chris11256

As others have said, without SSL Decryption of some kind the users will just get an error. So in our case all domain devices get a Palo Alto block page, as all that traffic is decrypted. However BYOD stuff isn't, so sites are still blocked but they get an error rather than a block page.

Just to update my own thread. I've now got IPv6 working on the IT & Server vlans. I just need to do the access lists before rolling it out on others. The problems I encountered were because I didn't tick the right box when applying an IPv6 address to the firewal's internall interface. So after checking it, I now have IPv6 connectivity.

Kyocera are good when they work... we're happy with the mono copier. Hower we aren't happy with the colour model, print quality is somewhat poor. So if you're only after black & white copiers, then don't worry as much.

They are all the same, newish 1080P Dell monitors, in theory the visualisers do claim to be HD. However I've got a VGA input selector from Amazon arriving today. So my idea is to have both devices completely seperate, with teachers just changing which input they want to use on the selector box thing.

Tell me about it! Unfortunately the member of staff who declared that everyone has visualisers is adament that they're completely independant of the computer. So any connected via USB result a sternly worded email from him to SLT about disruption to learning.

it's all VGA only i'm afraid.

I stuck with HDD's during out server/san refresh. I've got two HPE DL360 G10's connected via 12Gbps SAS to a HPE MSA 2050 SAN with 42TB raw storage. Each DL360 has two 10 core Xeon 4114's with 192GB ram, the hosts run about 15 vm's each including our virtual firewall and normally sit at about 80-95GB ram usage during normal running. Was deliberately specced so that one host can run everything if the other host died. Almost all our production servers are vm's. The only physical servers we have are for Veeam and a domain controller. Veeam runs backups to a Synology NAS. All other servers are vm's and uptime has been almost 100% since the new servers went in during July. Only outage was caused by me accidentally not realising a power cable was loose(was connected & working), but a tiny nudge by me then power cycled the SAN(one power supply had failed, so I was waiting for the new part). So was my fault completely rather than random hardware failure. Just for an idea on the costs, the hosts were £11K overall including 5 year warranty. SAN was about £12K also including 5 year warranty. Of this the actual MSA 2050 chassis was £3600, warranty £3000 and the 24 1.8TB 10K SAS drives were £230 each.

We have a Kyocera TaskAlfa 6052ci and two 8002i's. The 8002i is good, reliable and fast enough. Print quality is also good for a mono copier The 6052 on the other hand has been less than great. Colour print quality honestly isn't that good, especially when compared side by side to a Ricoh copier we have. It's also been very unreliable(one fault rendered it out of action for two months with multiple engineers not knowing whats wrong) Just to add to what Jammam960 said, personally I wouldn't go with Kyocera again. My previous school was all Canon and the difference is profound, sadly I'm stuck with the Kyocera's until the lease expires in October next year.

Hi Dave, I'll see if I've got any and give it a go. Monitors are Displayport anyway. Also the problem is only when displaying the computer, if you actually use the visualiser it displays normally, as it does if the computer is set to extended display mode.

Evening all, We have some staff who are fanatic visualiser users, however we keep getting strange problems. All classrooms are either a Sony VPL-SW536 or 526 projector, some also have an Elmo L-12id visualiser. So the computers VGA connection to the projector runs through the visualiser. The visualisers are already very sensitive to the PC display resolution(all rooms are set to duplicate display). Anything higher than 1366x768 causes the projector to go instantly blank(as if there's nothing connected at all), bypassing the visualiser instantly resolves the problem. 1 or 2 rooms also have a problem where the entire display will disappear except from a thin line at the top of the screen. These problems only occur when the visualiser is connected. I've tried replacing cables and looking at the very limited settings on the visualiser itself(they're set to VGA & WXVGA) on the physical switch on the side). It's a problem I've been scratching my head over for a few months now. So if anyone has any advice it'd be appreciated. Thanks, Chris

I'm considering moving users H Drives & our staff shared drives to One Drive & SharePoint. However I want to get Cloud Drive mapper first to give an almost seamless experience. Staff are keen as it allows for better collaboration. As for backup I've been told by SLT that we're not purchasing any additional solutions to backup any Office 365 data. So our backup is only what Microsoft provide. However I'm not in a rush to move vm's to azure. Although our MIS(isams) is cloud hosted along with our VLE(Firefly). However this has been the case since we opened in 2012 or so. Our ESX hosts & SAN were new in August and aren't oversubscribed and bulging at the seams. Overall I'm not convinced that all cloud is a huge money saver, money just goes on subscriptions rather than hardware. But we're moving to a completely new building in 2023 so things may change with the move, but I'll wait & see.

