Tag Archive for cisco

Whither the virtual audience?

studnet speaker

We successfully broadcast Catlin Gabel’s workshop to design the school’s next community event(s). I had the uStream working smoothly, the facilitator played his role perfectly, and we included the contributions from virtual participants in the real workshop. In the two weeks before the event, we made at least eight announcements in newsletters, email messages, and online articles that people would be able to attend the workshop online. We have some 3,000 alumni and 500 current families from which to draw a virtual audience.

Only five people showed up, and two were my IT colleagues.

What happened? What is the potential of live web broadcasting in a school?

I have seen uStream used most successfully in an educational setting to live broadcast major speeches and conferences. I recently tuned into a great presentation at Castilleja School. A Stanford professor was explaining how all websites, but social networks in particular, are vehicles of persuasion. I was the only virtual attendee.

Broadcasting educational technology conferences seems popular of late. The audience is large, widely dispersed, and technologically savvy. Still, having been a virtual participant before, the presentation quality is poor enough that it makes difficult to pick up everything that is going on. Our virtual participants on Saturday made the same comment.

I don’t feel compelled to live broadcast major events at our school. I would rather record with videocamera and then publish the next day, in higher quality than uStream and as a permanent addition to our site. Just last week, I recorded our Martin Luther King, Jr. community meeting (elementary), published it to a private page for our community, and already it has been viewed 70 times.

Perhaps people are just too busy to attend a live, five-hour online event at a specific time. They can play recorded online video at their convenience. Maybe for this event, we should have eschewed live participation in favor of making a highlight reel of the major points in a recorded video format. Or maybe the gesture of opening the meeting to virtual participants was a sufficiently important to justify the work involved.

Perhaps we were competing for audience against ourselves. If the 100 most interested people actually came to the event to participate in person, how many more did that leave to participate virtually?

Have you seen the new Cisco ads showing telepresence in classrooms? Who really thinks that schools will be able to afford high-end video conferencing of this sort? Grocery stores have far more flat-panel televisions than schools these days, and they sell food.

I would like my next attempt at live broadcast to involve a sports event. Sports have the immediacy of experience that demands a live broadcast, color commentary could be fun and interesting, and the project would involve students. However, we would still be competing against ourselves for audience, the potential audience is relatively small, and a lot of people might feel content to just find out the score the next day. It’s worth a try, though, as students studying at home could easily tune in and follow the game.

I could imagine a schoolwide event during which we partnered with one or more schools elsewhere to pursue the same agenda and discuss similar topics. However, I would choose Skype for such a broadcast, so that it would be equally bidirectional.

Have you used uStream in a school with more success? Did you draw an actual audience? Please tell us about it.

Network Access Control

Our IT team has been meeting regularly to determine new infrastructure projects for the year. The list includes network access control and wireless access controller systems. Our discussions reveal a common theme: how many of the components of an enterprise computer network should we acquire and maintain, considering their benefits and costs?

Network access control is currently up for consideration. Three years ago, we installed our first network access control system to bring the following benefits to our school.

Limit the campus network to known computers and users
If computers not known to the IT department get on the LAN, they may be infected with viruses or running a spambot or other malicious software. Network access control software ensures that only computers that IT manages can get on the network. They do this through different methods, including client login and MAC address filter.

Offer guests an open wireless network for Internet access
If we limit the campus LAN to known users, then we should provide an open network for parents, vendors, guests, and users’ personal wireless devices so that they may still get online. The guest network presents a welcome page (captive portal) to the user that includes terms and conditions. The guest network only provides Internet access, protecting the school’s file server, print server, and other network resources. Guests may still access the school’s websites.

Track network activity by user
Increasingly, division heads have asked us to identify one student who has bulled another student through the campus network. If users are required to log in to access the campus network, then it becomes easier to trace network activity to a specific user. We have also implemented DHCP reservations so that the IP address on record is a reliable indicator of what computer was used for each network activity. This works well for a computer with only one user and less well in shared facilities. Since client login lasts an entire day (to avoid bugging users with multiple daily login requests), users of shared computers are not required to logi in often enough to positively identify each user.

Check computers for minimum system requirements
Even computers that we manage may become infected or compromised over the course of the year. We would ideally like to keep such computers off the network in order to protect the school’s systems and to stop an infected computer from spamming the world. One method is to block computers that do not meet minimum system requirements and then provide the user with links to the necessary software updates.

