Hardware

Portland Public Schools Follows Step-by-Step Approach to Deploying Computer Images

Five-step process helps school district set up site-to-site VPN tunnel with CDW•G to transmit images.

Google+ Twitter

Steve has more than 30 years of journalism and publishing experience, most of the last 20 of which were spent covering technology. He has covered networking and telecommunications in corporate computing, government and small business environments.

A few years ago, Portland Public Schools in Oregon laid out its vision for the future. Officials wanted to quickly get technology into the hands of students, teachers and staff to continue the district’s already strong track record of academic achievement.

Statewide test scores were up in almost every category in 2014, and U.S. News & World Report recently named two of PPS’s high schools among the state’s 10 best. But the district’s IT staff decided more could be done to provide students and teachers with fast, efficient access to the latest hardware and resources.

Administrators reached out to technology partner CDW to discuss different ways in which new hardware, including computers, could be customized, imaged and delivered directly to schools.

Those discussions led to CDW’s Advanced Image Deployment Service. The solution involves the creation of a secure VPN tunnel between Microsoft System Center Configuration Manager (SCCM) servers at the district and the technology provider. The dedicated network connection, which includes a VPN appliance with a static IP address, allows school IT administrators to replicate computer images directly to the distribution point server at CDW.

Educators say the VPN connection between the school and CDW reduces the time it takes to set up and deliver new technology and saves the district in other areas, such as warehouse storage costs. Rather than send machines to a district office to be configured and distributed, CDW sends the hardware directly to the schools where it is needed.

14,000

The number of PCs Portland Public Schools had to reimage when it moved on to Windows 7 from Windows XP

Though VPN technology has been around for a while, costs have declined and security has improved to a point where the technology has become a viable option for schools, says Jonathan Vail, user experience management lead at PPS.

How It Works

PPS creates computer images on a SCCM server. Those images are then sent via dedicated connection across the network to CDW’s configuration/distribution center in North Las Vegas. Technicians consult the instructions sent by the district and install the images as directed on new PCs. Machines are delivered and are ready to go, out of the box.

Ryan Whitman-Morales, technical services director at PPS, says the foundation for this latest collaboration was laid several years earlier when the district transitioned to Microsoft Active Directory.

“The missing link was that even with all the improvements from Active Directory and SCCM, we still didn’t have a direct network connection between PPS and CDW,” he explains.

What follows is the step-by-step process by which PPS set up its VPN tunnel in partnership with CDW.

Preconfigure a VPN appliance. The VPN appliance (in this case, a Cisco Systems ASA 5505 unit) and an SCCM distribution point server were configured by district IT staff and sent to North Las Vegas for CDW technicians to access. The image files are transmitted over a 2-gigabit Internet connection from the district’s office to the VPN appliance on the CDW side. The district maintains a Cisco ASA 5585 unit and a secondary server on its side.
Secure the tunnel. As a security measure, CDW requires its customers to provide a list of customer IP addresses and/or an IP address range that will touch the peer address — the static public IP address assigned to the customer. For security purposes, all other IP addresses are denied access. Ports allowed through the VPN connection are limited to IPSec, HTTPS and SSH. This connection is isolated and segmented from the CDW network and any other networks in the North Las Vegas facility that also deliver a secure connection to devices being imaged.
Ship the preconfigured VPN device to the technology partner. CDW provided PPS with a return merchandise authorization number and instructions on how to send the preconfigured Cisco ASA appliance and SCCM server to CDW’s facility. PPS then shipped the hardware to technicians at CDW’s Configuration Center.
Test the VPN appliance. Once it received the district’s Cisco ASA unit, CDW contacted PPS to test the VPN traffic. Adam Seitz, PPS systems administrator, says the testing process was fairly straightforward and didn’t take more than a few hours. After the VPN connection was established and traffic validated, CDW racked the VPN appliance and deployment server in its data center in North Las Vegas. The secure, climate-controlled facility is monitored by video surveillance.
Retain management of devices. After the appliance was tested and racked, the district maintained full remote control of its VPN appliance and remote deployment server.

The new system came in handy earlier this year when PPS was moving off Windows XP and had to reimage all 14,000 machines, Whitman-Morales says. As of late fall, the district was about 84 percent done, largely because of the speed with which they now deploy new images across the district.

“It doesn’t matter if it’s during busy times like last spring, or if we get a large donation and need to image new machines, we now have the infrastructure, tools and network connection in place to quickly image computers and upload software any time we need them,” says Whitman-Morales.

3 Reasons Setting Up a VPN Tunnel Might Work for Your School

1. Low cost: Districts can run a VPN tunnel over the public Internet as opposed to more expensive T1 or T3 lines. T1 lines can run in excess of $1,000 per month. Some T3 lines cost more than $10,000. A site-to-site VPN typically costs half that.

2. Security: VPN tunnels are encrypted, so districts can feel comfortable that the data is secure. Technology providers such as CDW block most traffic, permitting only IPSec, HTTPS and SSH traffic.

3. Improved logistics: Once the computers are imaged at CDW’s facility in North Las Vegas, they are boxed and shipped directly to the school. This saves districts money on storage and saves IT staff from having to physically distribute the computers site to site.

6 Supplemental Services

CDW’s Advanced Image Deployment Service offers more than a site-to-site VPN connection between the school system and its technology partner. The service helps minimize the time needed for application installation and system deployment by eliminating defective devices and associated return merchandise authorizations, reduces shipping costs by sending devices directly to the school sites where they’ll be used, deploys PCs on schedule and frees the customer’s IT staff to focus on core business objectives. Some of the additional services CDW offers include:

Computer naming: Before a computer can be used on a network, it must be assigned a unique name. CDW can incorporate this step into the imaging process.
Domain join: CDW uses a VPN to join the computer to the domain, making it plug-and-play ready.
Security policies: CDW can apply security policies assigned from Group Policies so systems are secure out of the box.
Laser etching: Engraving a computer with a laser adds branding, provides a theft deterrent and increases the odds that a lost or stolen PC will be returned by law enforcement.
Asset tagging: Asset tags allow the customer to track numerous details about the device and run custom reports in CDW’s asset tracking system.
Kitting: IT departments traditionally received computers in stages — PCs, the monitors, then peripherals. CDW’s process combines these items in a single shipment.

ROBBIE MCCLARAN