HodgeHi

What is Profile Manager saying? Is the task pending or has it completed? Are the ports that PM require open? They are the same as for iPad deployment (being an MDM and all). Ports opened outbound to 17.0.0.0 or apple.com are 2195, 2196, 5223 The dock can be managed using the client and then uploaded as a custom plist to PM. This should do the same thing.

Remove the OD from the directory services list. It is no longer required.

The issue generally plagues new user accounts as it adds an everyone deny POSIX permission to each individual folder when the Mac creates the account on the server. It just doesn't work like it used to under 10.6.8 and has been broken since 10.9. You could try to fix the issue by removing the ACLs and then reapplying them properly but be warned that the Macs don't always have ACLs propagated down the structure properly either these days. What I mean by this is you could manually create a folder in the Documents folder stored on the server and it will only create the POSIX details. This means that the inherited perms don't get applied. I have been trying to find a way to resolve this issue properly for some time now. Forced Local Homes are the best way forward for now until A, Apple fix it properly or B, Users get used to working locally and manually shift important data to the server for backing up.

You need to log in as the local admin account and then check the console for the application name being denied. It may be easier filtering the logs by searching for the username that you logged in with. This will provide you with the direct path to the application that needs to be allowed through the restricted app policy. I guess the policy is only applying to the standard/network accounts that you have set the profile at in Profile Manager/other MDM that supports this restriction.

Hello All, A while ago I purchased a MCSE training kit for server 2003 (i did say a while ago ) and was looking at getting the same sort of kit for the server 2012 but cannot find the same set anywhere. Have MS stopped doing these kind of books? I found them to be really good and detailed, plus they came with the resource disc that provided the Server software as well. Does anyone know if they exist or what the best alternative to them are these days? TIA.

Hi all, Thanks for the replies. I did put the uplink to the router in to a trunk port but it still didn't work as I would have expected. I don't know why but anyway. The static routes on the Zyxel were already in place but traffic was not routing as I expected. I created the VLANs on the router and gave them an interface IP. Then the connection just started working on all VLANs. I figure I have basically bypassed the routing on the switch as the Zyxel router is now routing between all of the VLANs, basically making the L3 part of the switch redundant but at least its working. Not sure why it wouldn't work on its own routing table between the Zyxel and the L3 switch. All of the static routes should have worked as expected. I configured all of the switch and static routes in a test environment without issue. But at least its working . I may go back to it when time allows to try and identify why it didn't work initially. Thanks all for you help anyway.

I think I have noticed what the issue is, but correct me if I am wrong... The port that provides to uplink to the router is set to Access mode. This only carries on VLAN. Does this mean that it should be set to a trunk VLAN to allow it to carry all of the VLAN traffic to the router and back? This is where my VLAN knowledge starts to let me down. I don't know exactly how the Trunk and Access modes work alongside hardware that doesn't support VLANs. The Zyxel router that is now installed does so I could possibly switch back to a Trunk mode and set the VLAN information on the router if required.

The default gateways are set for each DHCP scope for each VLAN. The DHCP lease provides the gateway for the plan that the scope is addressing, i.e. VLAN 5 has a default gateway of 10.0.64.10 and this is the gateway address provided to the clients on that VLAN.

Thanks for your input Lostsoul. The static routes have already been created on the Zyxel router to provide the gateway back to the switch VLANs. They just cannot get out to the Internet. The config now is as follows: - The Switch has an IP address of 10.0.0.250 - the default mgmt VLAN - ID1 There are 4 other VLANs on the switch... VLAN 5 - Staff VLAN - 10.0.64.10 VLAN 6 - Guest VLAN - 10.0.80.10 VLAN 7 Reg VLAN - 10.0.96.10 VLAN 8 - Conference VLAN - 10.0.112.10 There are 5 WAPs (with 5 SSIDs) connected to ports 1-5 which have all been set as trunked and have been tagged with VLANs 5-8 and 1 which is untagged Port 24 has been left as untagged and has been set to access mode to allow the routed traffic to be understood but the router (was a BT business hub 5 at this point but has since been replaced with a Zyxel) The routing table in the switch has enabled these routes, which as you would expect, are directly connected routes. There is a default gateway which has been set to 0.0.0.0/0 - 10.0.0.254 which has been set as static route The Zyxel router has an IP address of 10.0.0.254 The Zyxel router has had the static routes for the VLANs added also, which are as follows: - S 10.0.64.0 / 255.255.240.0 -> 10.0.0.250 S 10.0.80.0 / 255.255.240.0 -> 10.0.0.250 S 10.0.96.0 / 255.255.240.0 -> 10.0.0.250 S 10.0.112.0 / 255.255.240.0 -> 10.0.0.250 The Mgmt VLAN is seen as a directly connected route: D 10.0.0.0 / 255.255.240.0 -> 10.0.0.250 If I connect a client via a cable to the staff VLAN and provide it with an IP address in the staff DHCP range, I can ping the client from the Zyxel router interface, but the same client cannot access the Internet. I don't know if this is due to DNS traffic not getting out and back or if it is indeed a routing problem.

