Avoid Microsoft Lync Deployment Pitfalls with A10 Thunder ADC

WHITE PAPER Avoid Microsoft Lync Deployment Pitfalls with A10 Thunder ADC

Table of Contents Introduction...3 Executive Summary...3 High Availability...3 Advanced Load Balancing...4 Global Server Load Balancing...4 Health Checks...4 Acceleration...5 SSL Offload...5 TCP Connection Reuse...6 HTTP Compression...6 RAM Caching...6 Security...6 DDoS Protection...6 Reverse Proxy...6 Additional Features for Optimizing Lync...7 Application Delivery Partitioning to Reduce Data Center Footprint...7 aflex Custom Scripting...8 Conclusion...9 About the Thunder Series...9 About A10 Networks...9 Disclaimer This document does not create any express or implied warranty about A10 Networks or about its products or services, including but not limited to fitness for a particular use and noninfringement. A10 Networks has made reasonable efforts to verify that the information contained herein is accurate, but A10 Networks assumes no responsibility for its use. All information is provided as-is. The product specifications and features described in this publication are based on the latest information available; however, specifications are subject to change without notice, and certain features may not be available upon initial product release. Contact A10 Networks for current information regarding its products or services. A10 Networks products and services are subject to A10 Networks standard terms and conditions. 2

Introduction Organizations around the world depend on Microsoft Lync to connect, collaborate, and share information in real time. Microsoft Lync combines instant messaging, Voice over IP (VoIP), video conferencing, and other real-time data sharing capabilities together to deliver a rich, enterprise-ready unified communications platform. Microsoft Lync 2013, launched in October 2012, introduces important new features for chat and mobility, but it also dramatically increases demands on the network. For IT staff, Lync deployments impose unique challenges. To avoid Lync deployment pitfalls, IT managers must ensure Lync servers are highly available and traffic loads are properly distributed to Lync servers. Additionally call quality for Voice over IP (VoIP) is critical; to reduce VoIP jitter, networking equipment must support high performance and low latency. If Lync customers deploy multiple Lync servers or a pool, they need to distribute traffic loads to those servers. Load balancing is not just a best practice, it s a requirement. Microsoft advises customers to provision either hardware load balancing or DNS load balancing. If load balancing is required, IT managers can deploy Thunder Series application delivery controllers (ADCs) from A10 Networks to ensure world-class performance, applications availability, and resiliency for Microsoft Lync. Thunder ADC, available as a high-performance hardware appliance or a flexible virtual appliance, improves the availability of Lync applications, offloads tasks like SSL encryption for Lync servers. Also, Thunder ADC reduces capital investment through advanced virtualization for hardware consolidation. Security threats challenge enterprise networks at every level, and Lync applications are not immune. Distributed denial-of-service (DDoS) attacks are a particular danger for Lync installments. Thunder ADC acts as a reverse proxy between clients and Lync front-end servers, ensuring that all connections to servers are initiated from Thunder ADC. In this process, Thunder ADC eliminates potentially crippling DDoS attacks and other network-level threats. Executive Summary A10 Networks Thunder ADC enhances Microsoft Lync applications by delivering a suite of powerful optimization features that improve scalability, performance, availability, and security. Thunder ADC helps organizations avoid deployment pitfalls by: Maximizing application uptime with advanced load balancing capabilities and server health checks Increasing security at the network and application layer (Layer 7), ensuring business continuity and safeguarding private and confidential information Consolidating multiple load balancing devices on a single device with application delivery partitions (ADPs) featuring Layer 3 Virtualization (L3V) to reduce hardware and operations expenses Optimizing Lync performance; improving call quality by reducing latency to eliminate VoIP jitter, leading to a better user experience and increased workplace productivity for enterprises While the Thunder Series offers literally hundreds of valuable features for the purpose of optimizing Microsoft Lync deployments, this document will focus on a set of key features in the categories of: High availability Acceleration Security High Availability Enterprises require high availability to enable their Lync servers to scale seamlessly, maintaining a positive end-user experience and keeping employee productivity consistent and strong. To ensure high availability for Lync servers and end user applications, the Thunder Series offers the following capabilities: Advanced server load balancing (SLB) Global Server Load Balancing (GSLB) Health checks 3

