u/nottypix

idrac zone doesn't send SNMP or SMTP via the admin zone?

Is there anything other than zero in the connection count for the rule?

I took away the Shutdown buttons.

I use Synology NASes as targets for my primary backup software: Altaro (I think it's Hornetsecurity now?) via SMB share, with the backup target NASes not domain-joined so Altaro has a completely different user/account.

I do hourly incremental backups of all VMs with Altaro on the hour to one NAS, and then use the native Synology "Active Backup for Business" to do hourly incremental backups on the x:30 mark to another NAS. I also do hourly backups of our (medical) testing equipment via Synology Active Backup to one of them Both of those copy their contents to NASes at two other of our locations, and something I just started doing- both "PRIMARY" NASes copy their entire contents to a TrueNAS box I made of a R340 server we obtained in a recent acquisition.

I do yearly Disaster Recovery testing, and since Altaro and Synology Active Backup both do instant-on VM booting, it's fairly simple to spin up all VMs from the backup hardware at HQ and/or the remote locations.

Being in healthcare, we still have a TON of on-prem presence. Onedrive and the like just can't match 10gbps+ folder redirection to all-flash storage when the doctors go room to room, logging in and out and in and out.

With all of that said, if you do go for Synology, don't setup regular RAID 5/6/10 arrays. Use their "SHR" or "SHR2" (Synology Hybrid Raid), as it will let you replace drives with larger drives one at a time and grow your pool as necessary. (learning that is actually why I have two at HQ, although now I don't know what I'd do without two of them with our workflow).

Having worked for MSPs for 20 years before settling into an internal position, I've been on both sides of this. It's why I absolutely do not trust "aaS" or "Fully Managed ________".

Its fully managed bullshit.

your users are able to read?

Ensure ports 500 and 4500 are allowed outbound with ZERO DPI or security services enabled for those ports.

I created separate LAN->WAN access rules for those ports to be able to disable Security Services on those, and put the rule above the bigger LAN->WAN rule.

Eh....maybe the first time, possibly the second time. When someone comes to me for the 100th time for the exact same issue, an issue that's literally part of their job duties, I'm going to get annoyed. Then by the 200th time I'm going to get pissed off that my time is constantly being wasted because they can't remember how to do their own job, and since I'm now doing part of everybody else's jobs, my projects are stacked up to the point of being overwhelming with deadlines approaching.

Actual issue right now that drives this home:

3 months of training for new LoB software. Old LoB software is still available for reference. The icon is a different color now. EVERYONE was informed of this, not only by mouth, but in their daily training in the new LoB software for the last 3 months.

Not only did almost everyone in the company put in a ticket about "XXX software is missing" (icon is a different color), but SOME people asked "What's this??!!!??" when we held their hands and got them signed into the new software....that they've been training for 3 months on (in a sandbox, but the only difference is the URL)

or in healthcare.

you need a real RMM. Action1 is free for the first 100 endpoints.

TeamViewer was completely compromised and DENIED it.

FIVE FUCKING TIMES.

Blocked at the firewall level for us.

Anything but TeamViewer.

that IS the printer port...

open something and click print to bring up the print dialog box. Does it show your installed printer as \printserver\sharedprinter ?

yup. and SMB healthcare at that.

tell that to my ~ 15,000 pages per week of faxes

So you use a pile of hardware built by or certified by one single company and it works. I would hope so!

While some banks are getting stingier with funding based on how much OpEx you're bleeding, but won't blink an eye to loan boat-loads for CapEx stuff (one-time cost vs ongoing)

so it's directly connected to the SonicWall? If it's in the same zone or vlan as your workstations, don't do that. It's not a switch.

create a bandwidth profile (like minimum 10mbps, maximum 10000mbps) and apply that bandwidth profile to your access rule that allows your workstations to talk to the "production box".

If all machines are in the same subnet or zone, this won't work. If they are, then this isn't the way to go about it at all. You'll need to make your changes in your switch(es).

I would like to add to this that if you use "proper" RAID, you're stuck with that size disk. With SHR, you can replace a disk with a larger one and keep moving. I had to buy an expansion unit to dump to, then change the main array's type from RAID 10 to SHR2, and then I could replace disks with bigger ones. Synology is SLOOOOWWW AF doing any of this too. (took two weeks of waiting for all of the rebuilds to finish, one by one per drive)

What actual equipment are you using?

I experienced similar behavior at a couple of sites until I got rid of the AGG-Pro switches at the core. They do not respect RSTP settings and would randomly make a little 8 port switch the root-bridge, causing all kinds of trouble. The unifi system thought there were 400+ clients connected to that little thing.

However, I do not use Unifi gateways (ew!) and came to the conclusion that those would operate better within their ecosystem. (like YEARS of DHCP issues using non-unifi DHCP servers)

capture client ties the machine/user to SonicWall logging though.

don't add a secondary...

Windows doesn't have a "primary" or "Secondary". It will choose which DNS server to use at random. In an AD setting, that makes things hard to troubleshoot.

blueiris will use USB cameras.

For all those that have the ability to work remotely. In-office is 100% desk phones, including our call center.

We do have web-based manipulation of our phone/presence/dialing/etc..., but I'm the only one who uses it. That, and I'm going to be rolling out the mobile app with the iPads I'm starting to distribute, but that still wouldn't be for everyone. Just VIPs.

on the flipside, I've been tasked with rolling out physical phones for our users so they "have all of the park slot buttons".

why wouldn't you just hand out your AD DNS servers with your DHCP addressing?