My environment included 2 sites and I had to run most of the steps below per site. I found that it was best to install CU4 on both sites before continuing In fact since the sites share a CMS its not a good idea to push ahead with one site and leave the other behind.
Another Gotcha was that the TMG on the site where my test user was, was faulty. Make sure the user you test with is homed to the same site as the TMG you are testing through.
Also found that most PS commands were best run from the FE holding the CMS.
1. DNS
First up you’ll need to create the internal (lyncdiscoverinternal) and external (lyncdiscover.) DNS A records for MCX discovery pointing to the IP of the FE Pools
I have also configured the external discovery record, which can be verified using mxtoolbox.com. This is pointed toward the external listener address of each site’s TMG reverse proxy.
2. CU4 Update
Next install November (2011) Lync Cumulative Update (CU4),
Log on to Lync Server:
- run Stop-CSWindowsService (this will stop all the services)
- run “net stop w3svc”
- Install the update by running LyncServerUpdateInstaller.exe
- run “Stop-CSWindowsService” again
- Run “net start w3svc” after the install.
- Run “Install-CSDatabase –Update –ConfiguredDatabases –SqlServerFqdn sqlservername.domain.com” (This will apply changes to the lync database)
- Run “Start-CsWindowsService” ( to start Lync services)
3. Installing the MCX Service
Once this is complete the MCX internal ports need to be defined via the Lync management shell.
First the internal listening port:
Set-CsWebServer -Identity -McxSipPrimaryListeningPort 5086
Second the external listening port:
Set-CsWebServer –Identity -McxSipExternalListeningPort 5087
Now enable the topology:
Enable-CsTopology –verbose
Set the exposed URL (if you want to pin it down to Internal as the default – External- actually means both
#ONLY USE IF YOU WANT TO RESTRICT TO INTERNAL ONLY!!
Set-CsMcxConfiguration -ExposedWebUrl internal
Get-CsMcxConfiguration – To view settings
MCX Service Installation
The next step is to install MCX server components, ie the mcxstandalone.msi. Before you can run the installation a few changes need to be made to IIS.
Within the Lync management shell run, ensure shell is run as admin if UAC is enabled (Windows Server 2008 R2):
Import-Module ServerManager
Add-WindowsFeature Web-Server, Web-Dyn-Compression
Or the following within the Windows command line, ensure command is run as admin if UAC is enabled (for Windows Server 2008):
ServerManagerCMD.exe –Install Web-Dyn-Compression
One complete you will be presented with the following:
Now we’re ready to run the MCXStandalone.msi
First you’ll need to copy the McxStandalone.msi to:
C:\ProgramData\Microsoft\Lync Server\Deployment\cache\4.0.7577.0\setup
Now execute:
C:\Program Files\Microsoft Lync Server 2010\Deployment\Bootstrapper.exe
During the installation you will be presented with “Installing MCXStandalone…”
5. Certificate Update
Update the internal SAN certificate, this needs to include the newly created lyncdiscoverinternal.
The easiest method for re-generating certificates is by re-running the Lync Deployment Wizard, going to Install or Update Lync Server System and executing Step 3 Request, Install or Assign Certificates
Verify with:
Get-CsCertificate
This will return all certificates and their corresponding thumbprints.
6. Update TMG for Lync Mobility
There are two approaches here, one uses SSL for setup the other does not. The main reason for allowing a re-direction from port 80 (http) to 443 (https) is to avoid the need of replacing your existing SAN.
The recommended approach is to only permit the Lync mobility client to communicate on port 443, so I replaced the certificate within my existing Lync web listener within Forefront TMG.
Since the existing Web Listener rule already defines the port forwarding and includes the Cert the logical approach is to simply add the new URL lyncdiscover. to this rule and update the certificate accordingly.
Associate the updated Certificate, remember only certs in the private store will be visible here.
Finish and Publish.
7. Push Notifications Configuration
Push notifications are handled by Microsoft Office 365 or Lync Online, so you need to have federation deployed and run the Set-CsPushNotificationConfiguration cmd-let
First enable push notifications within the Lync Management Shell by running:
Set-CsPushNotificationConfiguration
Next we should enable federation with Office 365 (if not completed already), within the Lync Management Shell type: (this will add a new Hosted Provider)
New-CsHostingProvider –Identity “LyncOnline” –Enabled $True –ProxyFqdn “sipfed.online.lync.com” –VerificationLevel UseSourceVerification
Then add the Lync Push federated domain type:
New-CsAllowedDomain –Identity “push.lync.com”
And thats it!
Now to get on with testing 😉
Testing
Test connectivity to the MCX service internally from the FE or other internal machine with
https://:4443/Mcx/McxService.svc
Test connectivity to the MCS service externally with
https:///Mcx/McxService.svc – external IP of Reverse Proxy
You will get a cert mismatch or 403 – Forbidden: Access is denied.
Test with http://www.testocsconnectivity.com/
Smarter Together 