Advanced Load Balancing When Lync servers become overloaded or fail, load balancing on the Thunder Series ADCs ensures that end users are not impacted. Using load balancing on a Thunder Series appliance delivers the following advantages for Lync services: Transparent load-sharing for applications. Thunder Series reverse proxy capabilities to enable communication between external clients and internal frontend servers. Lower total cost of ownership (TCO) through hardware consolidation, by requiring only one physical or virtual load balancer using A10 Networks Application Delivery Partition (ADP) technology, as compared to the three physical load balancers required for most Microsoft Lync 2013 topologies. Greater scalability, as the Thunder device transparently-load balances to multiple Lync 2013 communication servers. Higher connection throughput and faster responsive time for end-users, ensuring availability under peak traffic loads. The Thunder Series supports a wealth of different load-balancing algorithms to meet the needs of the particular infrastructure, application, or network design in use. This flexibility contrasts with the Microsoft Network Load Balancing (NLB) solution, which uses only one algorithm, Round Robin. IT managers can select the algorithm that best meets their needs. For most implementations, the Least Connection algorithm is optimal. Global Server Load Balancing For workforces that are dispersed in multiple locations, the Thunder Series can improve efficiency across the WAN with a feature called Global Server Load Balancing (GSLB). This feature provides scalability and high-availability when Microsoft Lync is deployed in multiple locations, whether they are around a metropolitan area, around the country, or around the world. For geographically dispersed end users, Lync eliminates delays by enabling them to connect to the nearest external edge server. GSLB eliminates the problem of long-haul delays brought about by geographical disparities between client and Lync server locations. This feature is also valuable for disaster recovery. Health Checks Real-time applications within Lync can be impacted by jitter, which results from latency in the network. The robust nature of Lync 2013 adds new levels of latency-sensitivity. To ensure a consistently positive experience for Lync end users, Thunder ADC automatically initiates health status checks for Lync servers on a per-protocol basis, acting as a proxy between the client and the server to maintain an even traffic flow and avoid service degradation. Health checks ensure that all Lync requests go to functional and available servers. For example, when a Lync user wants to share his or her desktop with others, the Thunder device automatically sends a request to validate the relevant back-end server or port before the Lync request is sent. If the server or port does not respond appropriately, then the Thunder device temporarily removes it from the list of available servers. When the server is restored and begins to respond appropriately to the health checks, the Thunder device automatically adds it back onto the list of available servers. The Thunder Series health check capability, which monitors a range of different protocols, differs from that of Microsoft Network Load Balancing (NLB), in that NLB only performs periodic, host-level health checks. Health checks on the Thunder Series can be configured to suit customer requirements, and IT staff can opt for more advanced scripts to define response parameters. By default, health checks are sent every second, and the default monitor is set for ICMP. 4

Acceleration Figure 1. Load balancing algorithms Thunder Series ADCs help enterprises deliver fast and responsive services for their end users, improving productivity and lowering infrastructure requirements for both application delivery and critical services. On the Thunder Series, acceleration features speed and load-balance traffic across multiple Lync applications, working with Microsoft Office Web Apps, a Microsoft feature that made its debut in Lync 2013 (also part of Microsoft SharePoint). In Lync deployments, Office Web Apps Servers support PowerPoint presentations; the Thunder Series devices make each transaction more efficient and secure while using less bandwidth. The following features on the Thunder Series appliances accelerate and optimize Lync applications for end users: SSL Offload TCP Connection Reuse HTTP Compression RAM Caching SSL Offload Lync connections are secured via Secure Sockets Layer (SSL) encrypted HTTP traffic to protect critical enterprise information. Secure Sockets Layer (SSL) offload capability, a standard feature on all Thunder Series ADCs, is another method that A10 uses to accelerate applications for end users. The SSL offload feature addresses the fact that each time a user logs in to Lync, it sends an SSL request to the Lync server. SSL offload moves the burden of SSL encryption and decryption from the Lync server to the A10 device, freeing up processing power. Encrypting and decrypting network traffic can be a highly CPU-intensive task for servers, particularly in the initial session setup. By relieving backend servers from the tasks of encrypting, decrypting, and setting up the secured network connections, SSL offload significantly reduces server hardware demands and, subsequently, reduces the number of servers needed to support Lync applications. Additionally, moving the SSL termination point to the Thunder Series ADCs substantially decreases the time required for managing certificates, and it reduces the margin for operational errors. This is especially important as organizations have moved from the 1024-bit SSL key size to the 2048-bit key size (which can introduce 3-7x more overhead). 5

