Guaranteed traffic for leadership?

I'm serving as Stake Technology Specialist. I received a request from my stake president asking if there is any possible way that I could configure the system in the stake center such that there were guaranteed bandwidth available to the leadership. Basically, since he is at the building for several hours every Sunday beyond his sacrament meeting, he would like to have reliable access to Internet sites related to his calling in spite of how ever many other church members in other wards are saturating the LDSAccess wifi at the moment, and without having to tether his equipment to a cell phone data plan.

I am aware that I can use tm.lds.org to dynamically tighten the firewall filters on Sunday from normal to strict, so that members aren't able to access bandwidth-hogging services like video downloads, in the hope that it makes the overall bandwidth usage nicer for everyone (including the stake president), but that's not the same as actually guaranteeing bandwidth to any particular client.

The stake president even offered to provide a separate Access Point box in order to allow me to setup a second SSID/password (leadership would be told to use that network to get guaranteed bandwidth, while the general membership continues to use the LDSAccess SSID for whatever bandwidth is leftover). If I were to install that AP in between the ISP modem and the firewall box, then I've trivially met the bandwidth guarantees (the AP gets traffic first, and the firewall gets whatever is left over) - but bypassing the firewall filters is not wise. Conversely, if I put the AP downstream from the firewall, then it is competing with everything else the firewall is servicing (so filtering works, but not only did I not solve bandwidth, but it might actually be worse for the leadership SSID depending on whether the firewall treats the AP as a single client rather than as a passthrough device to multiple clients). Then, regardless of whether I were to stick an AP before or after the firewall, there's the even bigger issue that church policy recommends against installing any rogue equipment (inserting our own equipment instead of using what the FM group provides is NOT the way technology is supposed to be run).

I know that it is a common thing in enterprise-grade networking equipment to be able to set up separate subnets and/or SSID, where you can configure priority levels of service based on which subnet a client is connected to, or even based on client MAC addresses. However, in browsing through tm.lds.org, while the firewall equipment itself may be capable of such a network setup, the interface exposed to STS does NOT let me tweak anything along those lines (I can see that my firewall has three zones: USER serving 192.168.108.2 - 192.168.111.254, with all the Meraki AP tied to that zone; then FAC serving 10.173.33.2 - 10.173.33.14 and SP serving 10.156.171.2 - 10.156.171.254) - but no way to add a new zone, or to switch an AP over to a different zone, or anything else that would let me set up priority traffic for leadership.

Does anyone have ideas or solutions they have used for giving guaranteed bandwidth to leadership while still remaining compliant to policy? Or is this something where I will gently have to inform my stake president that as important as his calling is, I still can't bend the rules to give him better Internet access than anyone else in the building?

ebb9 wrote:I received a request from my stake president asking if there is any possible way that I could configure the system in the stake center such that there were guaranteed bandwidth available to the leadership.

None that has been revealed.

ebb9 wrote:Or is this something where I will gently have to inform my stake president that as important as his calling is, I still can't bend the rules to give him better Internet access than anyone else in the building?

I think you've just answered your own question.

It's not just him, but the clerks and others doing church business. I think your best plan is to change the filtering level.

Or turn off the AP’s assuming that the Clerk computers are hard wired to the network?

Biggles wrote:Or turn off the AP’s assuming that the Clerk computers are hard wired to the network?

The stake center building is old enough that it did not come with any in-wall wiring. The stake clerk's office has a hard-wired connection obviously added after the fact in a conduit from the drop ceiling, but the three ward computers rely on wifi (and I have no idea how hard it would be to add more drop-down conduits to those additional rooms). Thus, killing wifi APs would negatively impact the ward clerks. That, and the stake president is a fan of his ipad which has wifi but no RJ45 port. Even if I turn off the Meraki AP, someone would undoubtedly be turning the hard-wired port into a wifi AP (at least the stake president was nice enough to ask me if I'd install his AP, rather than trying to do it himself - because I'm sure there are other stakes out there where leaders have completely bypassed the STS for an even harder-to-audit situation).

