Category Archives: Install Guide

Lync Edge Server Deployment Guide

23 Monday Jul 2012

Posted by in Install Guide, Lync Edge, Quick Reference Guide

≈ Leave a comment

Lync 2010 Edge Server Installation Guide

Firstly we will look at the Lync 2010 Edge Deployment Recommendations:
  • Do not join Edge servers to the domain
  • Use MS Lync Planning tool to generate an XLS-based topology document.
  • Use Topology builder to generate a file that will be exported to the Edge Server.
  • Edge server role cannot be combined with any other roles.
  • MS does NOT support NAT for traffic to or from the Edge internal interface, but for the Edge external interface is allowed.

 Lync 2010 Edge Server Certificate Requirements:

  • Certificate for Edge server can be issued by public CA or internal CA.
  • Edge server internal interface certificate can be issued by internal CA.
  • Edge server external interface certificate must be issued by public CA (go Daddy,DigiCert).
  • Public Certificate is used for the Access Edge service, the Web Conferencing Edge service, and for AV authentication.

  Lync 2010 Edge Server Firewall and Port Requirements:

Federation with

Feature

TCP/443

UDP/3478

RTP/UDP 50.000-59,999K

RTP/TCP 50,000-59,999K
Windows Live Messenger 2011
Point to Point
Audio/Video (A/V)
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Lync Server 2010
Lync Server 2010
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Lync Server 2010
Application sharing/desktop sharing
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Lync Server 2010
File transfer
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Office Communications Server 2007 R2
A/V
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Office Communications Server 2007 R2
Desktop sharing
Open inbound
Open inbound
Open outbound
Do not open in either direction
Open outbound
Office Communications Server 2007 R2
File transfer
N/A
N/A
N/A
N/A
Office Communications Server 2007
A/V
Open inbound
Open inbound
Open inbound
Open outbound
Open inbound
Open outbound
Office Communications Server 2007
Desktop sharing
N/A
N/A
N/A
N/A
Office Communications Server 2007
File transfer
N/A
N/A
N/A
N/A
Lync 2010 Edge Server Installation Walk-Through:
  • Configure NICs on Edge Server
    1. There must be two NICs, Internal NIC which is used to communicate with front-end servers and External NIC which is in the DMZ
    2. Configure External NIC with a gateway address.
    3. Configure Internal NIC without a gateway address.
    4. Create static route to all internal networks. (Use route add command)
  • Install pre-requisites:
    • Run Windows Powershell as Administrator
      • Import-Module ServerManager
      • Add-WindowsFeature NET-Framework-Core,Telnet-Client

  • Copy Topology Export to Edge Server
    1. Export topology by running “Export-CsConfiguration –FileName c:\edge.zip”
    2. Copy it to Edge Server

  • Install Lync 2010 Edge Server
    Run the Lync Deployment Wizard and provide exported file in step #2 (you will be prompted for the pre-requisites)

  • Apply Certificates
    Use Deployment Wizard to Request and Install certificates

  • Start Lync Services from Deployment Wizard
Advertisement

Edge Server Quick Reference Guide – install and Troubleshoot

26 Tuesday Jun 2012

Posted by in Edge Server, Install Guide, Lync Edge, Quick Reference Guide, Troubleshoot Edge

≈ Leave a comment

I Use this page to speed up the deployment all the time :-p
#Adding the persistent Route
route add –p 192.168.99.0 mask 255.255.255.0 192.168.99.252 if ?

#Get Replication status
Get-CsManagementStoreReplicationStatus

#Force Replication
Invoke-CsManagementStoreReplication

#Exporting for Edge
export-csconfiguration -filename c:\edge.zip

#Importing to Edge
import-csconfiguration -filename c:\LXLSupportedge.zip -localstore

#Testing the External interfaces (access, webconf & AV) – From Internet

telnet Access Public IP/FQDN port 5061, 443
telnet WebConf Public IP/FQDN port 443
telnet AV Public IP/FQDN port 443

#Testing the Internal interface – From LAN
telnet from:
Lync FE to IP/FQDN port 5061, 5062, 443, 4443 – Used for Replication

