Radware s AppDirector. And. Microsoft Office Communications Server R2. Integration Guide

Transcription

1 Radware s AppDirector And Microsoft Office Communications Server R2 Integration Guide Products: Radware AppDirector Software: AppDirector version Platform: On-Demand Switch II Microsoft Office Communications Server R2-1 -

2 Table of Contents Joint Solution Overview...4 Microsoft Office Communications Server Overview...4 Office Communications Server Architecture... 5 Diagram Office Communications Server 2007 R2 consolidated topology... 5 Pool Components... 5 Front-End Server... 5 Diagram 2.0 Office Communications Server Conferencing Component Interrelationships... 6 Consolidated Deployment Overview... 9 Diagram Enterprise Pool: Consolidated Configuration Perimeter Network Configuration for IM and Conferencing Diagram Office Communications Server 2007 R2 external configuration Table 1.0 Office Communications Server Protocols load balanced by AppDirector Radware AppDirector Overview...14 AppDirector and Microsoft Office Communication Server Architecture...15 Diagram AppDirector and Microsoft Office Communications Server Reference Architecture Primary Front-End AppDirector Configuration...16 IP Configuration Farm Configuration Create Layer 4 Policy Extended Farms Settings Adding Servers to the Farm Enabling Client NAT Health Monitoring Create the Health Monitoring Checks Binding Health Checks to Servers General Redundant Configuration Notes...44 Primary AppDirector VRRP Configuration Primary Virtual Routers Primary Associated IP Addresses Primary Mirroring Auto-Generate the Front-End Backup AppDirector Configuration...49 Setting up basic IP connectivity on the Backup AppDirector Auto Generating the Backup Configuration from the Primary AppDirector Upload the Backup Configuration file to the device Primary DMZ AppDirector Configuration...52 IP Configuration Farm Configuration Create Layer 4 Policy Extended Farms Settings Adding Servers to the Farm Enabling Client NAT Health Monitoring Create the Health Monitoring Checks Binding Health Checks to Servers General Redundant Configuration Notes...82 Primary AppDirector VRRP Configuration Primary Virtual Routers Primary Associated IP Addresses Primary Mirroring

3 Auto-Generate the DMZ Backup AppDirector Configuration...87 Setting up basic IP connectivity on the Backup AppDirector Auto Generating the Backup Configuration from the Primary AppDirector Upload the Backup Configuration file to the device Appendix...91 Appendix 1 Primary AppDirector Front-End Configuration File Appendix 2 Backup AppDirector Front-End Configuration File Appendix 3 Primary AppDirector DMZ Configuration File Appendix 4 Backup AppDirector DMZ Configuration File Appendix 5 - Protocols Definitions Used in Office Communications Server

4 Joint Solution Overview The Radware and Microsoft Office Communications Server joint solution ensures Office Communications Server customers solution resilience, efficiency and scale. Radware s AppDirector guarantees Office Communications Server maximum availability, scalability, performance and security. Managing traffic for both the Web Service content and SIP based Unified Communication services, AppDirector provides advanced health monitoring to avoid system down time and advanced traffic management to deliver a best of breed subsystem. With a pay as you grow platform licensing model, AppDirector ensures long term investment protection facilitating incremental growth demanded by today s business. Microsoft Office Communications Server Overview Office Communications Server 2007 R2 is available in two versions, Standard Edition and Enterprise Edition. The primary difference between these two versions is whether the deployment model is single server versus multi-server. Each of these deployment models is referred to a pool. Standard Edition combines all functions, including the SQL server, onto the same server platform, whereas Enterprise edition is intended to be deployed on multiple servers, providing scalability for enterprise deployments. For the Office Communications Server 2007 R2 Enterprise Edition, Microsoft recommends the use of a hardware load balancer for Enterprise Edition deployments to distribute user traffic to the front end servers of a pool. Software load balancing products such as NLB are not recommended for use with Office Communications Server 2007 R2 for deployments larger than 500 users. Office Communications Server 2007 R2 Edge Servers are deployed in the perimeter network and provide connectivity for external users and public IM connections. Employees traveling, or working from home or in remote offices, use the Edge Servers to remotely access the service. Client access to Office Communication Server 2007 R2 is provided via Microsoft Office Communicator 2007 R2 and Live Meeting 2007 R2 client desktop software. Optionally Office Communications Server 2007 R2, Communicator Web Access is a web service where external users can access the IM and presence features of Office Communications Server 2007 R2 through any supported Web browser. For more information, see the Microsoft Office Communications Server 2007 R2 Planning Guide

5 Office Communications Server Architecture Office Communications Server 2007 R2 is a distributed server environment. Independent software modules work in conjunction to provide the features of Office Communications Server. Diagram Office Communications Server 2007 R2 consolidated topology Pool Components An Office Communications Server pool consists of one or more Front End Servers that provide IM, presence, and conferencing services and are connected to a SQL Server database for storing user and conference information. Front-End Server The principal function of the front end server is to provide the following services to end users and control the application environment. Address Book Server A/V Conferencing Server IM Conferencing Server - 5 -

