Install Guide | Smarter Together

My environment included 2 sites and I had to run most of the steps below per site. I found that it was best to install CU4 on both sites before continuing In fact since the sites share a CMS its not a good idea to push ahead with one site and leave the other behind.

Another Gotcha was that the TMG on the site where my test user was, was faulty. Make sure the user you test with is homed to the same site as the TMG you are testing through.

Also found that most PS commands were best run from the FE holding the CMS.

1. DNS

First up you’ll need to create the internal (lyncdiscoverinternal) and external (lyncdiscover.) DNS A records for MCX discovery pointing to the IP of the FE Pools

I have also configured the external discovery record, which can be verified using mxtoolbox.com. This is pointed toward the external listener address of each site’s TMG reverse proxy.

2. CU4 Update

Next install November (2011) Lync Cumulative Update (CU4),

Log on to Lync Server:

run Stop-CSWindowsService (this will stop all the services)
run “net stop w3svc”
Install the update by running LyncServerUpdateInstaller.exe
run “Stop-CSWindowsService” again
Run “net start w3svc” after the install.
Run “Install-CSDatabase –Update –ConfiguredDatabases –SqlServerFqdn sqlservername.domain.com” (This will apply changes to the lync database)
Run “Start-CsWindowsService” ( to start Lync services)

3. Installing the MCX Service

Once this is complete the MCX internal ports need to be defined via the Lync management shell.

First the internal listening port:
Set-CsWebServer -Identity -McxSipPrimaryListeningPort 5086

Second the external listening port:
Set-CsWebServer –Identity -McxSipExternalListeningPort 5087

Now enable the topology:
Enable-CsTopology –verbose

Set the exposed URL (if you want to pin it down to Internal as the default – External- actually means both

#ONLY USE IF YOU WANT TO RESTRICT TO INTERNAL ONLY!!

Set-CsMcxConfiguration -ExposedWebUrl internal

Get-CsMcxConfiguration – To view settings

MCX Service Installation

The next step is to install MCX server components, ie the mcxstandalone.msi. Before you can run the installation a few changes need to be made to IIS.

Within the Lync management shell run, ensure shell is run as admin if UAC is enabled (Windows Server 2008 R2):

Import-Module ServerManager

Add-WindowsFeature Web-Server, Web-Dyn-Compression

Or the following within the Windows command line, ensure command is run as admin if UAC is enabled (for Windows Server 2008):

ServerManagerCMD.exe –Install Web-Dyn-Compression

One complete you will be presented with the following:

Now we’re ready to run the MCXStandalone.msi

First you’ll need to copy the McxStandalone.msi to:

C:\ProgramData\Microsoft\Lync Server\Deployment\cache\4.0.7577.0\setup

Now execute:

C:\Program Files\Microsoft Lync Server 2010\Deployment\Bootstrapper.exe

During the installation you will be presented with “Installing MCXStandalone…”

5. Certificate Update

Update the internal SAN certificate, this needs to include the newly created lyncdiscoverinternal.

The easiest method for re-generating certificates is by re-running the Lync Deployment Wizard, going to Install or Update Lync Server System and executing Step 3 Request, Install or Assign Certificates

Verify with:

Get-CsCertificate

This will return all certificates and their corresponding thumbprints.

6. Update TMG for Lync Mobility

There are two approaches here, one uses SSL for setup the other does not. The main reason for allowing a re-direction from port 80 (http) to 443 (https) is to avoid the need of replacing your existing SAN.

The recommended approach is to only permit the Lync mobility client to communicate on port 443, so I replaced the certificate within my existing Lync web listener within Forefront TMG.

Since the existing Web Listener rule already defines the port forwarding and includes the Cert the logical approach is to simply add the new URL lyncdiscover. to this rule and update the certificate accordingly.

Associate the updated Certificate, remember only certs in the private store will be visible here.

Finish and Publish.

7. Push Notifications Configuration

Push notifications are handled by Microsoft Office 365 or Lync Online, so you need to have federation deployed and run the Set-CsPushNotificationConfiguration cmd-let

First enable push notifications within the Lync Management Shell by running:

Set-CsPushNotificationConfiguration

Next we should enable federation with Office 365 (if not completed already), within the Lync Management Shell type: (this will add a new Hosted Provider)

New-CsHostingProvider –Identity “LyncOnline” –Enabled $True –ProxyFqdn “sipfed.online.lync.com” –VerificationLevel UseSourceVerification

Then add the Lync Push federated domain type:

New-CsAllowedDomain –Identity “push.lync.com”

And thats it!

Now to get on with testing 😉

Testing

Test connectivity to the MCX service internally from the FE or other internal machine with

https://:4443/Mcx/McxService.svc

Test connectivity to the MCS service externally with

https:///Mcx/McxService.svc – external IP of Reverse Proxy

You will get a cert mismatch or 403 – Forbidden: Access is denied.

Test with http://www.testocsconnectivity.com/

Once TMG has been installed with 2 interfaces – one pointing to LAN and the other to the Internet you are ready to create the Web Publishing Rule for Lync.
This rule will be used to access GAL, ABS, Web Conferencing (Meet and Dial) as well as Lync Mobile. Of course all of these URLS need to be included in the Public Certificate and Public A record for each name needs to be configured.

So lets get started..

Select New – Web Site Publishing Rule

Give the new rule a logical name

Since the Sites will be HTTPS we will use the SSL option

Now we add the internal URL as configured in the Topology Builder

Not required but I no harm in defining this

For Path add /*

The Public name is what is published in Topology Builder as the external URL as well as a name in the SAN Cert. If using the same cert and rule for more URL’s like lyncdiscover then this will need adding later, see last step.

Since this is a brand new TMG no Web Listener exists so we select New and continue. The Web Listener Name is irrelevant but always good to use something descriptive

Select External as this is where the traffic will originate from

Important to note that the certificate actually needs to be in the local store Personal or it wont show up when you click on select Certificate