#Testing the Internal interface – From DMZ
telnet from:
EDGE to IP/FQDN of Lync FE port 5061

# Ensure the Edge servers of the Federated Partners trust the certificate authority used by the other.

# Check SRV Record for Federation
nslookup -type=SRV _sipfederationtls._tcp.<sipdoamin>

# Test Edge infrastructure with MSTURNPING – Another beauty from the ResKit

It only runs on the Edge server
It needs the Edge Public cert to exist on the FE
If you have multiple Edge pools they will need to have access to each other
And of course they use internal DNS to look each other up

More Edge Stuff…

Make sure you can:-

  • Resolve the Lync server and DC on internal interface (via DNS or Hosts)
  • Resolve the internal CA to verify internal Certificates (via DNS or Hosts)
  •  External interface is used for resolving federation traffic.

  • Getting the cert from the internal CA…Of course you can add the external cert to both edge interfaces as long as the Lync server trusts the issuing authority.

How to check Lync FE Certificates for CMS from Edge Server
Exported the certificate from the server hosting the CMS (without the private key)
Copy the file to the edge server (C:tmpCMSCert.cer).
From a command prompt run:-
Certutil -verify -urlfetch “C:tmpCMSCert.cer” > c:\CRL.TXT

Then I found that you can launch the CA management console and request the cert straight from there…awesome! (newbie…)

This command runs a check on the certificate (including accessing the CRLs) and dumps the results to a text file, it may take a few minutes to complete.
Now simply check the CRL.TXT file for errors

Edge Server Quick Reference Guide – install and Troubleshoot

25 Monday Jun 2012

Posted by in Edge Server, Install Guide, Lync Edge, Quick Reference Guide, Troubleshoot Edge

≈ Leave a comment

I Use this page to speed up the deployment all the time :-p
#Adding the persistent Route
route add –p 192.168.99.0 mask 255.255.255.0 192.168.99.252 if ?

#Get Replication status
Get-CsManagementStoreReplicationStatus

#Force Replication
Invoke-CsManagementStoreReplication

#Exporting for Edge
export-csconfiguration -filename c:\edge.zip

#Importing to Edge
import-csconfiguration -filename c:\LXLSupport\edge.zip -localstore

#Testing the Ext interface – From Internet
telnet public IP/FQDN port 5061, 443

#Testing the Internal interface – From LAN
telnet from:
Lync FE to IP/FQDN port 5061, 5062, 443, 4443 – Used for Replication

#Testing the Internal interface – From DMZ
telnet from:
EDGE to IP/FQDN of Lync FE port 5061

# Ensure the Edge servers of the Federated Partners trust the certificate authority used by the other.

# Check SRV Record for Federation
nslookup -type=SRV _sipfederationtls._tcp.

# Test Edge infrastructure with MSTURNPING – Another beauty from the ResKit

It only runs on the Edge server
It needs the Edge Public cert to exist on the FE
If you have multiple Edge pools they will need to have access to each other
And of course they use internal DNS to look each other up

More Edge Stuff…

Make sure you can:-

  • Resolve the Lync server and DC on internal interface (via DNS or Hosts)

  • Resolve the internal CA to verify internal Certificates (via DNS or Hosts)

  • External interface is used for resolving federation traffic.

    Getting the cert from the internal CA…Of course you can add the external cert to both edge interfaces as long as the Lync server trusts the issuing authority.


A little pain I had was that after generating the request I tried connecting to the CA web (https:\\\certsrv) with no joy of course. I wouldnt even connect from the CA itself, very frustrating.

How to check Lync FE Certificates for CMS from Edge Server
Exported the certificate from the server hosting the CMS (without the private key)
Copy the file to the edge server (C:\tmp\CMSCert.cer).
From a command prompt run:-

Then I found that you can launch the CA management console and requet the cert straight from there…awesome! (newbie…)

Certutil -verify -urlfetch “C:\tmp\CMSCert.cer” > c:\CRL.TXT
This command runs a check on the certificate (including accessing the CRLs) and dumps the results to a text file, it may take a few minutes to complete.
Now simply check the CRL.TXT file for errors