6 Telephony Conferencing Server Web Conferencing Server Web Components Server Application Sharing Server for Multiparty or CWA-based Application Sharing. The Office Communications Server 2007 R2, Standard Edition or Enterprise Edition, Front End Server is responsible for the following tasks: Handling signaling among servers and between servers and clients Authenticating users and maintaining user data, including all user endpoints Routing VoIP calls within the enterprise and to the PSTN Scheduling and initializing on-premise conferences and managing conference state Aggregating enhanced presence information of users for clients Routing signaling and IM traffic Managing conferencing signaling and conference state Hosting SIP server applications Filtering SPIM (unsolicited commercial IM traffic) Diagram 2.0 Office Communications Server Conferencing Component Interrelationships - 6 -

7 These services are supported via the following software modules: Instant Messaging Conferencing Server The Instant Messaging Conferencing Server (IM MCU) is responsible for user registration into Office Communications Server 2007, instant messaging traffic, and presence state for users. A/V Conferencing Server The A/V Conferencing Server enables multiparty audio and video mixing and relaying capabilities. It is built on industry standard Real-time Transport Protocol (RTP) and Real-time Transport Control Conferencing Server the Protocol (RTCP). Telephony Conferencing Server The Telephony Conferencing Server (ACP MCU) is responsible for facilitating audio conferences hosted on a PSTN bridge provided by a telecomm provider. Web Components Server This is an Internet Information Server (IIS) service. The Web Components Server enables organizers to upload presentations and other data for use in a Web conference. Participants download this content via the Web Components Server. This IIS service also performs distribution list (DL) expansion for Office Communicator clients and distributes address book files to clients. Web Conferencing Server The Web Conferencing Server (DATA MCU) adds data collaboration functionality to Office Communications Server. The Web Conferencing Server is built on the same Persistent Shared Object Model (PSOM) technology used by the Live Meeting service. Both signaling and media are sent to and from a Web Conferencing Server using the PSOM protocol. The Web Conferencing Server supports Live Meeting features, such as Microsoft Office PowerPoint presentations, document presentations, chat, voting, white boarding, and application sharing. Application Sharing Server The Application Sharing Server is a new conferencing server role introduced in Office Communications Server 2007 R2, and is used specifically for multi-party Desktop Sharing from the Office Communicator client and Desktop Sharing from the Communicator Web Access client. The Application Sharing Server uses the RDP protocol. Though the Web Conferencing Server is also capable of Application Sharing (by using the PSOM protocol and the Live Meeting client), the Application - 7 -

8 Sharing Server provides Desktop Sharing functionality users can access directly in Office Communicator and Communicator Web Access, instead of users having to launch the Live Meeting client separately. Audio/Visual Conferencing Server The A/V Conferencing Server (AV MCU) enables users to share audio and video streams during multipoint Conferences. Focus Focus is a conference state service that manages all group IM, multiparty A/V, and data collaboration sessions on the Front End Server the service is responsible for conference setup and signaling for the duration of the conference. Focus Factory The Focus Factory is part of the Focus that is responsible for creating and destroying an instance of a conference and returning information about the conference to the client and is responsible for scheduling meetings. Conferencing Server Factory The Conferencing Server Factory is responsible for provisioning a conference for a particular media type on a conferencing server. Front End Server VoIP Components Translation Service The Translation Service is the server component that is responsible for translating a dialed number into the E.164 format or another format Inbound Routing Component The Inbound Routing component handles incoming calls largely according to preferences that are specified by users on their Enterprise Voice clients. Outbound Routing Component The Outbound Routing component routes calls to PBX or PSTN destinations. It applies call authorization rules to callers and determines the optimal media gateway for routing each call

9 Exchange UM Routing Component The Exchange UM routing component handles routing between Office Communications Server and servers running Microsoft Exchange Unified Messaging (UM), Consolidated Deployment Overview Office Communications Server 2007 R2 consolidated configuration deployments typically consists of an Enterprise pool where all server components are co-located on the pool's front end servers. All front end servers in the Enterprise pool are configured identically. The back end server running a SQL Server database resides on a separate dedicated physical server. The consolidated configuration provides scalability and high availability and is easy to plan, deploy, and manage. In the Office Communications Server 2007 R2 consolidated pool topology, the following server roles and services are collocated on the same computer as the Front End Server: Address Book Service Address Book Web Query Service Application Server Application Sharing Server A/V Conferencing Server Conference Announcement Service Conference Attendant Group Expansion Service IM Conferencing Server Outside Voice Control Response Group Service Telephony Conferencing Server Device Update Server Web Conferencing Server Enterprise pool in consolidated configuration requirements: Requires two or more front end servers deployed behind a hardware load balancer. Each of the Office Communications Server 2007 R2 components is installed onto each front-end server in the pool. A dedicated SQL Server is required to support the pool. All servers in the Enterprise pool must be deployed on the same subnet

