Multiple (connected) physical locations, or VLANs

[alexwyatt]

Our district is split into two major VLANs, one for each building, across a physical WAN that allows the whole district to connect as if it were one LAN. Bonjour won't communicate across these VLANs however, so Casper won't work in both buildings at the same time (I can unplug the server and stick it on a different VLAN, manage, and switch it back...but that's pretty useless!)

Is it possible to make a second, subordinate server on the other VLAN, which does nothing but relay settings/commands/etc from the main server across the VLAN gap? I'm trying to avoid having two servers for management, but this doesn't seem to be possible from what I have found

I've seen suggestions for L3 switching between the VLANs, but that's a major financial cost. I've tried Bonjour Gateways but have never gotten one to behave. I also tried plugging the server into a trunk/tagged port (it'd be on an HP switch so...I might have messed that up) and setting up the VLANs on the Mac, and that seemed to work for a while and then it stopped for no apparent reason. I'm just trying to be able to manage these things in both buildings...can you help a guy out?

[roadrunner2348]

Not sure what part of Casper your speaking to but I can't think of any piece of casper that uses bonjour. I know the JAMF binary (client software) definitely does not use bonjour to communicate. Our network consists of about 60 VLANS or so across 4 locations, and were managing everything with one server. As long as the macbooks can connect to the ip or dns name of the JSS server they should be able to communicate.

[bentoms]

@alexwyatt, when you say manage.. Do you mean image?

You can NetBoot over VLANs by adding IPHelpers. http://cisconet.com/tcpip/dhcp/107-how-to-use-ip-helper-address-to-connect-remote-dhcp-server.html

Else, if it's communication with the JSS.. Then are you using an FQDN? Like JSS.mycompany.com? If not, & both sites use the same DNS.. Then I'd suggest you use the FQDN.. Then the clients should be able to connect (barring firewall).

Lastly, if bandwidth is a concern. You could have a second server at the other site. We have 11 mac servers, each site uses it's local server. All clients contact the JSS hosted in our central site.

[alexwyatt]

roadrunner2348: Well maybe Bonjour isn't the problem...but Casper is definitely broadcasting Bonjour services so I always thought that might be it (especially upon discovering that Bonjour doesn't work seamlessly through different subnets). Maybe when it was first set up (prior to my tenure here) it was just done in such a way that things didn't work for no apparent reason

bentoms: Perhaps the FQDN is the real problem, as we do in fact have a separate DNS set up for each building. I've been meaning to switch to that over the "casper.local", and planned to do it this summer, so if I'm lucky that'll fix all of our problems

Bandwidth could be an issue depending on how demanding things are, but I'm not sure since we haven't implemented a lot of Casper features to their fullest yet. I'm not quite sure what you mean about your setup though. You say you have a separate server in each location, which is what I'm considering. When you say all the clients work with a central JSS, do you mean that each of those 11 servers is managed via a single JSS on the central server, or do you mean that each iPad/Mac you manage communicates with central? If the latter...I'm not sure where the bandwidth savings come from. Could you help me out? :)

EDIT 4/28: To answer your question, I do *not* mean "image". I'd just like for a...satellite server at the second building, which would handle all the iPad interaction, but still took orders/settings from the main server. Failing that, I could just have two servers managed completely separately...but that'd be a certificate nightmare I'm sure!

[bentoms]

@alexwyatt, we have 1 JSS for all macs to connect to for polices etc. On each site we have a mac server acting as a distribution point for imaging & for the clients to download packages. (So the data is local). The clients then use the local server as assigned by it's network segment.

I'd suggest you setup your JSS with an FQDN on both DNS servers, (the same FQDN). That way client devices in both buildings should be able to communicate with the JSS, (as long as all the needed ports are open if there is a firewall in place).

If you're looking at just managing iDevices, then the bandwidth usage will be minimal unless your hosting in house apps. Even then one server may suffice.

If your looking at managing macs too, I'd suggest a second server in the other bundling.. With network segments setup to point clients to use that server for NetBoot, imaging, packages & software updates.

In fact, for a level of redundancy I'd suggest a server in each location anyway. That way you can set the distribution points to fail over between each other (in case of an outage). I'd also backup the JSS's DB backups to the second server so it can be made into a JSS incase the JSS server goes down.