Hi AlClark, No, I haven't created the VLANs on the Zyxel router. The port on the switch that is used for uplink to the router is set to being an access untagged port since the BT business hub was not VLAN-aware as far as I knew. I have configured the other ports on the switch that have the Wireless Access Points connected to them to be tagged with each VLAN ID as they will be carrying the tagged traffic for each of the SSIDs. I have been told that this is the correct behaviour. They are still set to trunk ports though as I wasn't sure which is the preferred type of port for this. You couldn't seem to change them to access mode based ports as they have to have multiple tagged VLANs.

Thanks rich_tech for your reply. I have now replaced the BT business hub 5 with a zyxel router and am still experiencing the same issue where the router is not routing internal traffic from the additional VLANs out to the Internet. I believe it to be a routing issue as the main default VLAN works without issue. The DNS server address that is in use is 8.8.8.8 as no DNS server exists on the internal network as yet. Browsing the web results in the address bar just waiting to resolve the address. The static routes for the internal VLANs have been entered on the zyxel router to provide the routes back to the VLANs via the d fault router gateway address (the set up is simplified now with the zyxel router having a LAN side address of 10.0.0.254 which connects directly to the L3 switch which has a gateway address of 10.0.0.250) but the traffic just doesn't seem to get out. I've no idea what's preventing the traffic from being routed out and back in to the correct VLANs.

OK so I've managed to get this working to some extent but now I can't get the routing to work through a BT home hub. Has anyone else been able to get VLANs routing successfully through a VDSL infinity home hub? I can't seem to get the traffic any further than the internal LAN router address. If any more info is needed then please let me know. This has been going on for a while now and would like to put it to bed once and for all! Thanks in advance for any help that anyone may be able to provide

Hello All, I've been in this VLAN hell before not long ago and thought I'd understood it once I got it working...obviously not! I am trying to configure the cisco sg300-28p switch (set to L3 mode) to provide a wireless network with multiple SSIDs that provide a DHCP assigned address from different scopes depending on what SSID is chosen. I have a Staff, a Guest and a Register and a Conference SSID. I have chosen to use the IP range of 10.0.0.x with a subnet of 255.255.240.0. The set up would be as follows: Default VLAN = ID1 Staff VLAN = ID5 Reg VLAN = ID6 Guest VLAN = ID7 Conf VLAN = ID8 The Default VLAN address is set to 192.168 0.254 and the WAN address is set to 192.168.0.1 The Interface used for the link to the Router (Virgin Media router) is on port 24. The Staff VLAN uses the address 10.0.64.x with the VLAN ID5 interface using 10.0.64.1 and the DHCP pool is 10.0.64.10 - 10.0.79.250 using ports 1-4 The Reg VLAN uses the address 10.0.80.x with the VLAN ID6 interface using 10.0.80.1 and the DHCP pool is 10.0.80.10 - 10.0.95.250 using ports 5-9 The Guest VLAN uses the address 10.0.96.x with the VLAN ID7 interface using 10.0.96.1 and the DHCP pool is 10.0.96.10 - 10.111.250 using ports 10-14 The Conf VLAN uses the address 10.0.112.x with the VLAN ID8 interface using 10.0.112.1 and the DHCP pool is 10.0.112.10 - 10.0.127.250 using ports 15-20 I have configured the default route 0.0.0.0/0.0.0.0 next hop 192.168.0.1 The switch has already created the directly connected routes. I have been able to connect a WAP and connect to the SSID which in turn provides the correct IP for that network, and I am able to ping the gateway of the VLAn the device is in, and I can ping the mgmt VLAN gateway too, but I cannot ping the router address 192.168.0.1 I have set the ports for the WAPs as tagged with ingress disabled as the SSIDs are told what VLAN ID they belong to. I feel I'm missing something but Im not sure what it is. Would anyone be kind enough to help point out where I'm going wrong? Thanks in advance.

UNC patch will be case sensitive for macs. Ensure that the correct case has been used for all accounts. For example \\servername.example.com\StudentShare$ Note the capital S. If the share name is capitalised then the UNC path will need to be too. It has to be exact.

