james_yale

10GBe on ProCurve here as well, we're using the first generation short range optical stuff and did have to have some new (OM3) fiber pulled but it works well right upto (and slightly over) the 350M recommended maximum distance. There are some newer fiber modules now (J9144A) that will do 10GB over older fiber, I wouldn't use copper interconnects between buildings - it's not very scalable for future use and there are issues with electrical if the buildings are on different supplies (highly likely).

What is the netmask on the access point? You should also be able to somehow get the AP to dump it's routing table which will tell you what the current default route (and gateway) is.

iSCSI targets act like any other normal block device, and creating hard links is dependant on the file system (which is a(few) layer(s) above the block device) so it will work normally dependant on the FS you're using.

If you're going to the trouble of cabling the whole room wouldn't it make more sense to run your cabling back towards some central managed location rather than having lots of switches bolted to desks?

A NFS or SMB mounted share is definitely the way to do this, duplicating the storage seems unnecessary. The problem I suspect you will run into is permissions on the mounted share, whether you've copied the data across or not. Since you will be accessing the data via the web server the permissions applied will be those of the web server, not the user logged into Moodle (in this case). This will make it difficult to enforce access permissions on the data you're trying to keep private between different sets of users. In Moodle 1.9 there is a module called smbwebclient which creates a SMB connection using the credentials of the logged in Moodle user, getting round this problem but as far as I know nothing like that exists for Moodle 2 yet.

Ah I see - interesting configuration. Good news is that it should be fairly simple to achieve what you're after as it's a fairly standard configuration for authenticating against AD, just without the extra encryption you usually do that the same time. You should be able to make a start by following the guide here (as posted up thread): FreeRADIUS Active Directory Integration HOWTO - FreeRADIUS Wiki But don't worry about configuring EAP, just do the bit to get ntlm_auth working to check the user accounts. If you can get ntlm_auth working then you should be pretty much there, as an added bonus you can test with radtest rather that eapol_test as you don't have to worry about the EAP/SSL negotiation. If you get stuck post up some freeradius debug output and someone can try and diagnose what is going wrong: /usr/sbin/radiusd -X | tee /tmp/radius.out

I struggled to figure out why this 2 year old thread had come back to life, then struggled more to figure out what you're trying to do Are you trying to authenticate by username/password AND MAC address as I'm just about to roll out (more or less) that exactly configuration, so could probably help you..

Just finished the 2005->2008 migration myself, had the same error logging in users failing with reason 0. We migrated the database to a different system so had to move the SQL login accounts as well as the SIMS user accounts (contained in the SIMS database). There is a guide from Microsoft on how to do that here: How to transfer the logins and the passwords between instances of SQL Server 2005 and SQL Server 2008 Secondly our install of SQL Express wasn't accepting remote connections because for some reason it had set the SQL Server Browser service to disabled, once we enabled that clients (SQL Management Studio is useful for testing) were able to connect without issue.

This or some other cluster file system. I haven't used oc2fs - is it providing the HA service too? If you're having problems there, perhaps you could separate off the high availability part to another service, LVS (The Linux Virtual Server Project - Linux Server Cluster for Load Balancing) or similar? Alternatively you could avoid cluster file systems all together if you exported the storage via some network file system, say, NFS or SMB/CIFS, though this introduces another single point of failure.

I'm not sure if you can use the port on the front of the bladecenter to directly connect through to a blade's network interface (strongly suspect not) but you certianly can directly map it to one of the free switch ports on the back of the bladecenter. I'd suggest leveraging your investment in your new infrastructure would be preferable to buying more legacy servers too.

How about adding the users to /etc/passwd on your NFS server for a test?

I think there might be some benefits for caching in terms of intelligent read ahead and cache utilisation. Having the DB on a remote system also has some advantages if you ever need to move the mysqld. On the ID mapping, remember that NFS matches users based on their numeric ID, not the name.

I can't see a reason not to go gigabit now. HP wise, you might like to look at the ProCurve 1810G series - they offer VLAN support, port aggregation and have GBIC slots which is a reasonable feature set for an edge switch, at a price point pretty close to the Netgear options.

When is the network connection slow - how are you quantifying this? Slow logon times, packet loss? Does it only occour in certain parts of the school? Having copper between buildings isn't ideal but there are plenty of sites that manage fine with it - do you have a budget to do some additional cabling? And a network diagram illustrating the links between the switches may help us identify potential bottlenecks in the network.

I'd be interested in hearing people's experiences too - currently using alot of ESXi which works well but it extremely limited feature wise. XenServer adds in the extra features but doesn't seem have as wide a range of OS support as ESXi, or at least makes the OSes harder to provision. KVM could be the answer, downloading 5.4 now so will give it a shot at some point.