10 Diagram Enterprise Pool: Consolidated Configuration Perimeter Network Configuration for IM and Conferencing Office Communications Server 2007 R2 allows users working outside the enterprise network to participate in on-premise conferences, complete with data collaboration and the ability to relay audio and video through your organization s firewall. Office Communications Server 2007 R2 also enhances existing support for remote access, federation, and public IM connectivity service providers: AOL, MSN, and Yahoo! The Edge Server is composed of the following services: Access Edge Service, A/V Edge Service, and Web Conferencing Edge Service. The Access Edge service validates and forwards SIP signaling traffic between internal and external users. The A/V Edge service enables audio and video conferencing, desktop sharing, and audio/video (A/V) peer-to-peer communications with external users who are equipped with a supported client. For details, see Supported Clients. The Web Conferencing Edge service enables external users to participate in conferences that are hosted by an internal Web Conferencing Server. The HTTP reverse proxy is required for downloading Address Book information, expanding membership in distribution groups, downloading Web conference content, and providing access to files for updating devices and clients

11 Diagram 4.0 shows the servers that are required in the Office Communications Server 2007 R2 perimeter network and the protocols they use to communicate with Internet clients on one side and with Enterprise Edition servers on the other. Diagram Office Communications Server 2007 R2 external configuration Required services in the Office Communications Server 2007 R2 perimeter network are as follows. Access Edge Service The Access Edge service handles all SIP traffic across the corporate firewall. The Access Edge service handles only the SIP traffic that is necessary to establish and validate connections. It does not handle data transfer, nor does it authenticate users. Authentication of inbound traffic is performed by the Director or the Front End Server. A Director is an Office Communications Server 2007 R2 Standard Edition server or Enterprise pool that does not home users and that resides inside the organization s firewall. A Director is not mandatory but is strongly recommended. If a Director is not deployed, this authentication is performed on the Front End Server on the pool or Standard Edition server that you designate to do so. (Active Directory Domain Services, or AD DS, access is required to perform

12 authentication, which the Edge Servers do not have because they are deployed in the perimeter network outside AD DS.) The Access Edge service is essential for all external user scenarios, including conferencing, remote user access, federation, and public IM connectivity Web Conferencing Edge Service The Web Conferencing Edge service proxies Persistent Shared Object Model (PSOM) traffic between the Web Conferencing Server and external clients. External conference traffic must be authorized by the Web Conferencing Edge service before it is forwarded to the Web Conferencing Server. The Web Conferencing Edge service requires that external clients use TLS connections and obtain a conference session key. A/V Edge Service The A/V Edge Service provides a single trusted connection point through which inbound and outbound media traffic (including application sharing traffic) can securely traverse network address translations (NATs) and firewalls. The industry-standard solution for multimedia traversal of firewalls is Interactive Connectivity Establishment (ICE), which is based on the Simple Traversal Underneath NAT (STUN) and Traversal Using Relay NAT (TURN) protocols. The A/V Edge service is a TURN/STUN server. All users are authenticated to secure both access to the enterprise and use of the firewall traversal service that is provided by the A/V Edge service. To send media inside the enterprise, an external user must be authenticated and must have an authenticated internal user agree to communicate with him or her through the A/V Edge service. HTTP Reverse Proxy An HTTP reverse proxy in the perimeter network carries HTTP and HTTPS traffic for external users. The HTTP reverse proxy can be used to authenticate external users using Communicator Web Access. It is also required to enable external users to download the following data: Address Book Server information Web conferencing content Expanded distribution lists Client and device updates The reverse proxy does not run Office Communications Server 2007 R2 or carry SIP traffic. The reverse proxy can run Microsoft Internet Security and Acceleration (ISA) Server 2006 or other Internet software. Communicator Web Access Communicator Web Access is the browser-based client for Office Communications Server 2007 R2. Communicator Web Access is designed with a

13 similar look and feel to the desktop version of Microsoft Office Communicator 2007 R2. External Users can access the IM and presence features in Office Communications Server 2007 R2 through any supported Web browser. Communicator Web Access Server is deployed in the internal network. Internal users can access it directly. External users access the Communicator Web Access Servers through the HTTP reverse proxy. Component (server role or client) TCP Load balancer for Front End Servers 5060/5061 Port Protocol Notes Used by Standard Edition servers and Enterprise pools for all internal SIP communications between servers and between servers and Office Communicator. MTLS Load balancer for Front End Servers 443 HTTPS Communication from Front End Servers to the Web farm FQDNs (the URLs used by Web Components). Communication between the focus (the Office Load balancer for Front End Servers 444 HTTPS Communications Server component that manages conference state) and the conferencing servers. Used when a load balancer is deployed. Port 135 is used by Load balancer for Front End Servers 135 DCOM and the Front End Servers for WMI operations and for moving RPC users (a remote DCOM-based database operation). Load balancer for Front End Servers 5065 TCP Used for incoming SIP listening requests for application sharing. Load balancer for Director Load balancer for Edge Servers Load balancer for Edge Servers Load balancer for Edge Servers Load balancer for Edge Servers Load balancer for Edge Servers Load balancer for Edge Servers Load balancer for Edge Servers Live Meeting 2007 client 5060/5061 TCP Used for internal communications between servers. 443 TCP Used for internal ports for SIP/TLS communication for remote user access, accessing internal Web conferences, and STUN/TCP inbound and outbound media communications for accessing internal media and A/V sessions TCP Used for internal ports for SIP/MTLS communication for remote user access or federation. Used for internal ports for SIP/MTLS authentication of IM 5062 TCP communications flowing outbound through the internal firewall UDP Used for internal ports for STUN/UDP inbound and outbound media communications. Used for external ports for SIP/TLS communication for remote user access, accessing internal Web conferences, 443 TCP and STUN/TCP inbound and outbound media communications for accessing internal media and A/V sessions TCP Used for external ports for SIP/MTLS communication for remote user access or federation TCP Used for external ports for STUN/UDP inbound and outbound media communications TCP Used for outgoing PSOM traffic sent to the Web Conferencing Server. Table 1.0 Office Communications Server Protocols load balanced by AppDirector

