. The sites are https and are intercepted by SM. Adding them to a group which disables SSL interception in SM seems to resolve the issue (and I suspect that asking eSafe to add them to their whitelist would also have worked). So basically we have found that the eSafe client doesn't always like https sites that have been intercepted by SM. We can add "problem" sites to SM's "no intercept" group, as and when they get reported. However, a major problem with have is with our XenApp Citrix servers (think a group of terminal servers), which grind to a halt throughout the week with 100% CPU usage on all servers in the farm. I am unable to determine which process is responsible because I can't get onto the server to check. As at any one time there might be 20 users connected to each server (each accessing a site) and we no way of determining if the issue is due to a (A) user(s) accessing a "problem" site or (B) if it is a resources issue (eSafe's decryption/inspection/encryption inherently uses quite a lot of CPU cycles). It matters because, the latter would require allocation of additional resources (we might get away with jigging the VMs around a bit or it may require additional hardware which has not been budgeted for). We would like to use eSafe, and ELT really like the reports their getting through (from the desktops), but we don't seem to able to get passed this issue. Are you currently using eSafe and SM together successfully? I'm especially interested if anyone is using SM/eSafe with Terminal services/Citrix and what your experiences are of this? Kind Regards, Bruce.

We had almost exactly the same problem a couple a weeks ago, it's uncanny. VMs wouldnt come up, esxi taking ages to load, pressing F2 caused mouse and keyboard to stop working (so could not view the logs), iSCSI connections (multipath) were showing as up, vCentre had trouble connecting to one or two servers in the farm, like it was having trouble connecting to the management interface. But the problem was because one on the two switches the iSCSI traffic traversed, had failed. But it wasn't obvious as all of the indicator LEDs were on, blinking etc. It was only after the Network Manager tried turning off all of the equipment that he noticed this switch didn't come up. Part of reason why we didn't notice an issue with the switch was that they are both on a private network between the ESX hosts and the SAN, so our network monitoring software can't see them. I'd suggest your next step should be to check the status of the switches between the ESX hosts and your SAN, if it's setup that way. If you have HA enabled, I would also consider whether it has attempted to migrate VMs from one host to another, and check that all hosts can access all data stores. I know it's not exactly the same problem, but does have a lot of similarities. Good luck... Thanks, Bruce.

By implication you're asking why we haven't yet upgraded to Windows 10 (I noticed your profile image) and using Edge as the browser (or indeed Chrome)? That being said, Microsoft are still supporting IE (just look at the number of updates that apply to it). Thanks, Bruce.

Update 2: I tried manually installing this update (KB4343894) on a test PC and tried running IE11. Still experiencing SSO issues, but when they seem to be even worth than before. When I do eventually manage to get SSOed into o365 and click on the square of 9 dots at the top left to list all of the o365 Apps and click on one of the Apps (e.g. PowerPoint) it now completely closes IE (!). At least before, pressing F5 a few times would get you in, now the user seems to be totally blocked from it. Not sure if this relates to some complex interaction between this KB and third party software we have on PCs or if it's a general issue with this KB, which was supposed to resolve an issue with a previous KB (but just made it worse). Good job we didn't rush to push this out to all PCs and servers, before testing. This is reminiscent of the a previous patch to fix a patch to fix a patch to fix patch..., which we experienced earlier in the year. Thanks, Bruce.

Just an update on this: Microsoft added SSO problems (on 22/08/2018) to the list of known issues with KB4343900 and on 30/08/2018 a new update was released to resolve this issue. I'm unsure why it seems that only a small subset of users were affected globally, it must pertain to particular configurations. Thanks, Bruce.

I can't see why a cab move is making you consider 'flattening the network'. I'm willing to bet it's probably not the best move at this time, but I can appreciate you're probably thinking that removing all the VLANs will simplify things, making it easier to sort things out. But by doing so (without proper planning) you could just introduce more issues. Just picking up one example, by removing the VoIP VLAN you may have to modify the static IP of the phone system (assuming you have one onsite and it's IP is in the VoIP VLAN) to one that is in the same range as the only remaining IP network/VLAN. And what about your firewall rules and QoS (as mentioned previously) and DHCP scope options (which the phones may require), to name a few? If you're unable to sort out the issues (resulting from the cab move) by yourself (no shame in that you didn't move the cab) then if I were you I'd advise management to get someone in to assist/sort them out. It might cost around £600 for the day, but it would be worth it to get IT ready for the start of term. Good luck! Thanks, Bruce.