It was mentioned earlier but I didn't see a reply - are both ends of the proposed link gigabit capable? The GBICs on each end won't (can't) switch speed as would be possible with gigabit on copper.

From the HP side you could fairly directly swap the specificied Catalyst 4507R-E for a Procurve 5400zl, looks to be around 2/3rds of the cost for the same number of ports. For the fixed configuration switches the HP 2810 is probably fairly closely equivilent to the Catalyst 3750G, but look at the (HP) 2910al if you want 10GbE support and layer 3 switching (the former probably being more important than the latter).

The fibre spec will be printed on the outside of the cable jacket, something like 62.5/125 or 50/125 so you should just be able to look round the back of your patch panels.

Hi, Sorry for the tardy reply - have been without 'net access for afew days. On the redundancy front you would probably implement either at layer 2 or layer 2 and layer 3. Layer 2 redundancy will involve using protocols that operate below the IP layer like [ame=http://en.wikipedia.org/wiki/Spanning_tree_protocol]STP[/ame] and it's deriviatives. With STP the switches allow multiple links between them without creating loops and shutdown redundant links by assigning costs to each path on the network, then if a primary link fails it will automatically switch to another link to transmit the data. Doing it at layer 3 means using routing protocols ([ame=http://en.wikipedia.org/wiki/Ospf]OSPF[/ame] or [ame=http://en.wikipedia.org/wiki/BGP]BGP[/ame]) to manage the traffic over your links, and may have an impact on how you address different parts of your network. This is where the brand and specification of the switches outside the physical interfaces may make a difference. The Cisco kit will almost certianly support these more advanced routing features out of the box while other brands may require license upgrades, or may not offer support at all. With that in mind, you may still like to look further than Cisco for switches - HP do some good kit, which port for port will probably work out significantly cheaper than the equivilent Cisco stuff (we use it here and managed to implement a 10GbE central ring within a normal budget, not part of a new build). There is plenty of reason to have redundancy whereever possible, I've found some limitations with the HP kit we've got (no VRRP support without a premium license) but if budget is an issue then you may well consider layer 2 reduncancy sufficient (that's what we've got here).

Good, so you can get 10GbE at the core, however I'd suggest that isn't really where you need it - you're probably not going to have a massive amount of traffic there (unlike a big business with lots of application servers), most of the traffic is going out to the edges. Even if you don't go 10GbE to the edge straight away, it would be worth making sure the switches are at least capable of supporting it, so it's a case of buying some trascievers rather than whole new switches when you want to upgrade.

I agree with more or less everyone else - the Cisco solution is really nice. It's more or less the same as your proposed layout with added redundancy - it would be interesting to see (you might want to ask) what they intend to do on top of it, will the redundancy be implemented at layer 2 or layer 3 (BGP, MSTP, both)? I expect the Cisco solution will also be monstrously expensive, but if you've got a new build, money might not be an issue. Definitely find out what the backbone is - I don't see a reason why the links back to the core shouldn't be 10GbE, certainly with that many clients - putting in 1Gig links at this point seems like they'll just have to come back in afew years to upgrade it again. Looking at the spec of the 3750G switches, they don't appear to have support for 10Gb modules (but I'm not intimately familiar with the Cisco product range). Finally you might be wise to check with the architects for the new building how they're doing the cabling. Sometimes they do a decent job - check if the fibre they've put in is OM3, so can support 10GbE between your buildings. edit: Looks like you need the 3750-E for 10GbE support (http://www.cisco.com/en/US/products/ps7077/index.html).

Haven't configured Ruckus stuff but I suspect you'll want to have your wireless controller and AP untagged on ports with a common VLAN for management purposes and have the ports on the switch tagged for your extra SSIDs (where you're setting the VLAN tagging on the SSID).

Does your DHCP server have a route to the other VLANs - is it's gateway set to the switch IP (10.22.28.100)?

If the switch has interfaces with IP address on the VLANs it will generate a routing table automatically. Is the DHCP helper pointing at the correct DHCP server? Can you post the switch config?

The no contact group problem is only a warning however, the thing stopping nagios is the missing command definition: The commands.cfg should contain something like: # 'host-notify-by-email' command definition define command{ command_name host-notify-by-email command_line /usr/bin/printf "%b" "***** Nagios 2.11 *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /bin/mail -s "Host $HOSTSTATE$ alert for $HOSTNAME$!" $CONTACTEMAIL$ } # 'notify-by-email' command definition define command{ command_name notify-by-email command_line /usr/bin/printf "%b" "***** Nagios 2.11 *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$" | /bin/mail -s "** $NOTIFICATIONTYPE$ alert - $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" $CONTACTEMAIL$ } edit: Should have read the whole thread, nevermind