Lostsoul, Thanks for all your time and patience with this matter. You (and I) would be pleased to know that with your help I now have a fully functioning layer 3 switch with 3 VLANS and dhcp relayed IP assignment. Once again thanks for all your help. You are testament to why this site goes from strength to strength. Enjoy your day and the rest of the week. May the sun shine upon you always (too much?) 😊

Hi I'm back, I think I spoke too soon when I said i think I'm making progress. I cannot ping any gateway addresses (even when connected directly to a port on that VLAN). It must be something that Im doing wrong, although I find the manual on how to do this for the switch next to useless. Burning it might be a more useful purpose if it wasn't a PDF. I think it is the routing and VLAN interfaces that aren't working as they should but I don't know enough about VLANs or the way in which this switch is configured to work it out. I have looked at forum posts online relating to an M4100 switch but this is a M5300 series. I assume that the process is the same but I don't understand what the documentation is doing to follow it with any idea as to whats going on. I think I just need to know: A) Do the ports need to be set to T (tagged) or U (Untagged). I have removed the U from the ports for VLAN 1. Is this right? B) Routing. The guide goes through every kind of routing one after the other. So I don't know which one is supposed to do what I need. Is VLAN routing enough or do I need to enable RIP as well? C) Do I specify that the Acceptable Frame types is Admit All or VLAN only? D) Do I need to specify an IP address on the port interfaces for the Gateway addresses as well, or is this done through the VLAN virtual interfaces. I'm ranting a bit now but I've been banging my head at this for over 2 weeks now and am ready to just forget it completely. Hope someone can save the remaining hair on my head. TIA.

Thanks for the reply lostssoul. Since my original post I have shifted the default gateways for all VLANS over to .250 and created a 10.0.0.0/24 network for the switch management. This seems to resolve most setup issues I think. I have now just got to work out how to set a DHCP relay so I can get an IP on the other VLANs

Hello All, I am dipping my toe in to plan configuration. I think i sort of know how they work but am now starting to configure them and struggling to work out the requirements for that network side of things. Let me try and explain further: I have a single layer 3 switch (Neatgear) and would like to set up perhaps 3 VLANs for testing. I configure the switch with an IP address of 192.168.0.200 I have a Virgin Media internet connection on 192.168.0.1 I configure the 3 vlans with IDs 3 (Server) IP range 192.168 0.0/24, 4 (Staff) IP range 192.168.1.0/24 and 5 (Students) IP range 192.168.2.0/24. I then assign the ports to the VLANs (pts 1-5 = VLAN3), Pts 6-10 = VLAN4, pts 11-15 VLAN5) When I go to set the VLAN routes, this is where I get confused. I configure default gateway for the staff as 192.168.1.1/24 and the students is 192.168.2.1/24 But since the switch is on the same subnet range as the server VLAN it says there is an overlap since it already exists as a default route. So my question is how is the ip addressing configured to get this all working? I have gone through the manual but it never states how he switch IP addressing is configured. Is it in the default network range as the server, or the default gateway and so the rest need to be on different subnets. Will the default route carry the data anyway even if it has not been set. I probably have many more questions but my brain is a bit bamboozled at the moment. I am probably over-thinking it but cannot get my head around the way it needs to be configured to allow me to think about how it all works together. My understanding is that each plan needs to have a default gateway set so that the switch can route the data between them, which means that the server VLAN will also need a default gateway too? If you need any more info to help then please let me know. Thanks all.

What happens when you click on the ? Does it then change to the home dir after a few seconds?

Just bear in mind that CIFS / SMB1 was notoriously slow when navigating SMB shares. SMB 2 and 3 are better at browsing but also introduce the issue that you are seeing.

How would you manage other devices from a central location? Does Windows 8 tablets provide you with any enterprise wide management similar to Apple's Configurator and VPP for large app deployment? Does Android have anything for their Market place? I am just curious as to what the other vendors are doing to resolve their own deployment issues.

I have seen 10.9.5 exhibit the same issues as the previous versions where you can create folders on the desktop but they disappear immediately requiring a propagation of permissions to be able view them again. Not sure if it has been completing fixed and Im not sure whether it can be fixed in this version as there have been so many attempts. Maybe it needs a re-write (10.10)?

Go to WGM and then select the group you want to makes changes to. Click on preferences along the top Click on login Click items tab along top to the right In finder click go > connect to server. Enter the UNC path to the share you want to add When it mounts on your desktop drag the icon into the white space in WGM Select the share that is now displayed and tick the mount using username and password of user logging in. You can't mount a share that is located on the server that is hosting the share. Instead use WGM on a client and then do the same process as above. You may find running WGM on a client makes the process of creating the managed preferences a lot easier.

Garageband is worth it though

Ignore the 10.8 server. The issue is with 10.9. Clients or otherwise. The Mac server being 10.8 is irrelevant. You can remove the mac server from the set up completely and the issue with the AD file shares still remains. You can test the problem if you like. Simply upgrade one client to 10.9 and test with what I said above. Create a test share with some test data though. And yes the issue should be contained in the individual home dir. It only affects shares where the user has full control/ read/write access. Some say that a workaround is to remove the change ownership rights, but this could potentially cause more issues.