Current status
We currently run a Cisco Clean Access system to provide network access control and a public wireless network. We also gained the ability to track network activity by user, except for shared computer carts and labs. Despite lots of consultant help, we had great difficulty setting it up properly to perform these two functions. On account of the effort it took to get this far, we never did implement requirements checking beyond a small test group. Now, we are required to either upgrade to a new server software version (at great expense) or move to a different system.

Requiring users to log into client software to access the wireless network has been pretty intrusive. Ideally, this would be integrated with operating system login, but we hear that this is difficult to configure in our current NAC system with Windows and not possible for our Macs. Our users do not much like the additional login window that pops up, especially when it misbehaves, and they cannot access the wireless network.

Lower-cost options
Could RADIUS meet our needs? It’s a bit more do-it-yourself than buying a NAC product, it probably would not require user login, and it would not check systems for minumum system requirements. However, it would limit the network to known computers, which would take us part of the way toward our goal.

Setting our target appropriately
How much network sophistication can a school like ours afford to purchase and maintain? In a recent survey we conducted, only one of 26 peer schools was running NAC client software to check computers for minimum system requirements. The cost and effort required may not be worth the promise of reduced workstation maintenance and a safer network. We may have discovered that enterprise-level network access control is really

We will continue our investigation of different combinations of systems that could meet our needs and stay within budget.

AppleScript for laptop deployment and maintenance

Working in AppleScript again for the first time in many years, I have written a series of scripts that I hope will combine into a single application to partially automate fall laptop prep. Each fall, we collect and maintain 350 teacher and laptop students, a grossly time-consuming effort. Many configuration tasks involve opening an application and changing settings — difficult to do quickly and with consistently high accuracy. AppleScript has the ability to program changes in configuration.

As quirky as AppleScript is, it provides an ideal bridge between OS X GUI user friendliness and command-line power. Partly, this is because AppleScript can call execute shell and Perl commands, so one has the power of all three languages available. For example, the script collects the user’s password from a GUI window and then calls the shell commands cp to copy a missing driver from our file server to the local system and lpadmin to add the printers. One includes the password in the shell statement using simple text concatenation. Same for the Entourage configuration — capture the user name from AppleScript’s “name of current user” and then pass it to the Entourage configuration statement. Finally, you can package the entire thing into an executable application for use in-house or distribution to users. Way cool.

The first script turns off automatic VLAN detection for Cisco Clean Access agent, a feature that causes processor utilization to spike every few seconds, reducing battery life. The second automatically adds 20 or so SMB printers to the Macintosh using lpadmin, a useful post-restore action. A third configures Microsoft Entourage for our mail server. Next, I would like to set the user’s server shortcuts, check for proper antivirus operation, and check Acrobat Reader version.

Please note: these scripts are currently under development (they’re not yet finished) and contain Catlin Gabel-specific settings. Please use them to inform your own script-writing. They won’t work as-is on your network. Many thanks to William M. Smith for a couple key tips. His Entourage/Exchange setup script is terrific if you’re looking for that function — better generalized than what I have provided below.

-- Cisco Clean Access patch for CCAAgent
-- Disables automatic VLAN detection

do shell script "whoami"
set theUser to the result

do shell script "cp /applications/ccaagent.app/contents/resources/setting.plist \"/users/" & theUser & "/library/application support/cisco systems/ccaagent/preference.plist\""

tell application "System Events"
set the thePListPath to "/Users/" & theUser & "/Library/Application Support/Cisco Systems/CCAAgent/preference.plist"
tell application "System Events"
tell property list file thePListPath
tell contents
set previousValue to value
set value to ({|VlanDetectInterval|:"0"} & previousValue)
end tell
end tell
end tell
end tell

display alert "Auto VLAN detection turned off!"

-- Adds Catlin Gabel printers

-- get desired divisions
set theDivisions to {"LS", "MS", "US", "All"}
choose from list theDivisions with prompt "Which division?"
set theDivision to result as text

-- get user name and password
do shell script "whoami"
set theUser to the result
set thePassword to text returned of (display dialog "User's network password" default answer "" with hidden answer)

-- configure lists of printers, names, and driver file locations
-- need to add Graceland

set lsPrinterNames to {"LS 2nd grade", "LS Comp Lab B&W", "LS Library B&W - Duplexing", "LS Library Color - Duplexing", "LS Office - Duplexing", "LS Spanish", "LS French", "LS Japanese"}
set msPrinterNames to {"MS Library Color - Duplexing", "MS Mobile Blue", "MS Office", "MS Secret Garden - Duplexing", "MS Upper Hall"}
set usPrinterNames to {"US Art B&S", "US Dant 9 - Duplexing", "US Dant 12 - Duplexing", "US Dant Main - Duplexing", "US Dant 10", "US Library B&W - Duplexing", "US Comp Lab Color - Duplexing", "US Math - Duplexing", "US Modern Lang 2 - Duplexing", "US Modern Lang 5 - Duplexing", "US Office - Duplexing", "US Science Main", "US Vollum Learning Center Copier", "US Vollum Main - Duplexing"}

set lsPrinterDrivers to {"HP LaserJet 2200.gz", "HP LaserJet 4250.gz", "HP LaserJet 4000 Series.gz", "HP Color LaserJet 4650.gz", "HP LaserJet 4000 Series.gz", "HP LaserJet 4MP.gz", "HP LaserJet 4MP.gz", "HP LaserJet 1320 Series.gz"}
set msPrinterDrivers to {"HP Color LaserJet 4600.gz", "HP LaserJet 2100 Series.gz", "HP LaserJet 4100 Series.gz", "HP LaserJet 5MP.gz", "HP LaserJet 1320 Series.gz"}
set usPrinterDrivers to {"HP LaserJet P2015.gz", "HP LaserJet 2200.gz", "HP LaserJet 4350.gz", "HP LaserJet 4000 Series.gz", "HP LaserJet 4100 Series.gz", "HP Color LaserJet 4600.gz", "HP LaserJet 2300.gz", "HP LaserJet 2300.gz", "HP LaserJet 2300.gz", "HP LaserJet 4250.gz", "HP LaserJet 2100 Series.gz", "RICOH Aficio MP 161", "HP LaserJet 4100 Series.gz", "HP LaserJet 4100 Series.gz"}

-- copy Ricoh driver from installer folder to system PPD library
tell application "Finder"
open location "smb://" & theUser & ":" & thePassword & "@cgsfiles01/installers"
end tell
do shell script "cp \"/Volumes/Active/RICOH Aficio MP 161\" \"/Library/printers/PPDs/Contents/Resources/\""

-- set range of printers to install
if theDivision is equal to "ls" then
set thePrinters to lsPrinters
set thePrinterNames to lsPrinterNames
set thePrinterDrivers to lsPrinterDrivers
end if
if theDivision is equal to "ms" then
set thePrinters to msPrinters
set thePrinterNames to msPrinterNames
set thePrinterDrivers to msPrinterDrivers
end if
if theDivision is equal to "us" then
set thePrinters to usPrinters
set thePrinterNames to usPrinterNames
set thePrinterDrivers to usPrinterDrivers
end if
if theDivision is equal to "All" then
set thePrinters to lsPrinters & msPrinters & usPrinters
set thePrinterNames to lsPrinterNames & msPrinterNames & usPrinterNames
set thePrinterDrivers to lsPrinterDrivers & msPrinterDrivers & usPrinterDrivers
end if

-- loop through printers
repeat with x from 1 to the number of items in thePrinters
do shell script "/usr/sbin/lpadmin -p " & item x of thePrinters & " -E -v smb://" & theUser & ":" & thePassword & "@CATLIN/CGSPRINT01/" & item x of thePrinters & " -P \"/Library/Printers/PPDs/Contents/Resources/" & item x of thePrinterDrivers & "\" -D \"" & item x of thePrinterNames & "\" -o printer-is-shared=false"
end repeat

-- do shell script "/usr/sbin/lpadmin -p ITVLMOFC -E -v smb://" & theUser & ":" & thePassword & "@CATLIN/CGSPRINT01/ITVLMOFC -P \"/Library/Printers/PPDs/Contents/Resources/HP Laserjet 4000 Series.gz\" -D \"IT Vollum Office\" -o printer-is-shared=false"

display alert "Printers successfully added!"

-- Configure Entourage

tell application "System Events"
set theUser to name of current user
set fullName to full name of current user
end tell
set thePassword to text returned of (display dialog "User's network password" default answer "" with hidden answer)

tell application "Microsoft Entourage"

make new Exchange account with properties {name:"Catlin Gabel", Exchange server settings:{address:"https://webmail.catlin.edu/exchange", requires SSL:"true"}, Exchange ID:theUser, domain:"catlin", full name:fullName, email address:theUser & "@catlin.edu", LDAP server:"cgsdc00", search base:"ou=catlin users,dc=catlin,dc=edu", public folder server settings:{address:"https://webmail.catlin.edu/public", requires SSL:"true"}}

set enabled of schedule "Send & Receive All" to scheduled

end tell