TCP Connection Reuse The Thunder Series TCP Connection Reuse feature saves bandwidth and expedites processing on Lync servers by reducing the overhead associated with TCP connections. It establishes static TCP connections with Lync servers, and then reuses those established connections for future TCP requests, as compared to the traditional, CPU-intensive approach of opening new connections for every single client. The TCP Connection Reuse feature terminates all client connections on the Thunder device, maintains persistent connections to the Lync servers, and sends all client requests on the same TCP connections. The result is significantly faster responsive times from Lync servers, accelerating applications for end users. HTTP Compression HTTP Compression is a bandwidth-optimization feature included in the Thunder Series that reduces bandwidth demands for HTTP and HTTPS objects in Lync environments and subsequently results in faster client downloads. End users receive compressed objects in text-based formats (such as CCS, HTML, or JS), or in application formats (such as.ppt,.doc,.xls, or.pdf). For example, a Lync end-user may share a 5MB document with other users, who would receive it as a 1MB file. RAM Caching RAM Caching is a Thunder ADC feature that accelerates applications by easing CPU processing on the backend servers and reducing the number of connections needed between Thunder devices and Lync servers. With RAM Caching, all cached objects that are requested by Lync clients are delivered directly from Thunder devices randomaccess memory (RAM) cache. As a result, Thunder ADC can offload the object requests from the Lync servers. RAM Caching substantially reduces traffic to the Lync server, freeing up CPU resources and network bandwidth. Security Efficient and secure network traffic flow is vital to an organization s fiscal health. In Lync deployments, the Thunder Series ADC solution provides an excellent way to transparently scale multiple security gateways, improving speed and availability, without forcing a compromise between performance and security. Thunder ADC can act as a reverse proxy between clients and Lync front-end servers. All TCP connections are terminated at the Thunder device, ensuring that back-end connections are initiated from a Thunder device. In this process, the Thunder Series adds a layer of security targeted for Lync applications and designed to eliminate potentially crippling threats like Distributed Denial of Service (DDoS) and web application attacks. The integrated Web Application Firewall (WAF) can block attacks like SQL injection and cross-site scripting. It can also optionally mask sensitive data, like credit card numbers, sent to Lync servers over HTTP or HTTPS. DDoS Protection Lync external edge servers are typically deployed within the DMZ (public network) for external users to access Lync services. For this reason, these external edge devices are common targets of DDoS attacks. When a Lync external service is attacked, external users are unable able to gain access to Lync servers, lowering productivity and potentially impacting the financial bottom line. Because Thunder ADC includes DDoS mitigation capabilities standard, it provides an effective barrier against DDoS attacks. High CPU capacity and processing power makes Thunder Series ADCs especially well-suited to combat massive network or volumetric DDoS attacks as well as application-layer DDoS threats. Reverse Proxy The Thunder Series has been proven and tested to function as a reverse proxy within a Lync 2013 infrastructure. This capability is particularly important with the arrival of Microsoft Lync 2013. In order to experience the versatile communication features of Lync 2013, there are several new requirements in the network for communications that go from the external client to external web services which are hosted by the director or the front-end server. Deploying a reverse proxy in the Lync 2013 topology addresses these requirements and allows external Lync clients, such as desktop clients, web apps, mobile apps, or the Windows Store Lync App, to seamlessly log into the Lync internal network as external clients. In 2012, Microsoft ceased sales of ForeFront Threat Management Gateway (TMG) 2010. A10 Thunder ADC, with its integrated reverse proxy and security features, provides the ideal migration option for ForeFront TMG customers. Thunder ADC, acting as a reverse proxy for Lync 2013, provides a single point of access and control for external 6