(funny story: while I was auditing the equipment, I noticed the ward clerk computers had their wired ports cabled up, although Windows reported no internet access from the wire. Tracing the cables, I found them connected to a box labeled "3dds.com Keval Online" with that box further connected to a landline phone jack with no dial tone - it looks to be a really old modem from a company that is no longer in business, and that the previous STS faithfully kept the connection cabled across computer upgrades long after the land line phone was no longer useful, and without realizing that the ward clerk computers now depend on wifi)

ebb9 wrote:The stake center building is old enough that it did not come with any in-wall wiring. The stake clerk's office has a hard-wired connection obviously added after the fact in a conduit from the drop ceiling, but the three ward computers rely on wifi (and I have no idea how hard it would be to add more drop-down conduits to those additional rooms).

That, my friend, is where the FM folks come in. The installers they contract with have wired buildings of every kind of configuration and age. It takes FM budget money to hire the contractors, so if funds are tight it may have to be budgeted in for a future year, but this is who the stake president and/or PFR should be dealing with. I applaud your creative thinking, but there's only so much an STS can do. IMO, hard wiring all the ward offices should be the next move.

BTW, who is your ISP and what kind of bandwidth are you getting?

Mikerowaved wrote:

ebb9 wrote:The stake center building is old enough that it did not come with any in-wall wiring.

That, my friend, is where the FM folks come in.

Agreed. My stake center was built in 1941 using the then new "continuous pour" cement technique. All church computers are hard wired. Done by a contractor hired by FM.

Mikerowaved wrote:BTW, who is your ISP and what kind of bandwidth are you getting?

This is something worth looking at. It may be worth calling around and seeing if you can get more speed at a reasonable price.

Probably the best way is to set up an entirely new zone for those in leadership. Most major filtering solutions allow for this, where you can set policies for different workgroups and this approach is the most commonly used to manage bandwidth use. For example, leaders would have access to a few more sites than members would in meetinghouses, examples would be cloud storage where they might have something they need to show and they would stream from that, or some other sites that provide practical tools they might need.

On a given Sunday, members in meetinghouses only need access to Church resources and apps, there may be a way to block apps outside of that--there is a lot of talk about that in the commercial space, I think what the real problem is is that those who manage what is allowed or blocked on the general level got the sites OK, but not the corresponding apps, almost every site named in the April email and some things later has a corresponding iOS and Android app.

Then there are the VPN tunnels, someone said we got the two or three biggest ones app, but not the rest or only a few of the rest and there are a lot. It is whack-a-mole on those though, block one and they will find another, and new ones are created all the time.

I just thought of another, unexpected issue, one that is unexpected because we may not have realized there might be a problem.

Some meetinghouses contain an FHC. The machines there are normally in the FHC zone, and FHCs have wifi. So, the problem there may be that some that are near the wifi are getting on through the wifi that is on the FHC zone as that allows some sites that are necessary for FHCs such as the partner sites to be accessed through wifi, and their apps, and it is in some aspects different than the site listing in the Normal mode or Strict mode.

So, while they may be going through the firewall, the WAP may be on a different zone than the rest of the building, and anyone near that WAP may be getting to sites that are blocked where they are on a different zone. That WAP should be off when the FHC is not in use, and only on when the FHC area is in use.

JamesAnderson wrote:Probably the best way is to set up an entirely new zone for those in leadership.

Just to be clear, that option isn't available to us as stakes/wards. The filtering is set at the firewall level, not the zone level.

To Implement such a thing would require somehow logging into the network so the network can recognize the calling the leader holds. The problems with a different SSID/password is that in a short period of time all the "cool kids" have that information.

The church was contemplating this, until they discovered that it would in insecure unless the STS installed certificates on all the leader's devices.

JamesAnderson wrote:The machines there are normally in the FHC zone, and FHCs have wifi.

In my last conversation with someone in networking, I was told that FHCs technically didn't have WiFi, that it was expected that people would be using building WiFi. Of course, I know not all FHCs follow that. Also, I was told that currently there's no difference in filtering between the USER zone and the FAC zone.

russellhltn wrote:The filtering is set at the firewall level, not the zone level.

Actually, the SP zone used for FHCs has a different filtering level than the USER zone the members use. It is the USER zone that changes when an STS changes the filtering level.

I do not know how the FAC zone filtering works.