Good morning, We have the system setup so that when users opens IE it opens the URL for the Office 365 Sharepoint site and (automatically signs them into Office 365). However, from the middle of last week we noticed that after opening IE11, and being forwarded through several URLs (as happens normally), the browser gets stuck on a white screen (the URL at the time being https://login.windows.net/(very long string), which is the one before being forwarded to the actual Sharepoint site (blahh.sharepoint.com/(string). Pressing refresh usually takes the user the the site. I have managed to trace the cause to an update KB4343205 (Cumulative security update for Internet Explorer: August 14, 2018). Or August 14, 2018—KB4343900 (Monthly Rollup), which all of the fixes in KB4343205. Installing the above update raises IE update version (in the About menu) from 11.0.70 (fine) to 11.0.75 (issue). On testing, the problem doesn't occur with Chrome (sign-sign-on works fine). We use I Am Cloud for authentication into Office 365. What would people advise? Raise the issue with I Am Cloud? They say the issue must be with Microsoft as the URL IE gets stuck on belongs to MS. Raise the issue with Microsoft? But why aren't all o365 users affected? Encourage our users to use Chrome instead, and hope that Microsoft may resolve the issue (assuming it's their issue to fix)? Any advise is much appreciated. Kind Regards, Bruce.

That's interesting to hear... Did either party give any indication as to the cause of the issues? Thanks, Bruce.

Just to update everyone on this issue. Adding the interception cert to the list of trusted root CAs on the client PCs didn't resolve the issue as we originally thought (the validation tool used by eSafe verifies certs right the way up the chain). Looking into the issue of the validity of the original Smoothwall root CA cert, eSafe used the Libre opensll.exe tool to demonstrate an that the format of the start/expiry date fields don't conform to the relevant RFC for x509 certs. And Smoothwall's suggestion of disabling the SSL interception feature of eSafe to resolve this issue would seem to negate one of the main features of the product. In the end we generated a new root CA cert in Smoothwall and used the same opensll.exe tool to verify compliance (no issues were found with date formats with the new cert). And, as of today we are using it (or more precisely, the new interception cert) for SSL interception in Smoothwall and is working fine. We have't yet tested compatibility with eSafe... Thanks, Bruce.

Windows 2012 R2 NPS. That's that I wondered, but where would you configure the accounting server IP (i.e. Smoothwall's IP), on the WiFi Controller or on the RADIUS server? Thanks, Bruce.

We are looking at setting up a BYOD network. We have successfully setup the SSID to authenticate users via the RADIUS server. However, also need our proxy/filter to know who the user is (for filtering and logging). We don't want the users to have to authenticate twice, how would this normally be achieved? Any advise is appreciated. WiFi: MoJo Proxy: Smoothwall (operating in bridged transparent mode). Many Thanks, Bruce.

We are looking at setting up a BYOD network. We have successfully setup the SSID to authenticate users via the RADIUS server. However, also need our proxy/filter to know who the user is (for filtering and logging). We don't want the users to have to authenticate twice, how would this normally be achieved? Any advise is appreciated. WiFi: MoJo Proxy: Smoothwall (operating in bridged transparent mode). Many Thanks, Bruce.

FN-GM wrote: Are you sure this is correct? Just because a switch has been elected a root bridge in a spanning tree instance it doesn't necessarily follow that all traffic will go via that switch. The main issue (if my understanding is correct) would be if this switch was rebooted or removed, it would trigger a re-election and all ports on all switches participating in spanning tree will stop forwarded frames (and go through blocking > listening > learning for stp) until convergence is complete. Depending on how long it takes to converge, users will experience a momentary loss in connectivity. The same issue applies when manually modifying the priority value, it's best done out-of-hours and with a serial cable connected to the switch, in case, for whatever reason, you need to change it back to what it was (*). Thanks, Bruce.