clients. With its reverse proxy features, Thunder ADC will: Act as an SSL bridge for connections between a Lync client and Lync backend servers. Redirect or bridge SSL traffic from one externally defined port to another defined port (for example, from TCP 443 to TCP 4443). Decrypt packets upon receipt and then re-encrypt packets prior to sending Optionally redirect unencrypted TCP traffic from one port to another for example, from TCP 80 to TCP 8080. No user configuration is required; the Thunder Series Reverse Proxy capability goes to work automatically, hiding the origination of the server on the back end. Additional Features for Optimizing Lync A10 Thunder Series virtualization and scripting features help IT managers improve the deployment and management of load balancers in Lync deployments. Application Delivery Partitioning to Reduce Data Center Footprint Application Delivery Partitions (ADPs), another Thunder Series feature, saves CapEx and operational resources by reducing the number of appliances required to host multiple applications. ADPs support Lync in a single Thunder Series appliance that establishes separate administrative and resource partitions, lowering the cost of application delivery and reducing hardware complexity and device sprawl. The Thunder device can use ADPs to segment itself virtually, such that each segment of the device can operate and appear as a separate ADC entity. These partitions can either be role-based administration (RBA) partitions with Layer 3 Virtualization (L3V). ADP capability simplifies ADC deployment, shortens time to implement, and lowers the total cost of ownership. The figures below show the consolidation of three Thunder Series devices into a single Thunder device, using ADP capability. Before External User 1 External User 2 External Internet External Edge Internal Edge 198.58.100.81 Internal External Router Edge 203.0.113.81 203.0.113.x 198.58.100.x 198.58.100.82 Internal Edge 198.58.100.x 192.0.2.x Internal Router 203.0.113.82 SNAT:203.0.113.245/24 AX #1(External Edge) VIP 203.0.113.210(Public IP) SNAT:198.58.100.226/24 AX #2(Internal Edge) VIP 198.58.100.225 SNAT:192.0.2.150/24 AX #3(Internal) AX #3(Internal) VIP 192.0.2.3 VIP 192.0.2.3 SQL Enterprise Server SP2 192.0.2.103 FrontEnd Server1 FrontEnd Server2 (Lync Server) (Lync Server) 192.0.2.105 192.0.2.106 AV1 A/V Conf 192.0.2.211 AV2 A/V Conf 192.0.2.112 Active Directory Internal User 1 Domain server 192.0.2.110 Tm.a10corp.com 192.0.2.101 Internal User 2 192.0.2.111 Figure 2. High availability architecture without ADP 7

After External User 1 External User 2 External Internet External Edge External Router Edge 203.0.113.81 203.0.113.x 203.0.113.82 Partition 1 SNAT:203.0.113.245/24 AX #1(External Edge) VIP 203.0.113.210(Public IP) Partition 1 Partition 2 Partition 3 External Edge Internal Edge Internal Internal Edge 198.58.100.81 Internal 198.58.100.x 198.58.100.82 Internal Edge 198.58.100.x 192.0.2.x Internal Router SNAT:198.58.100.226/24 AX #2(Internal Edge) VIP 198.58.100.225 SNAT:192.0.2.150/24 AX #3(Internal) VIP 192.0.2.3 Partition 2 Partition 3 SQL Enterprise Server SP2 192.0.2.103 FrontEnd Server1 (Lync Server) 192.0.2.105 FrontEnd Server2 (Lync Server) 192.0.2.106 AV1 A/V Conf 192.0.2.211 AV2 A/V Conf 192.0.2.112 Active Directory Internal User 1 Domain server 192.0.2.110 Tm.a10corp.com 192.0.2.101 Internal User 2 192.0.2.111 Figure 3. High availability architecture with ADP aflex Custom Scripting On the Thunder Series, aflex is a powerful and flexible feature for managing traffic and providing enhanced benefits and services. aflex uses the industry-standard Tools Command Language (TCL)-based syntax, including standard TCL commands and special extensions designed for the Thunder device. The aflex feature enables the Thunder Series ADCs to perform content inspection (including headers and data), and actions on traffic, including: Blocking traffic Redirecting traffic to a specific service group (pool) or server (node) Modifying traffic content In Lync environments, aflex gives IT administrators the ability to write custom TCL scripts to achieve specific application or network objectives. For instance, using aflex, administrators can write aflex rules that translate undesirably long URL links to shorter links for access to the Lync portal. 8