14 For more information, please visit: Radware AppDirector Overview Radware s AppDirector is an intelligent application delivery controller (ADC) that provides scalability and application-level security for service infrastructure optimization, fault tolerance and redundancy. Radware combined its next-generation, OnDemand Switch multi-gigabit hardware platform with the powerful capabilities of the company s APSolute operating system classifier and flow management engine. The result AppDirector enables accelerated application performance; local and global server availability; and application security and infrastructure scalability for fast, reliable and secure delivery of applications over IP networks. AppDirector is powered by the innovative OnDemand Switch platform. OnDemand Switch, which has established a new price/performance standard in the industry, delivers breakthrough performance and superior scalability to meet evolving network and business requirements. Based on its on demand, pay-as-you-grow approach, no forklift upgrade is required even when new business requirements arise. This helps companies guarantee short-term and long-term savings on CAPEX and OPEX for full investment protection. Radware s OnDemand Switch enables customers to pay for the exact capacity currently required, while allowing them to scale their ADC throughput capacity and add advanced application-aware services or application acceleration services on demand to meet new or changing application and infrastructure needs. And it does it without compromising on performance. AppDirector lets you get the most out of your service investments by maximizing the utilization of service infrastructure resources and enabling seamless consolidation and high scalability. AppDirector s throughput licensing options allows pay as you grow investment protection. Make your network adaptive and more responsive to your dynamic services and business needs with AppDirector s fully integrated traffic classification and flow management, health monitoring and failure bypassing, traffic redirection, bandwidth management, intrusion prevention and DoS protection. For more information, please visit:

15 AppDirector and Microsoft Office Communication Server Architecture Diagram AppDirector and Microsoft Office Communications Server Reference Architecture Note: There is two pair of AppDirectors configured for this deployment. A pair of AppDirectors configured in the DMZ for the Edge Servers and a pair of AppDirectors configured in the LAN for the Front-End Servers. Note: DNS SRV records for the appropriate domain are used to locate the OCS servers for client connectivity. DNS administration is required to bind an A record for the OCS FQDN, where the FQDN resolves the appropriate AppDirector Virtual IP Address (VIP). AppDirector has the ability to become the Authoritative responder for this FQDN, normally used in Disaster Recovery designs; in this case the DNS would use a name server record pointing to the AppDirector for the authoritative response. AppDirector would base the response on the availability, load and proximity information it uses to drive intelligent load distribution

16 Primary Front-End AppDirector Configuration Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None 1. Using the following Command line, assign management IP address / 16 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware. Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. IP Configuration 1. From the menu, select Router IP Router Interface Parameters to display the IP Interface Parameters page. 2. Click the Create button

17 3. On the IP Interface Parameters Create page, enter the necessary parameters as shown below: 1 This will create the interfaces needed for the Office Communications Server ecosystem. 4. Click the Set button to save parameters. 5. Repeat the steps 2 4 to create the next IP Interface, whose information is defined as follows: IP Address , Network Mask , If Number G-1, Peer Address Verify that the new entries were created on the IP Interface Parameters page: 1 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings

18 Farm Configuration 1. From the menu, select AppDirector Farms Farm Table to display the Farm Table page similar to the one shown below: 2. Click the Create button. 3. On the Farm Table Create page, enter the necessary parameters as shown below: 2 2 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings

19 Note: Farm Aging time tuned to 20 minutes from default value. This will ensure that state entries will not be terminated prior to client aging time. 4. Click the Set button to save parameters. 5. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 6. Click the Set button to save parameters. 7. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below:

20 8. Click the Set button to save parameters. 9. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 10. Click the Set button to save parameters. 11. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below:

21 12. Click the Set button to save parameters. 13. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 14. Click the Set button to save parameters. 15. Verify that the new entries are created on the Farm Table page:

22 Create Layer 4 Policy 1. From the menu, select AppDirector Layer 4 Traffic Redirection Layer 4 Policies to display the L4 Policies page similar to the one shown below: 2. Click the Create button. 3. On the L4 Policies Create page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. 5. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

23 6. Click the Set button to save the parameters. 7. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 8. Click the Set button to save the parameters

24 9. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 10. Click the Set button to save the parameters. 11. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

25 12. Click the Set button to save the parameters. 13. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 14. Click the Set button to save the parameters. 15. Verify that the new entry was created on the L4 Policies page: Extended Farms Settings 1. Click the Extended Farm Parameters URI at the top of the Farm Table page. 2. On the Extended Farm Parameters Table page, click on the Farm Name ocs.frontend.sip.5060.farm

