FHC vs. Stake Internet

[nessie-p40]

Can someone please verify for me what the Churche's policy is on FHC Internet. Our FHC has been paying for their own ISP for some time now and the wards and Stakes have been "borrowing" the wireless signal for MLS, email, training, etc. The wireless signal from the FHC is very weak and the Stake wants to have its own strong connection with an eventual webcasting setup.

Am I suppose to utilize and/or modify the FHC equipment for Stake and ward use? Or am I suppose to leave the FHC equipement alone and purchase a Church Managed Firewall for the Stake and pay for an additional ISP?

Thanks

[russellhltn]

The FM group is to be paying the ISP for an official FHC. (Note, this must be an official one, not something thrown together by local leaders and called a FHC). As part of their setup, they should have a church managed firewall.

Under the direction of the stake president, units may be able to tap into the connection.

You can see the directive here, that allows the units to use the FHC connection.

[jdlessley]

Can someone please verify for me what the Churche's policy is on FHC Internet.

There are two policy letters affecting internet access for stake and ward administrative computers. The first is the February 11, 2008, Connecting Stake and Ward Clerk Computers to Church Communications Network (CCN) Internet Connections policy letter and the second is the August 8, 2008, Broadband Internet Services in Meetinghouses policy letter.

Our FHC has been paying for their own ISP for some time now and the wards and Stakes have been "borrowing" the wireless signal for MLS, email, training, etc. The wireless signal from the FHC is very weak and the Stake wants to have its own strong connection with an eventual webcasting setup.

The normal procedure for funding FHC broadband access is through the FM Group. There was a period of time last year when there was a bit of confusion as to who should be paying the bill.

Most FHCs come under the responsibility of the state president within their stake boundaries. As such the stake president will make the decisions regarding internet use. This includes whether to upgrade services or equipment.

Am I suppose to utilize and/or modify the FHC equipment for Stake and ward use? Or am I suppose to leave the FHC equipement alone and purchase a Church Managed Firewall for the Stake and pay for an additional ISP?

The stake technology specialist should be contacted about this. He will council with the stake president on how to manage the broadband internet access.

[nessie-p40]

I've been told that the firewall config for the FHC is much more restrictive that the Church Managed Firewall since its used by the public, is this true?

If the above is the case should the Stake purchase their own firewall and separate ISP account, since webcasting will require a higher speed connection anyway?

What is the customary practice for those Stakes in the Church with a FHC that has Internet access who want broadband Internet for furture webcasting?

If we utilize the FHC setup that is currently in place I suppose the Stake would not have to worry about a monthly bill (if the speed is sufficent for webcasting) since the FM Group is paying for the ISP, correct?

Does the Stake Tech Spec. have the authority to modify/upgrade the equipment that the FM Group has in place for the FHC to meet the needs of the Stake and wards?

Our FM Group rep says he does not know how to access the firewall for the FHC. I need to change the Network Key since I believe too many people have access to the FHC network and are using it during meetings, etc. Who do I contact to obtain passwords? How do I change the Network Key?

Lots of questions, thanks in advance for answering them.

[aebrown]

I've been told that the firewall config for the FHC is much more restrictive that the Church Managed Firewall since its used by the public, is this true?

No, actually the opposite is typically true. Because a FHC needs to search a variety of sites, it is configured with a filtering level called "General Access". Most FHCs that have been around for a while have a PIX firewall; as far as I know, every PIX in a FHC has that filtering level.

The General Access filtering level is now also available on the Cicsco ASA firewall that is the one provided to stakes for Internet connections; originally the ASA only supported LDS Extended Access and LDS Restricted Access (both of which are more restricted than General Access).

If the above is the case should the Stake purchase their own firewall and separate ISP account, since webcasting will require a higher speed connection anyway?

What is the customary practice for those Stakes in the Church with a FHC that has Internet access who want broadband Internet for furture webcasting?

Since the FHC has an Internet connection and firewall, it is not an option for the stake to purchase their own firewall. Church policy allows for only one Internet connection per building. So if the FHC connection is not sufficient, you need to work with the FM Group to make changes in the ISP or whatever is needed to make the connection work better.

If the issue is simply the wireless access, then your stake can choose (at its cost) to extend the wired network from the FHC to the clerk offices and whatever other places in the building need an Internet connection.

If we utilize the FHC setup that is currently in place I suppose the Stake would not have to worry about a monthly bill (if the speed is sufficent for webcasting) since the FM Group is paying for the ISP, correct?

Correct. Even if the Internet connection in the FHC is upgraded, the FM Group would still be responsible for the monthly bill.

Does the Stake Tech Spec. have the authority to modify/upgrade the equipment that the FM Group has in place for the FHC to meet the needs of the Stake and wards?

An FHC will have up to four kinds of equipment, with different entities responsible:

1. The Broadband modem. This is connected to the monthly ISP bill, and so cannot be modified without coordinating with the FM Group. But if the FM Group agrees to make a change, the STS would be involved in connecting the new equipment.
2. The Church-managed firewall. This is installed by the STS, but is managed by the Global Service Center. The STS does not configure it himself.
3. A Church-installed wireless network. This may or may not be present, but if it is, it probably has Cisco Aironet 1200 or similar Wireless Access Points. If this exists, the WAPs are managed by the Global Service Center.
4. Everything else behind the firewall (cables, switches, PCs, other routers, other WAPs) are the stake's responsibility and are managed by the STS.

Our FM Group rep says he does not know how to access the firewall for the FHC. I need to change the Network Key since I believe too many people have access to the FHC network and are using it during meetings, etc. Who do I contact to obtain passwords? How do I change the Network Key?

Contact the Global Service Center at 1-866-678-2763. As I mentioned above, the GSC manages the firewall, so you can only obtain this information or change access through them (assuming you are the stake technology specialist).

[aebrown]

Since the FHC has an Internet connection and firewall, it is not an option for the stake to purchase their own firewall. Church policy allows for only one Internet connection per building. So if the FHC connection is not sufficient, you need to work with the FM Group to make changes in the ISP or whatever is needed to make the connection work better.

In case you're wondering where you can find this policy, it is not extremely easy to find. It can be found on page 2 of "Installing the Church-Managed Firewall", where you will read:

NOTE: If a Church-managed firewall or wireless network for Internet use is already in the building, contact the facility manager to share the existing service.

It is Church policy to share existing filtered Internet connections between ecclesiastical units (wards, stakes, districts, and branches) and field office units (family history centers, seminaries and institutes, facilities management offices, LDS Employment Resource Centers, etc.).

So I would reword a previous comment:

Under the direction of the stake president, units may be able to tap into the connection.

to say: "If a stake president authorizes an Internet connection in a building with an existing connection, the stake must work with the FM group to tap into that connection."

[russellhltn]

Our FM Group rep says he does not know how to access the firewall for the FHC. I need to change the Network Key since I believe too many people have access to the FHC network and are using it during meetings, etc. Who do I contact to obtain passwords? How do I change the Network Key?

The firewall itself is managed by the church. At best the STS is the local eyes and hands to assist in any troubleshooting.

However, I think the problem you're referring to is the wireless network. The original wireless network the church installed required a software package (Odyssey) to be installed in order to access it. However, the newer configuration is a straightforward WPA or WPA2 key. Since you think others are accessing it, either this is a church installed wireless system with the newer (Moroni) configuration, or it's something installed by the previous STS.

GSD can help you change the network key if it's a church installed system. If this is something installed by the previous STS, then you're on your own.

(I am assuming you are the STS. If not, then you need to contact him and work with him to make the changes.)