ManageEngine can easily cope with multi site setups, so I'd consider staying with it. Not quite a MAT but at my previous school we maintained the infrastructure for a nearby prep school with the onsite tech doing general support bits. So the had it setup as an additional site on ManageEngine which the tech then had full access too.

Perfect, thank you

Evening all, Hope everyone's having a good Christmas & new year. Our current agreement expires on 31st December and a renewal order has been placed with a new supplier(cheaper). At what stage will the new agreement appear in VLSC? I can only see our current & previous agreements. I've had the email asking me to sign the new agreement and have done so and recieved confirmation that I've signed it. Sorry if this is a stupid question, this is the first time I've dealt with Microsoft licensing renewal. Thanks, Chris

That documenatation was never provided(or it was and my predecessor lost it). So I had to chase BT for ages. In the end I was provided this 2A00:2381:144:100::/56 ASSIGNED and thats it!

Many thanks for this. Yes I can ping the firewall's internal interface from my test server. I suspect I have a bit of a fight on my hands trying to explain thia to BT support. Many thanks for the advice. It's all a rough plan beyond the internal network i've configured, So am more than happy to adjust the addressing plan. I'll update this thread in due course, although after today I'm off until January.

We're with BT here on a 1Gbps line with 500/500Mbps port speed. The actual server is good & reliable with no downtime since it was installed in 2017. However their support & actually getting hold of people is terrible. For web filtering we do it on a Palo Alto virtual firewall. Also think we're paying more than what resellers would quote. But my predecessor signed a 5 year contract, so we're stuck in 2022.

Just to update, not getting very far with this. Double verified that the firewall config is good & IPv6 is enabled. Correct static routes are set outbound & inbound as well. So if anyone has any advice it'd be greatly apprechiated.

Hi All, Am trying to get started configuring IPv6 on my network following from the recent thread. We've been assigned the 2A00:2381:144:100::/56 block from BT which has then been split into the 256 /64 subnets. I've assumed BT have used 2A00:2381:144:100::1 for the managed router's interface, so I configured my firewall outside interface as 2A00:2381:144:100::2. This works and from the firewall CLI I can ping from 2A00:2381:144:100::2 to any other IPv6 address. However my test internal devices can't access IPv6 websites.. I've enabled IPv6 on the firewall itself(plus on the relevant interfaces) and added a defualt route pointing towards the BT router's IPv6 address. The firewall's inside interface has been assigned an address as has the transit vlan on the core switch. This is vlan 101 and is used as a core-firewall transit. A v6 default route has also been set on the core pointing towards 2A00:2381:144:101::2(firewall inside). The vlan i'm testing with has had IPv6 enabled and an address assigned on the core switch. My firewall rules include a generic catch all external traffic which is filtered to student standards). So even though I don't have a specific v6 security rule in place, traffic should still flow. I've also set a static route on the firewall for the test subnet(which in this case is vlan 201 with 2A00:2381:144:1a1 with the core switch vlan IP being 2A00:2381:144:1a1::1). IPv6 unicast routing has also been enabled on the core switch. I'm able to ping from the firewall's external interface to anywhere on the internet. However I can't ping from vlan 201 to anything external on IPv6. I also can't ping from the firewall's internal interface to anything v6 external. I'm at a bit of a loss as to why, as I've followed Palo Alto guidance for enabling IPv6. Any advice for things I can check? Thanks, Chris

As long as your license is current you can download Mac/Windows installers from the my account part of the Avid website. . There's a seperate sounds download for mac as well

The no Ipv6 on BYOD wasn't my call. For some reason it just wasn't something that my old boss wanted to do.

Not planned yet & I haven't asked BT if we can have one. My last school was full dual stack with everything except BYOD. So I'd very much like to go down that route, just requries a lot of planning.

If possible I'd go with Server 2019 instead. Server 2016 takes ages to install any updates. I've been running 2019 on one domain controller, two file servers and a few others have have no problems. Server 2008 R2 is end of life in January, so ideally you need to move.

Yep, which is why we don't do it. BYOD devices would need the certificate installing, which is honestly a hassle I can't be bothered with. They're still fully filtered, just can't do in depth scanning as we can with domain devices.

We're with BT(1Gbps bearer with 500Mbps port speed) and use a Palo Alto VM300 as both Firewall & URL filtering. Currently do SSL Decryption on all domain computers. Don't currently decrypt BYOD devices. It is technically possible, we'd just need to get everyone to install the certificate on their device. Which we currently don't do. Am very happy with the Palo Alto overall, does everything we need and more. Much better than the Cisco ASA5505 it replaced.