For ICND2, I don't recall having to make configuration changes, only use the show command to diagnose issues. But 3 years ago I did with the CCNA exam. Thanks, Bruce.

I passed the ICND2 exam on the 22nd June (score of 889 the pass mark being 810). Yay! Some feedback for anyone preparing for it: We are now on V3 of the exam (since late 2016 I think), some things have been taken out, in particular: RIP Frame Relay (thank God!). And new things have been added, including: MPLS/MetroEthernet BGP SDN (software defined networking) IP SLA Others So the only (interior) routing protocols now covered are: OSPF (IPv4 and IPv6) EIGRP (IPv4 and IPv6) Also, if have you only ever taken the full CCNA exam (like me), check what's not a part of ICDN2. For example: DHCP NAT (don't waste your time on something you won't be questioned on). The full V3 ICND2 syllabus can be downloaded here: https://learningcontent.cisco.com/cln_storage/text/cln/marketing/exam-topics/200-105-icnd2-v3.pdf I would start by downloading and reviewing it and use it as you revise to check you are fully confident for each bullet point. The actual exam was 90 minutes to answer 55 questions. So as a guide, by 45 minutes you should have answered 28 questions, otherwise, you might not leave yourself enough time to finish. I was at 27 questions after 45 mins and sped up a little finishing 20 mins early (you can't go back over previous questions). The questions were all multi choice. There were several practical questions (each scenario having 4 multi choice question attached to them). There is a warning at the beginning that some questions won't count (towards/against your grade) and are used for internal reviews of the syllabus. Thanks, Bruce.

I think I found the solution to this, there is a hidden (from the Exchange Admin GUI) attribute in the OwaMailBoxPolicy-Default policy called GroupCreationEnabled (which was set to False, which is now set to True). I don't know if this just applies to OWA or Office 2016 as well...

Good afternoon, We have used the following guidance from Microsoft ( https://support.office.com/en-us/article/manage-who-can-create-office-365-groups-4c46c8cb-17d0-44b5-9776-005fced8e618 ) restrict who can create Office 365 groups: Students - denied Staff - allowed As a test, the article suggests creating a new Plan in the Planner app and doing this confirms that Staff can create Office 365 groups, but students are restricted. Fine, but it appears that, if staff try in Office 365 OWA (and I think Office 2016) an error appears: "Sorry, the ability to create groups has been turned off by the person who manages your email". Anyone have any thoughts on this? I assume there must be a separate policy for Exchange. Kind Regards, Bruce.

Thanks for the info. eSafe confirmed that there wasn't a problem with the interception cert (only the root), so as a test we tried adding the interception cert to the list of trusted root CAs on the test PC and it resolved the issue (no errors). I guess the eSafe software doesn't check all the way up to the root of the certificate chain if one of them in the chain is explicitly trusted by Windows. Thanks, Bruce.

We have been testing a new product called eSafe (from http://www.esafeglobal.com). It logs what students are typing and performs SSL interception on the computer to decrypt traffic between the the browser and the proxy. The problem is it doesn't work properly and when esafeglobal have investigated they said the issue is because the "Smoothwall Root Certificate is not fully SSL compliant". We use Smoothwall operating in transparent mode (bridging). Their advice is to upgrade Smoothwall to (at least) Kenilworth, re-create the root cert and re-deploy it to the clients. That's a non-trivial task, as we have had to manually install the cert to non-domain joined wireless devices. Domain-joined Windows have the cert pushed out via Group Policy, so this shouldn't be too bad. We are currently on Leeds-4 (>Kenilworth), but I don't know what version Smoothwall was when the root cert was generated (or even that it was created by Smoothwall but it probably was). Anyway, the implication seems to be that an there was bug in an older version of Smoothwall that led it to create a certificate that wasn't 100% compliant with the standards. Has anyone heard of this, or have any experience of using eSafe with Smoothwall? Many Thanks, Bruce.