Conclusion By provisioning load balancing appliances with a robust set of high availability, acceleration, and security features, organizations can avoid Lync deployment pitfalls and ensure a successful Lync implementation. Thunder Series ADCs from A10 Networks give a cost-effective way for IT managers to optimize their Lync deployments and empower employees to connect, communicate, and collaborate with Lync without application jitter, disruption, or downtime. Using Thunder Series appliances to optimize and load-balance between Lync servers in enterprise networks, businesses can: Achieve high availability for Lync servers with world-class load balancing capability, to ensure that end users have uninterrupted access to Lync applications. Speed response times for end users and improve CPU utilization on Lync servers by offloading processingintensive tasks to the Thunder appliance. Optimize and complement an enterprise security solution set by load-balancing their security gateway solutions, and adding security features at the application layer to guard sensitive information shared in Lync sessions. Thunder Series ADCs are highly scalable to meet the business needs of growing companies of all sizes, to protect and ensure hardware investments today and in the future. About the Thunder Series A10 Thunder Series next-generation application delivery controllers enable high availability, acceleration, and security for Microsoft Lync. Thunder ADC delivers scalability, and a broad range of form factors, including physical, virtual, and hybrid appliances for dedicated, hosted or cloud data centers. The A10 Thunder ADC product line is built upon A10 s Advanced Core Operating System (ACOS ) platform, with a Symmetric Scalable Multi-Core Processing (SSMP) software architecture that delivers high performance. Customers can use all of the features and capabilities on the Thunder Series without incurring extra license fees per function or performance. This benefit helps keep budgets in line and, importantly, speeds deployment time as enterprises roll out new business applications. To learn more about the Thunder Series next-generation ADCs, visit www.a10networks.com/products/thunder-series. php. About A10 Networks A10 Networks is a leader in application networking, providing a range of high-performance application networking solutions that help organizations ensure that their data center applications and networks remain highly available, accelerated and secure. Founded in 2004, A10 Networks is based in San Jose, California, and serves customers globally with offices worldwide. For more information, visit: www.a10networks.com. Corporate Headquarters A10 Networks, Inc 3 West Plumeria Ave. San Jose, CA 95134 USA Tel: +1 408 325-8668 Fax: +1 408 325-8666 www.a10networks.com Part Number: A10-WP-21105-EN-01 Apr 2014 Worldwide Offices North America sales@a10networks.com Europe emea_sales@a10networks.com South America brazil@a10networks.com Japan jinfo@a10networks.com China china_sales@a10networks.com Taiwan taiwan@a10networks.com Korea korea@a10networks.com Hong Kong HongKong@a10networks.com South Asia SouthAsia@a10networks.com Australia/New Zealand anz_sales@a10networks.com To learn more about the A10 Thunder Application Service Gateways and how it can enhance your business, contact A10 Networks at: www.a10networks.com/contact or call to talk to an A10 sales representative. 2014 A10 Networks, Inc. All rights reserved. A10 Networks, the A10 Networks logo, A10 Thunder, Thunder, vthunder, acloud, ACOS, and agalaxy are trademarks or registered trademarks of A10 Networks, Inc. in the United States and in other countries. All other trademarks are property of their respective owners. A10 Networks assumes no responsibility for any inaccuracies in this document. A10 Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 9