26 3. On the Extended Farm Parameters Update page, Select the parameters as shown below: Note: The Client Nat Address Range gets set by the Client NAT Quick Setup; no action is required at the Extended Farm Update page. It is circled here because Client NAT Address Range is not set by default. Note: Close Session At Aging will reset the sessions if they still exist after the aging period. This will ensure any clean-up of abandoned sessions which could hold state on the servers inadvertently. 4. Click the Set button to save parameters. 5. Repeat the steps 2-4 for extended farms: ocs.frontend.sip.5060.farm, ocs.frontend.https.conf.444.farm, ocs.frontend.https.443.farm, ocs.frontend.mtls.5061.farm and ocs.frontend.dcom.135.farm to verify Client NAT Address Range and enable Close Session at Aging. For extended farm ocs.frontend.sip.app.sharing.5065.farm enable Close Session at Aging. Adding Servers to the Farm 1. From the menu, select AppDirector Servers Application Servers to display the Server Table page similar to the one shown below:

27 2. On the Server Table Create page, enter the necessary parameters as shown below: Note: The Client NAT field is enabled by the Client NAT Quick Setup; no action is required at the Server Table Create page. 3. Click the Set button to save parameters

28 4. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 5. Click the Set button to save parameters. 6. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 7. Click the Set button to save parameters. 8. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

29 9. Click the Set button to save parameters. 10. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 11. Click the Set button to save parameters. 12. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

30 13. Click the Set button to save parameters. 14. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 15. Click the Set button to save parameters. 16. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

31 17. Click the Set button to save parameters. 18. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 19. Click the Set button to save parameters. 20. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

32 21. Click the Set button to save parameters. 22. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 23. Click the Set button to save parameters. 24. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

33 25. Click the Set button to save parameters. 26. Verify that the new entries were created on the Server Table page: Enabling Client NAT 1. From the menu, select AppDirector NAT Client NAT Client NAT Quick Setup to display the Client NAT Quick Setup page similar to the one shown

34 2. On the Client NAT Quick Setup page, enter the necessary parameters as shown below: 3. Click the Set button to save parameters. 4. From the menu, select AppDirector NAT Client NAT Intercept Addresses to display the Client NAT Intercept Table page similar to the one shown. 5. Click the Create button. 6. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below

35 7. Click the Set button to save parameters. 8. Create the next intercept range. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below: 9. Click the Set button to save parameters. 10. Create the next intercept range. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below: 11. Click the Set button to save parameters. 12. Create the next intercept range. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below: 13. Click the Set button to save parameters. 14. Verify the Intercept Addresses were created on the Client NAT Intercept Table page

36 Health Monitoring 1. From the menu, select Health Monitoring Global Parameters to display the Health Monitoring Global Parameters page. 2. On the Health Monitoring Global Parameters page, change the parameters as shown below: 3. Click the Set button to save parameters. Create the Health Monitoring Checks. 1. From the menu, select Health Monitoring Check Table to display the Health Monitoring Check Table page similar to the one shown below:

37 2. Click the Create button. 3. Create a set of health checks for the web servers. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 4. Click the Set button to save parameters. 5. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

38 6. Click the Set button to save parameters. 7. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 8. Click the Set button to save parameters. 9. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

39 10. Click the Set button to save parameters. 11. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 12. Click the Set button to save parameters. 13. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

40 14. Click the Set button to save parameters. 15. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 16. Click the Set button to save parameters. 17. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

41 18. Click the Set button to save parameters. 19. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 20. Click the Set button to save parameters. 21. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

42 22. Click the Set button to save parameters. 23. Verify the new entries were created on the Health Monitoring Check Table Note: The status of this check may display Unknown until the server replies successfully to the AppDirector s check

43 Binding Health Checks to Servers 1. From the menu, select Health Monitoring Binding Table to display the Health Monitoring Binding Table page similar to the one shown below: 2. Click the Create button. 3. Create the health check binding for the web servers. On the Health Monitoring Binding Table Create page, enter the necessary parameters as shown below: 4. Click the Set button to save parameters. 5. Repeat the steps 2-5 to bind the rest of the server health checks. See the table below. Check Server/NHR/Report Mandatory ocs.sip.av.tcp.5063.server.1 Farm ocs.frontend.sip.5060.farm Mandatory ocs.sip.av.tcp.5063.server.2 Farm ocs.frontend.sip.5060.farm Mandatory ocs.https.conf.tcp.444.server.1 Farm ocs.frontend.https.conf.444.farm Mandatory ocs.https.conf.tcp.444.server.2 Farm ocs.frontend.https.conf.444.farm Mandatory ocs.https.web.tcp.443.server.1 Farm ocs.frontend.https.443.farm Mandatory ocs.https.web.tcp.443.server.2 Farm ocs.frontend.https.443.farm Mandatory ocs.mtls.tcp.5061.server.1 Farm ocs.frontend.mtls.5061.farm Mandatory ocs.mtls.tcp.5061.server.2 Farm ocs.frontend.mtls.5061.farm Mandatory ocs.sip.app.sharing.tcp.5065.server.1 Farm ocs.frontend.sip.app.sharing.5065.farm Mandatory ocs.sip.app.sharing.tcp.5065.server.2 Farm ocs.frontend.sip.app.sharing.5065.farm Mandatory