You are correct that the stake cannot add additional zones. Those are regulated by headquarters.

lajackson wrote:

russellhltn wrote:The filtering is set at the firewall level, not the zone level.

Actually, the SP zone used for FHCs has a different filtering level than the USER zone the members use. It is the USER zone that changes when an STS changes the filtering level.

I do not know how the FAC zone filtering works.

I stand corrected.

But, unless the strictest filtering cuts down the traffic enough to allow connection, restricting just some of the traffic (the general membership) isn't going to work either. At some point you may have to start turning off APs. They can be controlled individually from TM.

JamesAnderson wrote:The machines there are normally in the FHC zone, and FHCs have wifi.

FHC's don't normally have their own WiFi. If they do, they use their own consumer AP with different login credentials than the rest of the building.

Mikerowaved wrote:FHC's don't normally have their own WiFi. If they do, they use their own consumer AP with different login credentials than the rest of the building.

Yet another variation.

I'd love to see what use-cases this SP has that is impacting the ability to do his calling that doesn't also apply to members of the wards unable to do their callings. I don't have much sympathy to be honest. If I were this STS I'd say, well, the intention is that you download anything you need before you come to church to do your callings. It would be tongue-in-cheek but he is literally the only person that can affect the speed of internet in the meetinghouse.

johnshaw wrote:I'd love to see what use-cases this SP has that is impacting the ability to do his calling that doesn't also apply to members of the wards unable to do their callings.

I'd imagine it has to do with LCR. We haven't heard yet what the ISP bandwidth is. Perhaps this building just shouldn't have WiFi - at least not building wide. I'm pretty close to that with my "problem child" unit running on 4G.

We had bottlenecks, until we updated the cabling to the best CAT 5 stuff we could get, also reran some of that and now no spots where we get less bars or other issues causing sluggishness. Did this last year and it is as good or better than most other places that also offer free wifi, and this was before the filtering policies change.

Mikerowaved wrote:It takes FM budget money to hire the contractors, so if funds are tight it may have to be budgeted in for a future year, but this is who the stake president and/or PFR should be dealing with. I applaud your creative thinking, but there's only so much an STS can do. IMO, hard wiring all the ward offices should be the next move.

Indeed, and I've already started contacting PFR/FM group to ask about that, especially given the recent initiative to get rid of land lines where possible.

Mikerowaved wrote:BTW, who is your ISP and what kind of bandwidth are you getting?

AT&T, and speed tests are currently hitting 0.75Mbps up, and anywhere between 8 and 13 Mbps down (probably depends on whether I ran the test when something else was competing for bandwidth).

russellhltn wrote:

johnshaw wrote:I'd love to see what use-cases this SP has that is impacting the ability to do his calling that doesn't also apply to members of the wards unable to do their callings.

I'd imagine it has to do with LCR. We haven't heard yet what the ISP bandwidth is. Perhaps this building just shouldn't have WiFi - at least not building wide. I'm pretty close to that with my "problem child" unit running on 4G.

I have no idea what the ideal bandwidth is for the hammering that a typical congregation places on the system each Sunday. I am aware that I can adjust filter strictness to see if it helps. I also don't know if it is possible to request more bandwidth from AT&T; and even if it is possible, how much it would increase the stake's costs. I don't even know what rate the current contract promises, only that I have measured between 8 and 13 Mbps down.

In subsequent emails with stake leadership, I'm now seeing a slightly different picture for the SP's request - it may be more that he is unable to get a wifi connection at all, rather than a question about getting guaranteed bandwidth (and more an issue because his preferred devices have to use wifi because they don't have ports for wired). He reported that even on a Thursday night high council meeting, when there were not lots of members hitting the wifi like on Sundays, they still spent 10 minutes at the start of the meeting figuring out who could get on the wifi. Or quoting from some of the other emails:

"Can not get my computer to connect to the WiFi while sitting in the Stake Clerks office.
Next, move into the High Council Room. Boom, connects right up.
Next, move into the Stake Presidents office. Our Stake President cannot connect to the WiFi. He is forced to use his personal cell phone as a Hot Spot to access the internet."
and a reply from the FM group:
"The Church is in the process of replacing existing wireless APs with newer Meraki APs. The APs at Duncanville were recently changed, but we will need perform adjustments to take care of the issues you identified. This may take a 2-3 weeks to get back to the Duncanville building as we have 13 other buildings in process, but we will do all we can to address the issue as soon as possible."
with instructions that I shouldn't move the Merakis around myself.

And then, today while troubleshooting General Conference (our satellite reception went down, so I had to enable internet streaming as the backup), I purposefully disabled the wifi through tm.lds.org, at least all of the Meraki units listed, but even with that, I was still picking up an LDSAccess hotspot near the stake offices - so it looks like I do get to chase down a rogue AP. I was too busy today to play with a wifi analyzer on my phone to actually try and locate the rogue hotspot or map out the signal strength in various rooms when the Merakis are enabled, but trust that the FM group will eventually get it right, and that hopefully this is just a temporary problem.

ebb9 wrote:I have measured between 8 and 13 Mbps down.

Not great, but as long as no one is trying to stream video, it's probably adequate. I'll have to check, but I think our stake center is only 10Mbps and they have up to three wards on the network at the same time.

ebb9 wrote:I'm now seeing a slightly different picture for the SP's request - it may be more that he is unable to get a wifi connection at all,

That's a horse of a different color!

Some of use have used ekahau to do a heat map of the building. (It goes a lot better if you have a floor plan to load up.)

ebb9 wrote:"The Church is in the process of replacing existing wireless APs with newer Meraki APs."

That's true. I haven't tried anything yet to see if they're any better or worse than the old Cisco APs.

ebb9 wrote: I was still picking up an LDSAccess hotspot near the stake offices - so it looks like I do get to chase down a rogue AP.

When FM changed out the APs in our stake center, I was short one. Looking around, it was there and working, just not listed in TM. So, it might not be that "rogue". Just unlisted. Unfortunately, someone will have to get the serial number to get it added to TM.

russellhltn wrote:When FM changed out the APs in our stake center, I was short one. Looking around, it was there and working, just not listed in TM. So, it might not be that "rogue". Just unlisted. Unfortunately, someone will have to get the serial number to get it added to TM.

Although this is true for an MR33 that hasn’t been configured via a Church firewall. A previously configured MR33, will have the normal Church SSID visible to a device, but won’t appear in TM until the serial number is added to TM. The act of registering the MR33 causes the Church configuration to be downloaded, on a new install.

ebb9 wrote:"Can not get my computer to connect to the WiFi while sitting in the Stake Clerks office.
Next, move into the High Council Room. Boom, connects right up.
Next, move into the Stake Presidents office. Our Stake President cannot connect to the WiFi. He is forced to use his personal cell phone as a Hot Spot to access the internet."

Distance from a wireless access point will affect your WiFi speed and connectivity, as well. It sounds as if your nearest AP is in or over the high council room.

I have found that neighbors who are using the same channels also interfere with meetinghouse wireless. It seems that everyone likes to use channels 1, 6, and 11. We have no control over which channels we use, and our neighbors don't know or care how to change their channels.

Biggles wrote:Although this is true for an MR33 that hasn’t been configured via a Church firewall.

Can you elaborate? I'm confused.

What are you confused about? My, not very eloquent explaination, goes into how the MR33 is, or isn’t configured. I’m guessing that might be the confusing bit?

I've received the same request. Can a leaders laptop, ipad or iphone be assigned to a static port? Would this guarantee wifi access even during peak usage? Is there a downside to doing this?

Rtdean wrote:Can a leaders laptop, ipad or iphone be assigned to a static port?

Probably.

Rtdean wrote:Would this guarantee wifi access even during peak usage?

No. The problem is bandwidth, not IP addresses. There's no way to assign privileges by IP.

Bottom line is there's no privileged users. Your only tools are filtering level and active AP location.

We were having a similar issue with poor internet connectivity in the stake offices. We got the FM group to provide us an extra MR33 access point and POE injector. We wired up the extra MR33 access point into the attic above stake offices and haven't had any issues since. We are paying for 100mb internet in the building, and we seem to get about 50-70mb download speeds most of the time when the connection is being stressed, but in any case it seems to be working well even with everyone in the building on Sunday.