Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Thanks Ants
May 21, 2004

#essereFerrari


We have fax-to-email inbound, but just plug a phone line into our multifunction for the one time each year we might need to send a fax. The workflow for most fax sending services are quite poor and you still need to put your paper through the machine so you may as well just dial the phone number at the same time.

Adbot
ADBOT LOVES YOU

dogstile
May 1, 2012

fucking clocks
how do they work?
I'm currently sat next to a Brother FAX 2840.

It's leased.

Jack the Lad
Jan 20, 2009

Feed the Pubs

Thanks for the AV advice peeps. I have a new thing I'm struggling with.

We're on G Suite and since late last month a lot of our emails are going to spam/quarantine and not reaching recipients.

These are emails sent through third party newsletter services like sign-up.to, emails sent direct from the Gmail web UI, via Outlook with G Suite Sync, from the iOS app etc, to a range of businesses, some of them big enterprises, and including random individual emails sent to people we've corresponded with before and even replies to their emails.

I've had a bunch of the recipients send me headers and it looks like everything is passing SPF/DKIM but (e.g.) Office 365 just mark even innocuous personal emails from us as spam all of a sudden. I've switched our SPF from hard to soft fail and subsequently to neutral anyway, just to do something, but it's made no difference.

Google Postmaster Tools says we have a 0% user-reported spam rate, High IP and Domain reputation, 100% SPF success rate and so on.

I've looked the affected domain up on every blacklist/reputation checker I can find and haven't found anything bad.

We haven't changed our signatures to include links or GDPR disclaimers or anything recently.

We've contacted all our clients and asked them to whitelist us, but that isn't a great look, and we can't do that for prospects or anyone else we're communicating with for the first time.

Our CEO is angry and willing to spend lots of money on "high powered consultants" getting this fixed, but I don't know what the problem is or who I could give money to that would be able to fix it.

:negative:

Jack the Lad fucked around with this message at 10:59 on Jun 29, 2018

Thanks Ants
May 21, 2004

#essereFerrari


Are you DKIM signing your outbound messages?

Jack the Lad
Jan 20, 2009

Feed the Pubs

Thanks Ants posted:

Are you DKIM signing your outbound messages?

We weren't at onset but are now.

Gerdalti
May 24, 2003

SPOON!
Suggestions needed.
We're a small shop (100ish users). Everyone has a laptop, generally HP Elitebook 840's. These laptops span a few generations, and each gen is slightly different hardware wise. Windows licenses are 7 Pro OEM on about 95% of these. The newest ones are Win 10 Pro (OEM again).

We spend a lot of time wiping/reconfiguring these as they cycle in and out.

I have access to Server 2016, so the built in MDT/WDS might be worth a look I guess. Most of our end-user software is pushed out via PDQDeploy (though not all, and it can be a little slow for new/fresh computers). I'd like be able to just push a few buttons and have a recently configured image that matches the model/hardware install on these machines and activate properly.

Where should I start?

GreenNight
Feb 19, 2006
Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Gerdalti posted:

Suggestions needed.
We're a small shop (100ish users). Everyone has a laptop, generally HP Elitebook 840's. These laptops span a few generations, and each gen is slightly different hardware wise. Windows licenses are 7 Pro OEM on about 95% of these. The newest ones are Win 10 Pro (OEM again).

We spend a lot of time wiping/reconfiguring these as they cycle in and out.

I have access to Server 2016, so the built in MDT/WDS might be worth a look I guess. Most of our end-user software is pushed out via PDQDeploy (though not all, and it can be a little slow for new/fresh computers). I'd like be able to just push a few buttons and have a recently configured image that matches the model/hardware install on these machines and activate properly.

Where should I start?

MDT/WDS is the way to go. Eventually if you get licensing, use SCCM. I started where I am at about 150 users and now span 400 or so, so not a crazy amount and I use SCCM specifically for imaging. You can do it cheap with MDT/WDS.

We also use all HP notebooks, specifically the ElitebBook 840 G5 models now, but we have G2/3/4 in production.

The Fool
Oct 16, 2003


MDT is the way to go.

The PDQ blog had some directions on triggering PDQ deploy from an MDT task sequence.

https://www.pdq.com/blog/mdt-imaging-in-pdq-deploy/

Gerdalti
May 24, 2003

SPOON!

The Fool posted:

MDT is the way to go.

The PDQ blog had some directions on triggering PDQ deploy from an MDT task sequence.

https://www.pdq.com/blog/mdt-imaging-in-pdq-deploy/

This is awesome, and exactly how I'm going to go. Thanks guys.

Rick
Feb 23, 2004
When I was 17, my father was so stupid, I didn't want to be seen with him in public. When I was 24, I was amazed at how much the old man had learned in just 7 years.
MDT and system imaging in general is a big blind spot to me. I absolutely get the point and see how it would be easier, but also I've generally been able to keep up with just doing this manually.

I read the blog and then on MDT and it all seems easy enough to install but they all seem to be missing the step of what you do next to actually get the clients to take the image.

I'm like a super terrible IT person.

GreenNight
Feb 19, 2006
Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Basically F12 and PXE boot to the imaging server. Something about configuring DNS to accept PXE requests.

The Fool
Oct 16, 2003


MDT generates a bootable WIM file that you can distribute however you want.

The best way (IMO) is to boot it over the network with WDS.

The built in task sequences are fairly robust, but require a fair amount of interaction, but with some research and experimentation you should be able to automate the whole imaging process.

In my environment you can network boot a computer then 2 clicks and a login later you can walk away, confident that in 40 minutes the computer will be ready for a user to log in to.

Gerdalti
May 24, 2003

SPOON!
Since I started the discussion, and actually spun up a WDS server today, I'll ask. Does anyone have some good resources for configuration and image setup they could share?

The Fool
Oct 16, 2003


Only use WDS to distribute your MDT image.

Deployment Research has a lot of good info, and was a heavily used source when I built my system.

https://deploymentresearch.com/Research/Post/540/Building-a-Windows-10-v1607-reference-image-using-MDT-2013-Update-2

Dans Macabre
Apr 24, 2004


MDT owns, I don't know how to get it to work but another guy here has it so it literally Just Works and it's amazing

Moey
Oct 22, 2010

I LIKE TO MOVE IT
You just gotta grind through it to find out what works with your poo poo.

Potato Salad
Oct 23, 2014

nobody cares


GET loving HP SOFTPAQ MAKER if you aren't already using it

Injecting drivers specific to each machine without using PNP to check compatibility will save you a ton of time on each deployment

Consider also using HP's bios get/set config tools to unify your firmware configuration and do stuff like convert from MBR to gpt then bios to UEFI automatically

Potato Salad fucked around with this message at 16:43 on Jul 1, 2018

Charlotte Hornets
Dec 30, 2011

by Fritz the Horse
Make sure you got a Volume License for the image(s) from MS. There is no imaging rights in OEM license agreement.

Digital_Jesus
Feb 10, 2011

As long as you buy PCs with OEM licensing you only need to buy an ovl wiin10 pro upgrade key for imaging rights. Itll cost you a whoppin $180.

Morganus_Starr
Jan 28, 2001
Honestly why not just Smart Deploy and call it a day? Especially if you are a lean shop and you'd rather focus on other likely more important aspects of the infrastructure. The cost is pretty reasonable IMO for the time savings involved. They do all the driver pack management for you.

https://www.smartdeploy.com/

I've turned a few of my customers with their own IT departments into using the product, so far, good feedback and no complaints.

The Fool
Oct 16, 2003


Because MDT is not hard, and you are already licensed for it.

Dans Macabre
Apr 24, 2004


I remember having to buy acronis licenses every time I did a thing and it was extremely annoying so that's why.

Mr. Clark2
Sep 17, 2003

Rocco sez: Oh man, what a bummer. Woof.

The Fool posted:

Because MDT is not hard, and you are already licensed for it.

This right here. Buy Johann Aarwidmark's book, follow his examples when setting up your environment, never look back.

Mr. Clark2
Sep 17, 2003

Rocco sez: Oh man, what a bummer. Woof.

Question: I have been tasked with replacing our network monitoring system, currently handled by software called Opsview. The Opsview installation works fine and does its job well enough but my boss has decided that It Must Go.
So to this end I'm looking for suggestions/recommendations. I know that Nagios is pretty much the 'go to' solution for this kind of thing but the last time I looked at it (roughly 5 years ago so maybe it's different now) I remember being turned off by the fact that pretty much all configuration had to be done by modifying config files, and it was also butt ugly to look at.
Of course I've been given a budget of 0 dollars for this project so I'm looking for something free that will monitor 6-7 physical servers, 3-4 routers, and a few dozen switches and APs. I really only need it to monitor up/down status, disk usage and to send emails if something goes down.

Matt Zerella
Oct 7, 2002

Norris'es are back baby. It's good again. Awoouu (fox Howl)
Look into check_mk / OpenNMD E: openNMS

pixaal
Jan 8, 2004

All ice cream is now for all beings, no matter how many legs.


I like prtg it's free under a certain number of monitors I believe it's 100, but may be 200. It's pretty expensive if you go over, but being the small shop thread, that shouldn't be an issue.

Internet Explorer
Jun 1, 2005





Yeah, I'd recommend PRTG. It's 100 sensors for free. Also I don't find it that expensive, but YMMV.

Dans Macabre
Apr 24, 2004


PRTG is good

Old Binsby
Jun 27, 2014

Sheep
Jul 24, 2003
I ran LibreNMS for a bit, it was ... alright I guess? I was using it with Meraki MIBs though which was a goddamn disaster.

Were I doing it nowadays I'd probably use telegraf to get the SNMP data and then use whatever storage and visualization medium fits my needs.

Digital_Jesus
Feb 10, 2011

Just find whatever monitoring suite you like that has a 30 day free trial. Export your config and rebuild the server every 30 days.

Perfect for a $0 budget.

pixaal
Jan 8, 2004

All ice cream is now for all beings, no matter how many legs.


Digital_Jesus posted:

Just find whatever monitoring suite you like that has a 30 day free trial. Export your config and rebuild the server every 30 days.

Perfect for a $0 budget.

This is likely a gross violation of the terms of services and you'll end up having to pay for all the extra trials if they audit you. They will audit you at some point when they notice 20+ trials all coming from the same IP.

I assume this was a joke, but I don't want someone taking it serious.

There's several packages that offer unlimited trials as long as you keep it under a certain number. So why would you want to lose all that data history and have to set something up each month when there's something free that's still on of the best.

CampingCarl
Apr 28, 2008




My work has somehow managed to get more outside consultants than IT staff and no one seems to be on the same page as to what we actually need. I want to replace the switches for our corporate (separate from production) network that is a jumble of various model switches, total somewhere around 150-200 ports. The main uses of this network are getting people email, sharepoint, websites, and printers. We are going to add some new security cameras that need POE and are moving to VOIP phones (~50) that don't need POE and just share network with the computers. Here is the range of suggestions:

1. Get a bunch of Cisco SG300 50 port switches and a separate POE switch. Total cost $2500
2. Get a bunch of SG300 50 ports, but make them all POE. ~$7000-8000
3. Get some Cisco 2960 ~$10-12k
4. Get Cisco Meraki switches, ~$15-20k plus whatever the Meraki subscription is

The justification for the expensive stuff is the VOIP phone quality will suffer if its not on its own VLAN and if the routing isn't good enough (LLDP) and supposedly SG300 are bad at that. I admit I don't know enough about VOIP to know if that is true or not. The VOIP provider said it wasn't necessary for the number of phones we have. For some extra fun context, I was told a month ago by one of those consultants to get a bunch of SG300s for production, which has very heavy file traffic and is what makes us the money so hopefully they aren't poo poo.

Thanks Ants
May 21, 2004

#essereFerrari


I’m pretty sure the SG300 series is EOL now.

I priced some switches recently and the Aruba 2930F were a good option, and with VSF you can cluster them for management and do cross-switch LACP bonds.

Thanks Ants fucked around with this message at 12:23 on Jul 15, 2018

Morganus_Starr
Jan 28, 2001

CampingCarl posted:

My work has somehow managed to get more outside consultants than IT staff and no one seems to be on the same page as to what we actually need. I want to replace the switches for our corporate (separate from production) network that is a jumble of various model switches, total somewhere around 150-200 ports. The main uses of this network are getting people email, sharepoint, websites, and printers. We are going to add some new security cameras that need POE and are moving to VOIP phones (~50) that don't need POE and just share network with the computers. Here is the range of suggestions:

1. Get a bunch of Cisco SG300 50 port switches and a separate POE switch. Total cost $2500
2. Get a bunch of SG300 50 ports, but make them all POE. ~$7000-8000
3. Get some Cisco 2960 ~$10-12k
4. Get Cisco Meraki switches, ~$15-20k plus whatever the Meraki subscription is

The justification for the expensive stuff is the VOIP phone quality will suffer if its not on its own VLAN and if the routing isn't good enough (LLDP) and supposedly SG300 are bad at that. I admit I don't know enough about VOIP to know if that is true or not. The VOIP provider said it wasn't necessary for the number of phones we have. For some extra fun context, I was told a month ago by one of those consultants to get a bunch of SG300s for production, which has very heavy file traffic and is what makes us the money so hopefully they aren't poo poo.

Honestly I would stay away from the SG series if possible - and move towards Catalyst 2960-X with LAN Base - doubt you need routing on them - quantity 4 with stacking modules/cables and call it a day. I've got a few refurb vendors who can do refurb 2960-X (POE model) for around $1600 each - that comes in well under your $10k, POE, and you can still get a lifetime hardware warranty from the same vendor. You could even add the RPS unit on there for redundant power supplies. You could also go Dell N2048 series which is fairly comparable to 2960-X and the CLI is very similar to Cisco with pretty good documentation, Layer 2 features are quite similar also (BPDU Guard, storm control, DAI, 802.1x etc.). Probably some people on these forums hate on Dell but I've got such a mixture of Dell/Cisco/Meraki/Ubiquiti out there at various clients and I rarely have issues with the Dell N series (stay away from the 1500 series though, go up to the 2000 series).

Stay far away from the Ubiquiti UniFi switch - just total crap and not even close to what I'd consider "SMB" ready. I hear the EdgeSwitches are OK, but if you have some budget, spend more money. Don't waste money on Cisco optics, go to Fiberstore (https://www.fs.com) and save a metric shitton of money on any modules you might need.

As for your VoIP - using voice vlan functionality on your switch is pretty straightforward (LLDP / CDP / mix, depending on switch type), even on the SG series - but it's not going to really help QoS across the WAN to your (presumably) cloud hosted PBX. You'll want to focus a bit on your network edge and look at some shaping options on your firewall, particularly if your site has limited bandwidth. Also ensure your are monitoring bandwidth on your firewalls and switches, and switch uplinks, as closely as possible to do root cause analysis when people say "phones are choppy".

I'd also recommend your system integrator / consultants ensure they have a good baseline set of layer 2 security on the new switches, e.g. BPDU guard - become some bozo will eventually plug in the LAN/WAN ports on a phone simultaneously, thinking "it might make the phone faster" or "oops this cord looks like it needs to be plugged back in" and then ruin your day as you try to frantically find the loop :)

Maneki Neko
Oct 27, 2000

Thanks Ants posted:

I’m pretty sure the SG300 series is EOL now.

I priced some switches recently and the Aruba 2930F were a good option, and with VSF you can cluster them for management and do cross-switch LACP bonds.

Sadly no such luck on the SG300s. They have end of saled a few models, but not all. We run into them all over the place.

wolrah
May 8, 2006
what?
The bit about the VoIP phones not using PoE stands out to me as a big red flag. Any good VoIP phones support PoE and the ability to centrally reboot them all at once is worth its weight in gold, not to mention the power backup aspect. If they don't support PoE at all, they're trash and if you have any power at all to get better ones you really should exercise it. If they support PoE but the plan is to not use it, that's just being silly.

Morganus_Starr posted:

Stay far away from the Ubiquiti UniFi switch - just total crap and not even close to what I'd consider "SMB" ready. I hear the EdgeSwitches are OK, but if you have some budget, spend more money.

EdgeSwitch and UniFi Switch are the same hardware (there are minor variations but nothing meaningful), the real difference is the software. EdgeOS definitely has a lot more features than UniFi, but that's also sort of the point with UniFi. They work great in applications where you don't need the advanced features. For a VoIP deployment where you only really need PoE, LLDP, and VLANs they're fine.

I agree of course that unless your LAN is huge or has serious bottlenecks VLANs shouldn't have much of a meaningful effect on voice quality, but they do make other things nice by keeping the phones in a separate DHCP scope which makes them easier to keep track of and avoids potential DHCP option conflicts with PXE booting and the like.

pixaal
Jan 8, 2004

All ice cream is now for all beings, no matter how many legs.


wolrah posted:

by keeping the phones in a separate DHCP scope which makes them easier to keep track of and avoids potential DHCP option conflicts with PXE booting and the like.

VLANs are easy and useful, but assuming a hardware / company policy issue, couldn't you filter for a MAC range with a policy for the DHCP scope? Considering the first few characters are determined by vendor all the phones should be easy to define a range for that nothing else will hit.

MAC filtered DHCP is going to end up way more complicated than a VLAN, but I think you could do it, and sometimes it's not fully in your control.

Dans Macabre
Apr 24, 2004


I've been using the same piece of junk voip handset for the past decade and even that supports PoE so what's their excuse

Adbot
ADBOT LOVES YOU

Rick
Feb 23, 2004
When I was 17, my father was so stupid, I didn't want to be seen with him in public. When I was 24, I was amazed at how much the old man had learned in just 7 years.
So we have some laptops at an offsite location we have limited control over the local internet. We used to have stable staff there but suddenly we don't. Is there a way to allow users to access these laptops without having been logged on to them at one of our main locations first?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply