; Lync 2013 Planning Tool

Transcription

1 Dean Suzuki Blog Title: Building a Lync 2013 Edge Pool Created: 3/3/2013 Description: One of my teammates was asking how to build the Lync Edge infrastructure. In this post, we ll walkthrough the build of a Lync 2013 Edge Server. The Edge Server provides the following capabilities: External access from the Internet to the Lync capabilities for your users. Federation with other companies running Office Communications Server or Lync so that you can do Lync capabilities with other companies running these technologies. Federation with users on public IM clouds (e.g. AOL). Federation with users on XMPP clouds (e.g. GoogleTalk). Access to web conferences from external users. Lync provides web conferencing and allows participants to join who aren t even on Lync. They can join via a new Lync web access (LWA) client. Below is a diagram of a typical Lync environment with Lync Edge servers. References: ; Lync 2013 Planning Tool ; Deploying External User Access ; Lync 2013 Planning Documentation 1

2 ; Deploying Lync Server ; Preparing the Infrastructure and Systems ; Server and Tools Operating System Support ; Managing Lync Server 2013 Disaster Recovery, High Availability, and Backup Service ; Planning for Central Site Voice Resiliency Disclaimer: Contents of this blog and article represent the opinions of Dean Suzuki, and do not reflect the views of my employer. (C) 2012 Dean Suzuki, All Rights Reserved Procedure: Table of Contents 1 Planning Your Edge Architecture with the Lync Planning Tool Build a VM for the Lync Edge server: Name the Server and Set DNS Suffix Setup Networking Configure the Internal NIC Host File Or DNS Creating Static Routes From Edge Server to Internal Configure the External NIC Load Pre-requisites Run Topology Builder Take the Configuration to the Edge Server Run Setup on Lync Edge Server Creating Certificates on Edge Server Download the Internal Certificate Chain from the Internal Certificate Authority Request Internal Certificate Request the External Certificate

3 1 Planning Your Edge Architecture with the Lync Planning Tool Microsoft has released a tool called the Lync Planning tool. In an earlier post, I describe how to get and install the tool. I would highly recommend working through the tool and planning out the Lync Edge architecture based upon your requirements. The Lync Edge architecture has many moving parts: Lots of IP addresses, VLANs, and networking Lots of DNS records Lots of certificates Lots of ports to open and secure The Planning tool helps you understand what you need and simplifies the complexity. Below is a sample picture of a Lync edge architecture: mes Note that there are 4 different subnets in the above picture Internet ( x) External leg of Edge server ( x) Internal leg of Edge server ( x) Internal network ( x) This is the standard best practice layout. Note that you can double-click the IP addresses used by the tool and enter your network subnets. You can also change the DNS FQDN hostnames to match your design. In addition, the tool outputs the DNS records, certificates, and firewall ports that need to be configured. Go to the Edge Admin Report Note that there are tabs covering certificates, firewall, and DNS records. 3

4 2 Build a VM for the Lync Edge server: Create a new virtual machine for Lync 2013 Edge Server. See the earlier posts for building a base Windows 2012 VM. Copy it and make a virtual machine for Lync Lync 2013 supports Windows For a list of the supported operating systems for Lync 2013 are listed here: 3 Name the Server and Set DNS Suffix Set the hostname of the server. The Edge server should not be joined to the internal AD forest. Some customers may have a DMZ AD forest. If you don t have a DMZ AD forest, then the edge server should stay in a workgroup. 4

5 Deploy edge server in a workgroup Need to set the DNS suffix of the edge server. This is normally set when you join the machine to a domain but this machine won t be joined to the domain. The topology builder uses the FQDN of the edge server so this FQDN must match the DNS suffix that you are setting here. 4 Setup Networking Edge server needs at least 2 physical NICs. 5

6 Rename the NIC s so that its easy to identify the internal and external NIC 4.1 Configure the Internal NIC Set the IP address Note: the internal NIC doesn t have a default gateway set. 4.2 Host File Or DNS In my diagram, I am able to connect to my internal DNS servers. Some organizations don t allow DMZ resources to connect to internal DNS servers. If that is the case in your organization, then you will need to leave the DNS servers field empty and create a HOST file on the edge server. In the Host file, you will need to create DNS A records for each of the front end servers. If you are using DNS load balancing for the internal front end pool, need to include a DNS A record for each member of the front end pool. Between the edge server and the internal network on the internal firewall, we recommend a route configuration (not a NAT configuration). Between the Internet and edge server on the Internet facing firewall, we support NAT ing. 4.3 Creating Static Routes From Edge Server to Internal 6

7 To get communication from the Edge server back to the Internal front-end pool and UM servers, you need to setup static routes on the Edge server since the edge server is not aware of the route to these servers. Need to setup static routes to the internal networks that contains Lync 2013 servers and Unified Messaging servers. Open a command prompt: Use Route print to see the routes To set a static route, use the route command In this above command, I am adding a route to network (which is my internal network, inside the firewall). The is the external IP address of my internal firewall that protects my internal network. The p is important to make the route persistent so that it will continue to exist even after you reboot the server. If you don t do this p, then you will lose this route once you reboot the server and will be wondering why the edge server can t communicate with your internal hosts. 7

8 4.4 Configure the External NIC The external NIC needs to support 3 IP addresses for: access, web conferencing, and av conferencing. These could be on the same NIC or you could use 3 separate NICs. The Internal and External NICs should be on different VLANs. Although in my lab, I don t have two separate VLANs. In a production environment, you should setup the internal and external NICs on separate VLANs for security. For the default gateway in most cases, it will be the IP address of the internal leg of the Internet/external firewall. For DNS servers, it depends if you have connections to your internal DNS servers. In most companies, they would restrict access from the DMZ to their internal DNS servers so the DNS servers would need to be external DNS servers. 8

9 5 Load Pre-requisites The Edge server needs some pre-requisites on the server. Run Server Manager. 9

10 Need to load the Windows Identity Foundation

11 6 Run Topology Builder Create a new Edge Pool. 11

12 Need to define a FQDN for the Edge pool of servers if you have multiple edge servers. Create a DNS A record for the Edge pool FQDN. I 12

13 I made mistake on this screen and entered IP addresses versus FQDN. I had to go back and change. This screen asks for fqdn s not ip addresses. The following is the screen in topology builder that I fixed later. The next step is to add the Edge servers to the Edge Pool. This internal FQDN must correspond to the hostname and DNS suffix that we set earlier on the edge server. Need to create a DNS A record in your internal DNS for this internal FQDN as well. This internal IPv4 address is the IP address that we set on the internal NIC. 13

14 These three external IPv4 address are the three IP addresses that we set on the external NIC. This is the public IP address that we ll use for the AV edge. Each of the 3 external private IP addresses that we set earlier will have 3 public IP addresses. The topology builder needs to know the public IP address that will correspond to the AV conferencing connection. Note; av edge service NAT is not supported by HW load balancing. If you want to NAT the AV edge service, then you need to use DNS load balancing. 14

15 This is the edge server in the pool The next hop should be set to the front-end pool. 15

16 7 Take the Configuration to the Edge Server After you publish the configuration in topology builder, you need to export the configuration to a zip file and copy it to the edge server. Since the edge server is not domain joined when you run setup on it, it can t contact the central management store initially. So for the initial load, it will get its configuration from the zip file. After it is configured, it can talk to the CMS to get updates from it. Export the config Copy it to the edge server 16

17 8 Run Setup on Lync Edge Server Select Install or Update Lyc Server System Select Install Local Configuration Store and press Run. 17

18 Specify the file copied earlier. Select Setup or Remote Lync Server Components and press Run. 18

19 9 Creating Certificates on Edge Server For external interface, Use Public certificate so that everyone trusts it. Certificate must be exportable. Need to export it from edge and import it across all edge servers so that the private key is the same across all the edge servers. The AV conferencing service needs this requirement. Certificate Subject Name = Access Edge FQDN (access2013.irvlab.mtcdemos.net) or if HW load balancing is used, HW LB VIP FQDN (e.g. access.contoso.com) Certificate Subject Alternative Name = contains o Access Edge FQDN (access2013.irvlab.mtcdemos.net) or if HW load balancing is used, HW LB VIP FQDN (e.g. access.contoso.com). Although this address is in the subject name, this address is also needed in the SAN since TLS uses the SAN versus the Subject Name. o SIP domain FQDN s (e.g. sip.irvlab.mtcdemos.net) o Web conferencing edge FQDN (webcon2013.irvlab.mtcdemos.net) 19

20 For the internal interface, use Can use public certificate or one that is generated on a private Certificate Authority. Certificate Subject Name = Internal Edge FQDN or HW LB VIP FQDN. Can also use a wildcard certificate on the Edge internal. Certificate Subject Alternative Name = None needed 20

21 21

22 Make sure to mark the private key as exportable since you will need to export it out of the first Edge server and import it onto all the other Edge servers. 22

23 Notice that the wizard is using the Edge pool FQDN (instead of the specific server FQDN, edge2013.irvlab.mtcdemos.net). I can t even change this value in the wizard. 23

24 10 Download the Internal Certificate Chain from the Internal Certificate Authority If you are using an internal CA, download its Certificate Chain to the Edge server. Download the certificate chain In certificates snap-in. Import the certificate chain. 24

25 Select Download a CA Certificate. After downloading the certificate chain, import it into Certificates snap-in. 25

26 11 Request Internal Certificate 26

27 Import certificate 27

28 Needed to import through Certificates snap-in. The Lync import tool didn t work. 28

29 Select Assign 29

30 12 Request the External Certificate Select Request 30

31 31

32 Again, remember to mark the private key as exportable. The private key on the edge external leg needs to be the same across all the Edge servers for the AV conferencing service. 32

33 I added the FQDN of the other edge servers that will be deployed. 33

34 34

35 Import the certificate from Lync Deployment Wizard. 35

36 Import from the Lync Wizard failed. Although the wizard said it was successful, I looked at the Certificates snap-in and didn t see it. So, I used the Certificates snap-in to import the certificate. 36

37 37

38 After importing, need to assign the certificate to Lync. Press Assign 38

39 39

40 Check Lync Services Check Windows Updates 40