44 6. Verify that the new entries were created on the Health Monitoring Binding Table page: This completes the Primary AppDirector policy configuration. General Redundant Configuration Notes For complete high-availability, Radware encourages implementing pairs of AppDirector units in an Active / Backup configuration. If your implementation of this architecture includes only a single AppDirector, then it is unnecessary to follow the steps in this section

45 Primary AppDirector VRRP Configuration 1. From the menu, select AppDirector Redundancy Global Configuration and set the parameters as noted below: 2. Click the Set button to save these changes. Primary Virtual Routers 1. From the menu, select AppDirector Redundancy VRRP Virtual Routers to display the Virtual Router Table page similar to the one shown below

46 2. Click the Create button 3. On the Virtual Router Table page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. 5. Verify that the new entries were created on the Virtual Router Table page: Primary Associated IP Addresses 1. From the menu, select AppDirector Redundancy VRRP Associated IP Addresses to display the Associated IP Addresses Create page similar to the one shown below: 2. Click the Create button

47 3. On the Associated IP Addresses Create page, enter the necessary parameters as shown below: 4. Click the Set button to save the parameters 5. Repeat the steps 2-4 to create the associated IP Addresses for the Layer 4 policy virtual IP address and client NAT address. These definitions will ensure proper ARP management by the backup device during failures. Note: Additional IP addresses are defined as follows: All the EBS Front End Layer 4 policy VIP s reference this single IP and run on different ports Client NAT address used to ensure symmetric routing in a one armed design. 6. Verify that the new entries are created on the Associated IP Addresses page: 7. Go to AppDirector Redundancy VRRP Virtual Routers and on the Virtual Router Table under VRID s Up/Down select All Up and click on the Set button to enable all Virtual Routers. 8. Make certain that the State of this VR is displayed as Master in the Virtual Router table

48 Primary Mirroring 1. Go to AppDirector Redundancy Mirroring Active Device Parameters and set the Client Table Mirroring status to enable: 2. Click the Set button to save the parameters. 3. From the menu, select AppDirector Redundancy Mirroring Mirror Device Parameters to display the Mirror Device Parameters page similar to the one shown below 4. Click the Create button

49 5. On the Mirror Device Parameters page, enter the necessary parameters as shown below: Note: This sets the Backup AD target address used for mirror traffic. 6. Click the Set button to save the parameters. This completes VRRP redundancy configuration on the Primary AppDirector. Auto-Generate the Front-End Backup AppDirector Configuration Once the Backup AppDirector is configured for basic IP connectivity and is available to the network, simply export the Backup Configuration file from the Primary AppDirector and upload it to the Backup AppDirector. The steps are defined below. Setting up basic IP connectivity on the Backup AppDirector Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None 1. Using the following Command line, assign management IP address / 16 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware

50 Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. Auto Generating the Backup Configuration from the Primary AppDirector 1. From the web interface menu of the Primary AppDirector, select File Configuration Receive from Device to display the Download Configuration File page similar to the one shown below: 2. On the Configuration File Download page, choose the necessary parameters as shown below:

51 3. Click the Set button to launch save file window. 4. Click the SAVE button to save the file to a local directory. Upload the Backup Configuration file to the device 1. From the web interface menu of the Backup AppDirector, select File Configuration Send to Device to display the Configuration File Upload page similar to the one shown below:

52 Note: Clicking the Browse button and navigate to the updated configuration file. 2. Click the Set button to upload the configuration. This completes redundancy configuration on the Backup AppDirector. Primary DMZ AppDirector Configuration Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None 1. Using the following Command line, assign management IP address / 16 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware. Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector

53 If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. IP Configuration 1. From the menu, select Router IP Router Interface Parameters to display the IP Interface Parameters page. 2. Click the Create button. 3. On the IP Interface Parameters Create page, enter the necessary parameters as shown below: 3 This will create the interfaces needed for the Office Communications Server ecosystem. 3 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings

54 4. Click the Set button to save parameters. 5. Repeat the steps 2 4 to create the next IP Interface, whose information is defined as follows: IP Address , Network Mask , If Number G-1, Peer Address Verify that the new entries were created on the IP Interface Parameters page:

55 Farm Configuration 1. From the menu, select AppDirector Farms Farm Table to display the Farm Table page similar to the one shown below: 2. Click the Create button. 3. On the Farm Table Create page, enter the necessary parameters as shown below: 4 Note: Farm Aging time tuned to 20 minutes from default value. This will ensure that state entries will not be terminated prior to client aging time. 4. Click the Set button to save parameters. 5. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 4 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings

56 6. Click the Set button to save parameters. 7. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 8. Click the Set button to save parameters. 9. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below:

57 10. Click the Set button to save parameters. 11. On Farm Table page Click the Create button to configure another Farm. Enter the necessary parameters as shown below: 12. Click the Set button to save parameters. 13. Verify that the new entries are created on the Farm Table page:

58 Create Layer 4 Policy 1. From the menu, select AppDirector Layer Traffic Redirection Layer 4 Policies to display the L4 Policies page similar to the one shown below: 2. Click the Create button. 3. On the L4 Policies Create page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. 5. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

59 6. Click the Set button to save the parameters. 7. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

60 8. Click the Set button to save the parameters. 9. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 10. Click the Set button to save the parameters. 11. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

61 12. Click the Set button to save the parameters. 13. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

62 14. Click the Set button to save the parameters. 15. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 16. Click the Set button to save the parameters. 17. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

63 18. Click the Set button to save the parameters. 19. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below:

64 20. Click the Set button to save the parameters. 21. On L4 Policies page Click the Create button to configure another Layer 4 Policy. Enter the necessary parameters as shown below: 22. Click the Set button to save the parameters. 23. Verify that the new entry was created on the L4 Policies page: Extended Farms Settings 1. Click the Extended Farm Parameters URI at the top of the Farm Table page

65 2. On the Extended Farm Parameters Table page, click on the Farm Name ocs.edge.https.sip.443.farm. 3. On the Extended Farm Parameters Update page, Select the parameters as shown below: Note: The Client Nat Address Range gets set by the Client NAT Quick Setup; no action is required at the Extended Farm Update page. It is circled here because Client NAT Address Range is not set by default. Note: Close Session At Aging will reset the sessions if they still exist after the aging period. This will ensure any clean-up of abandoned sessions which could hold state on the servers inadvertently. 4. Click the Set button to save parameters. 5. Repeat the steps 2-4 for extended farms: ocs.edge.lm.443.farm, ocs.edge.meeting.443.farm and ocs.edge.av.443.farm to verify Client NAT Address Range and enable Close Session at Aging. For extended farm ocs.edge.internal.443.farm only enable Close Session at Aging. Adding Servers to the Farm 1. From the menu, select AppDirector Servers Application Servers to display the Server Table page similar to the one shown below:

66 2. On the Server Table Create page, enter the necessary parameters as shown below: Note: The Client NAT field is enabled by the Client NAT Quick Setup; no action is required at the Server Table Create page. 3. Click the Set button to save parameters. 4. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

67 5. Click the Set button to save parameters. 6. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 7. Click the Set button to save parameters. 8. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

68 9. Click the Set button to save parameters. 10. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 11. Click the Set button to save parameters. 12. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

69 13. Click the Set button to save parameters. 14. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 15. Click the Set button to save parameters. 16. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below:

70 17. Click the Set button to save parameters. 18. On Server Table Create page Click the Create button to configure another Server. Enter the necessary parameters as shown below: 19. Click the Set button to save parameters. 20. Verify that the new entries were created on the Server Table page:

71 Enabling Client NAT 1. From the menu, select AppDirector NAT Client NAT Client NAT Quick Setup to display the Client NAT Quick Setup page similar to the one shown. 2. On the Client NAT Quick Setup page, enter the necessary parameters as shown below: 3. Click the Set button to save parameters

72 4. From the menu, select AppDirector NAT Client NAT Intercept Address to display the Client NAT Intercept Table page similar to the one shown. 5. Click the Create button. 6. Create the intercept range. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below: 7. Click the Set button to save parameters. 8. Create a second intercept range. On the Client NAT Intercept Table Create page, enter the necessary parameters as shown below: 9. Click the Set button to save parameters. 10. Verify the Intercept Address Verify was created on the Client NAT Intercept Table page

73 Note: the intercept IP s should reference all client IP s that are trying to access the Edge servers, only 2 IP s were configured to test with the lab clients. You can open up the range to include all IP s (see below). Health Monitoring 1. From the menu, select Health Monitoring Global Parameters to display the Health Monitoring Global Parameters page. 2. On the Health Monitoring Global Parameters page, change the parameters as shown below: 3. Click the Set button to save parameters

74 Create the Health Monitoring Checks. 1. From the menu, select Health Monitoring Check Table to display the Health Monitoring Check Table page similar to the one shown below: 2. Click the Create button. 3. Create a set of health checks for the web servers. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 4. Click the Set button to save parameters. 5. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

75 6. Click the Set button to save parameters. 7. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 8. Click the Set button to save parameters. 9. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

76 10. Click the Set button to save parameters. 11. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 12. Click the Set button to save parameters. 13. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

77 14. Click the Set button to save parameters. 15. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below: 16. Click the Set button to save parameters. 17. Create the next health check. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

78 18. Click the Set button to save parameters 19. Verify the new entries were created on the Health Monitoring Check Table Note: The status of this check may display Unknown until the server replies successfully to the AppDirector s check. Binding Health Checks to Servers 1. From the menu, select Health Monitoring Binding Table to display the Health Monitoring Binding Table page similar to the one shown below:

79 2. Click the Create button. 3. Create the health check binding for the web servers. On the Health Monitoring Binding Table Create page, enter the necessary parameters as shown below: Note: only the ocs.edge.https.internal.tcp.443.server.1 and ocs.edge.https.internal.tcp.443.server.2 checks are using Non-Mandatory the rest uses mandatory. 4. Click the Set button to save parameters. 5. Repeat the steps 2-5 to bind the rest of the server health checks. See the table below. Check Server/NHR/Report Mandatory ocs.edge.https.internal.tcp.443.server.1 Farm ocs.edge.lm.443.farm Non - mandatory ocs.edge.https.internal.tcp.443.server.2 Farm ocs.edge.lm.443.farm Non - mandatory ocs.edge.https.meeting.tcp.443.server.1 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.meeting.tcp.443.server.1 Farm ocs.edge.meeting.443.farm Mandatory ocs.edge.https.meeting.tcp.443.server.1 Farm ocs.edge.av.443.farm Mandatory ocs.edge.https.meeting.tcp.443.server.2 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.meeting.tcp.443.server.2 Farm ocs.edge.meeting.443.farm Mandatory ocs.edge.https.meeting.tcp.443.server.2 Farm ocs.edge.av.443.farm Mandatory ocs.edge.https.sip.tcp.443.server.1 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.sip.tcp.443.server.1 Farm ocs.edge.meeting.443.farm Mandatory ocs.edge.https.sip.tcp.443.server.1 Farm ocs.edge.av.443.farm Mandatory ocs.edge.https.sip.tcp.443.server.2 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.sip.tcp.443.server.2 Farm ocs.edge.meeting.443.farm Mandatory

80 ocs.edge.https.sip.tcp.443.server.2 Farm ocs.edge.av.443.farm Mandatory ocs.edge.https.av.tcp.443.server.1 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.av.tcp.443.server.1 Farm ocs.edge.meeting.443.farm Mandatory ocs.edge.https.av.tcp.443.server.1 Farm ocs.edge.av.443.farm Mandatory ocs.edge.https.av.tcp.443.server.2 Farm ocs.edge.https.sip.443.farm Mandatory ocs.edge.https.av.tcp.443.server.2 Farm ocs.edge.meeting.443.farm Mandatory ocs.edge.https.av.tcp.443.server.2 Farm ocs.edge.av.443.farm Mandatory 6. Verify that the new entries were created on the Health Monitoring Binding Table page:

81 This completes the Primary AppDirector policy configuration

82 General Redundant Configuration Notes For complete high-availability, Radware encourages implementing pairs of AppDirector units in an Active / Backup configuration. If your implementation of this architecture includes only a single AppDirector, then it is unnecessary to follow the steps in this section. Primary AppDirector VRRP Configuration 1. From the menu, select AppDirector Redundancy Global Configuration and set the parameters as noted below: 2. Click the Set button to save these changes. Primary Virtual Routers 1. From the menu, select AppDirector Redundancy VRRP Virtual Routers to display the Virtual Router Table page similar to the one shown below

83 2. Click the Create button 3. On the Virtual Router Table page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. 5. On the Virtual Router Table page click the Create button to create a new Virtual Router, enter the necessary parameters as shown below

84 6. Click the Set button to save the parameters. 7. Verify that the new entries were created on the Virtual Router Table page: Primary Associated IP Addresses 1. From the menu, select AppDirector Redundancy VRRP Associated IP Addresses to display the Associated IP Addresses Create page similar to the one shown below: 2. Click the Create button 3. On the Associated IP Addresses Create page, enter the necessary parameters as shown below: 4. Click the Set button to save the parameters 5. Repeat the steps 2-4 to create the associated IP Addresses for the Layer 4 policy virtual IP address and client NAT address. These definitions will ensure proper ARP management by the backup device during failures

85 Note: Additional IP addresses are defined as follows: OCS Internal VIP s OCS Edge STUN VIP OCS Edge Meeting VIP OCS Edge Lm VIP Client NAT address used to ensure symmetric routing in a one armed design. 6. Verify that the new entries are created on the Associated IP Addresses page: 7. Go to AppDirector Redundancy VRRP Virtual Routers and on the Virtual Router Table under VRID s Up/Down select All Up and click on the Set button to enable all Virtual Routers. 8. Make certain that the State of this VR is displayed as Master in the Virtual Router table

86 Primary Mirroring 1. Go to AppDirector Redundancy Mirroring Active Device Parameters and set the Client Table Mirroring status to enable: 2. Click the Set button to save the parameters. 3. From the menu, select AppDirector Redundancy Mirroring Mirror Device Parameters to display the Mirror Device Parameters page similar to the one shown below. 4. Click the Create button

87 5. On the Mirror Device Parameters page, enter the necessary parameters as shown below: Note: This sets the Backup AD target address used for mirror traffic. 6. Click the Set button to save the parameters. This completes VRRP redundancy configuration on the Primary AppDirector. Auto-Generate the DMZ Backup AppDirector Configuration Once the Backup AppDirector is configured for basic IP connectivity and is available to the network, simply export the Backup Configuration file from the Primary AppDirector and upload it to the Backup AppDirector. The steps are defined below. Setting up basic IP connectivity on the Backup AppDirector Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None 1. Using the following Command line, assign management IP address / 16 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware