Configuring Lync 2010 Mobility with Front end and Edge Server

I have been racking my brain the past week trying to figure out how to get the lync edge server working properly and how to get the mobility service working properly.
Currently I have 1 front end server that is configured and working. I have one edge server that has been configured according to nearly every online help I could find along with public CERT.
If I use microsoft's online connectivity test and I run the test for
Lync Server Remote Connectivity Test everything passes. I am also able to connect to lync using a windows lync client from outside of the internal network however I have to specify the server name as being sip.ourdomain.com I cannot get connected using
autodiscover.
When I run the Lync Autodiscover Web Service Remote Connectivity Test it fails due to SSL error to lyncdiscover.ourdomain.com which then lead me down the path that I needed to install
the Mobility service but it also tells me that I may need to update our SSL cert as well.
This is where I am getting confused and would like to be pointed in the correct direction.
When I installed mobility service on the front end server it created the autodiscover section in IIS. If I am inside our network I can browse to it without any issue. Where I am confused at this point is how to either setup DNS or how to configure
the edge server to use autodiscover.
Do I need to setup an additional public IP and point lyncdiscover.ourdomain.com to the IP of our front end server or to our edge server? If I have to point this to our front end server then that would mean that I use one public IP that goes to 443,
444 and 5061 for our edge server and then I would need one public IP that goes to ports 443 and 80 that get redirected to ports 4443 and 8080 on our front end server? If that is the case then do I have to get an external cert for the front end server
that contains lyncdiscover or can clients connect if it is just using the self signed cert from the domain?
This is where I am getting confused at and hopefully some nice folks out there can clarify this for me so I can get this resolved.
Thank you
KK

You need an additional public IP to point to a reverse proxy, which will listen on port 443 and proxy requests to your front end server on port 4443 (notice the extra 4). You can use IIS ARR, Web Application Proxy, or whatever else you may have for
this purpose, but you need to ensure you redirect port 443 to port 4443. This reverse proxy cannot be collocated on your front end server or edge, you'll need a separate box or appliance.
Beyond Lyncdiscover, you'll want to do this for your external web services FQDN as defined in the topology builder and your meet and dialin URLs too. You'll want a third part cert for all of this (though it doesn't need to be installed on the front
end, just the reverse proxy) so that you don't need to install any internally signed root certs on anyone's smartphone.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Similar Messages

Lync 2010 Standard Edition Front-End and Edge Cerificate Renewal issue

Hi Experts,
I have a client with Single Standard Edition FE server and 1 Edge server and both are using PUBLIC certificates. It also has a reverse-proxy server (F5 HLB) with wildcard certificate installed. The FE and Edge certificates are about to expire and the client
now wants the ff.
1. Internal Certificate from Internal CA server for FE
2. External Certificate from Public CA for Edge
What I did was,
A. For Internal Cert - I generated a CSR from MMC cert manager using custom request from the FE server and have it signed by the Internal CA. Reason I did that was, everytime I requested the CSR from Lync Certificate Wizard, it is getting the certificate
template not supported by the Internal CA.
B. For External Cert - I requested the Edge external CSR thru Lync Certicate Wizard and submitted to the client for public CA renewal.
When I installed both certificates, internal lync works fine but anything external (i.e. external lync access, mobile, federation) do not work anymore.
So I decided to roll back the certificates and everything went back to normal?
Question is, what steps or process did i miss or gone wrong? Hope for your response. Thank you in advance.

Hi DaxZilla,
You also need to request a certificate to internal interface of Edge Server from internal enterprise certificate authority.
The certificate for the external edge interface should contain SANs as below:
SAN=Access Edge service FQDN
SAN=Web conference service FQDN
SAN=SIP domain FQDN
Mobile client goes through reverse proxy server to sign in. It is not related with Edge Server. Check the certificate on reverse proxy is not expired.
Best Regards,
Lisa Zheng
Lisa Zheng
TechNet Community Support

Lync Front End and Edge on same host

Hey guys can anyone confirm if having a front end and edge on single host is supported, providing of course the ram and cpu requirements are met.
Thank you.

The Front End and Edge must be on separate computers and can't be collocated. Both servers can coexist on the same Virtual Host if using VMware or Hyper-V.
See: http://technet.microsoft.com/en-us/library/gg398131.aspx
Please mark posts as answers/helpful if it answers your question.
Blog
Lync Validator - Used to assist in the validation and documentation of Lync Server 2013.

Lync 2013 Enterprise load balancing on the front end and edge pool

Hi,
I am setting up a Lync 2013 Enterprise deployment consisting of a Front End pool (x2 FE servers) and an Edge pool (x2 Edge servers). I'm seeing some conflicting advice regarding load balancing using hardware or DNS for the front end and the edge.
On the front end I have 2 internal DNS records 'lyncfepool1.contoso.local' each of which map to one of the IPs of the FE servers. I've used my details to populate the Detailed Design Planner excel spreadsheet and am told that I require a HLB to load
balance my front end pool. I'm aware of the need to load balance HTTPS traffic internally (which will be done by TMG) however other traffic to the front end (SIP, etc) can be balanced by DNS only, and not require a HLB?
Can someone clarify the front end requirement?
Also - looking now at the edge pool - this site again have two edge servers in a pool. We are using a total of six private IP addresses, two per edge service (2 x av.contoso.com, 2 x sip.contoso.com and 2 x webcon.contoso.com). These will be
NAT'ed by the external firewall and directed to the respective external (DMZ) IP addresses on the Edge servers on port 443. I know this isn't true roundrobin due to the intelligence of the Lync client when connecting (in that the Lync client will connect
to one of the public IPs and if it can't connect, it will know to connect to the other service IP), however I want to clarify this set up, particularly the need to direct the external public IP traffic at the DMZ Edge IP specified in the topology builder.
I've attached a basic diagram of the external/DMZ/Edge side which hopefully helps with this question
Persevere, Persevere, Per..

That is because you will always need HLB for a front-end server since it hosts the Lync webservices which use HTTP/HTTPS traffic.
The description on the calculation tool also describes this correctly:
Supports Standard and Enterprise pools (up to 12 nodes), with pure device-based load balancing or a combination of DNS load balancing and device-based load balancing (for
Lync web services)
You can use either Hardware or DNS loadbalancing for SIP traffic only, but you will always need a HLB for the webservices. Both are applicable for the Front-End so you have either
full HLB for both SIP and HTTP(S) traffic
DNS LB for SIP traffic and HLB for HTTP(S) traffic
Hope this is more clear :-)
Lync Server MVP | MCITP Lync Server 2010 | If you think my post is the answer to your question, please mark it as answer so future visitors can easily find it.

Lync 2010 Mobile Client for IOS and Android - Is File Transfer Possible

I'm seeking confirmation that File Transfer is possible in a chat session with a Lync Mobile client running on IOS or Android. Can anyone provide further information as none of the client feature lists state it one way or the other?
Many thanks
Ivor

The Mobile Lync client can't share files, see the Client Comparison Table: http://technet.microsoft.com/en-us/library/hh691004.aspx
(edit) Lync 2010 Mobile client Comparison Table: http://technet.microsoft.com/en-us/library/hh691004(v=ocs.14).aspx
Please mark posts as answers/helpful if it answers your question.
Blog
Lync Validator (BETA) - Used to assist in the validation and documentation of Lync Server 2013.

LYNC 2010 Enterprise Pool Front End Servers

Can we mix Windows 2008 R2 Enterprise Edition and Standard Edition virtual servers in same LYNC 2010 Front End Pool?
Tek-Nerd

Agree with Lisa,Lync Server virtualization supports a mix of operating systems. For example, a host server running Windows Server 2012 R2 that runs virtual servers that run Windows Server 2008 R2 is supported.
You cannot mix different types of servers within the same pool. All servers within the same pool must either be physical or virtual
Also you can refer below link
http://technet.microsoft.com/en-us/library/gg399035.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"

Lync 2013 On Prem - Front End Pool - Second server in pool becomes unavailable when first server is offline

We have one front end pool, that contains 2 front end servers running Lync Server 2013.
When the first server, LFE01 goes offline (to be restarted for instance), the second front end server LFE02 in the same pool's Lync services will suddenly stop and will refuse to start until LFE01's Lync services have started again.
During this time, the Lync client will go from full functioning mode whilst LFE01 is up and running, to reduced functionality (when LFE01 is restarting), to the user being signed out of Lync and not able to log back in. As soon as LFE01 comes back up, users
can log back in to Lync.
We'd ideally like LFE02 to take over the front end server role whilst LFE01 is restarting, and vice-versa.
Checking the event logs on LFE02, I can see the following errors when LFE01 is offline:
This process was not able to update its health status
The Audio-Video Conferencing Server failed to send health notifications to the MCU factory at https://frontendpool.contoso.com:444/liveserver/mcufactory/.
Failure occurrences: 30, since 7/11/2013 3:40:38 PM.
Cause: Either the Front End service is not running, or poor network connectivity.
Resolution:
Verify that the Front End Service is available, and its machine is visible over the network.
This process was not able to update its health status
The IM Conferencing Server failed to send health notifications to the MCU factory at https://frontendpool.contoso.com:444/liveserver/mcufactory/.
Failure occurrences: 30, since 7/11/2013 3:40:42 PM.
Cause: Either the Front End service is not running, or poor network connectivity.
Resolution:
Verify that the Front End Service is available, and its machine is visible over the network.
Server startup is being delayed because fabric pool manager is initializing.
Cause: This is normal when Pool is bootstrapped and indicates that the Front-End is waiting for a quorum of other Front-Ends to be started.
Resolution:
If this event recurs persistently, ensure that 85% of the Front-Ends configured for this Pool are up and running. For 2 or 3 machine Pools, initial cold-start of the Pool requires all machines to be started. If multiple Front-Ends have been recently
decommissioned, run Reset-CsPoolRegistrarState -ResetType QuorumLossRecovery to enable the Pool to recover from Quorum Loss and make progress.
Does the first server in the pool need to be up at all times for the second server to be running? If so, I may need to re-plan my redundancy.

I can't believe how inaccurate these statements are.
Yes as per Microsoft it is best practice to have 3 FE in a pool but that absolutely does not mean that if you have 2 FE server in a pool that your pool will stop working!!
In case when you do have 2 FE servers in a pool your Back End primary database server will act as a vote to keep the quorum for single server still left in a pool and all your clients will keep operating in a pool with one FE still running.
The problem with having 2 FE in a pool as per Microsoft documentation is as follows:
If one of the two Front End Servers goes down, you should try to bring the failed server back up as soon as you can. Similarly, if you need to upgrade one of the two servers, bring it back
online as soon as the upgrade is finished.
If for some reason you need to bring both servers down at the same time, do the following when the downtime for the pool is finished:
The best practice is to restart both Front End Servers at the same time.
If the two servers cannot be restarted at the same time, you should bring them back up in the reverse order of the order they went down.
If you cannot bring them back up in that order, then use the following cmdlet before bringing the pool back up:.
http://technet.microsoft.com/en-us/library/gg412996.aspx
I tested this in my environment which I currently am running with 2 FE servers and I can categorically confirm that pool will continue operating.
However, with all this said I did notice that clients with connection to FE server that is shut down take anywhere from 2-9 min to reconnect. I was trying to figure out why such a long delay until clients reconnect. Possibly it might be because there are
2 FE servers in a pool and Back End server is taking a while to vote in turn delaying auto reconnect process for clients. Second possibility that I'm looking into is that we deployed HLB for sip traffic internally as well and I'm curious if using DNS LB would
fix this delay.
I'm just so disappointed how inaccurate some of these accepted answers above are.

How to connect Lync 2013 client with OCS 2007 R2 Edge server

Hi,
We have OCS 2007 R2 Edge server for external & OCS 2007 R2 FE Server for internal access in our environment.
We able to access internally Lync2013 clients with OCS 2007R2 server, however from external we cannot access Lync2013 client with OCS2007 R2 server.
Is there any patch or registry key trick to access OCS from lync2013 client externally? We cannot immediately migrate to Lync2013 server from OCS.
Any help
MD

Hi,
I suggest you still use OCS 2007 R2 client to login OCS 2007 R2 Server untill finishing migration to Lync Server 2013, as using Lync client with OCS 2007 R2 Server will offer a pretty limited experience.
Here is a great blog about Lync 2010 Client unsupported with OCS, it is for Lync 2010 client but similar for Lync 2013 client:
http://blog.schertz.name/2010/09/lync-client-unsupported-ocs/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.
Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Authentication with UME separation of front end and back end

My webdynpro project has 2 application. One for Admin one for Rating.
Is it possible to create a java class at Webdynpro level and share it between the 2 applications?
Why the need?
Created a custom class (lets called it CommonEJB), to point to the right pages and set of UI controls after the initial login with UME. This class utilizes the IWDClientUser.getSAPUset() method to get IUser object.
If it is not possible to create a java class at Webdynpro, then this ejb will need to be deployed to the backend.
Putting it at the backend is not good as security wise, its always better to separate the authentication between front and back end.
Any ideas/solutions?
thanks

s0003358504
au-?Krup
LDAP
==============================================
Computer Associates Int'l [eTrust Directory]
Critical Path [CP Directory Server (CP DS)]
Microsoft [Windows 2000 Active Directory Server]
Microsoft [Windows 2003 Server - Active Directory]
Netscape Communications [Netscape Directory Server]
Novell [DirXML Driver for User Management]
Novell [Novell DirXML Driver for SAP HR/PA]
Novell [Novell eDirectory]
Oracle Deutschland [Oracle Internet Directory (OID)]
Siemens [DirX Directory Server]
Siemens [DirX Extranet Edition]
Sun Microsystems [Sun Java System Directory Server]
     Test Objectives
     Testing Scope
     Test Approach
     Test Environment
     Test Data
     Entry / Exit Criteria
     Risks
     Schedule and Resources
     SIT Deliverables
     Test Planning Source Documents
Well, i wish to create a java class that can separate the view areas depending on their login.
lets say you're a manager, u can see certain views. and if you're a supervisor u see another. This is achieved using the java class with information from getSAPUser() position. After retrieving the position, using the java class will programmatically assigned the appropriate views, buttons, tabs etc.
so this class need to in front end, and not back end. problem is we have 2 application.
if the class is created front end in one application can it be shared with another.

Lync 2010 Integration with Exchange Online UM

Hi All,
Recently I have got the project to integrate Lync 2010 with Exchange Online UM, I have gone through the TechNet article but it seems very confusing and things are not very clear, can some please please help me out in this that how to setup this, what ports
do I need to allow from on premises to Exchange online UM.
There are some other questions as well which is not clear from TechNet.
1. Create SRV record, when I create the SRV record in external dns then in the host providing this service will be access edge fqdn is this correct.
2. Configure Edge Server for federation (do I need to run this on Edge server or on Lync FE Servers, I believe on FE SErvers is this correct, if yes then do I need to run the setup again on Edge server by exporting Topology or the replication will
do the needful)
3. To Create a hosting provider do I need to run this command on Edge or on Lync FE Servers.
4. To create a hosting provider you need to run the command
New-CsHostingProvider -Identity Fabrikam.com -Enabled $True -EnabledSharedAddressSpace $True -HostsOCSUsers $False -ProxyFQDN "proxyserver.fabrikam.com" -IsLocal $False -VerficationLevel UseSourceVerification
now from the above command -Identity what will be the Identity name it can be any thing or it should be some thing related to exchange online um.
for -proxyfqdn what will be the FQDN name here, from where I can get this name
5. Do I need to add or remove any domain names in office 365 if yes then what domain names it will be
6. If my sip address is abc.com then do I have to add this domain name in exchange online or do I need to add another domain name how this setup will be
7. if I will create any new domain in the dns in office 365 then do I need to add this domain name in my external dns if yes then which ip it will be pointed to.
Please guys help me out as I m new to exchange um online and I have never integrated it before.
Appreciate your help
If answer is helpful, please hit the green arrow on the left, or mark as answer. Salahuddin | Blogs:http://salahuddinkhatri.wordpress.com | MCITP Microsoft Lync

1. Yes, create an SRV as per Lync documentation for external access to Edge.
2. Correct, all config is done on
Front End and will be replicated to the Edge servers. As long as your Edge servers are replicating successfully theere is no need to do a manual import.
3. Run this PowerShell on the Front End
4. Identity is a name to identify the hosting provider such as "Exchange Online". See http://technet.microsoft.com/en-us/library/gg398490.aspx
proxyfqdn for Exchange Online is exap.um.outlook.com
5. Your SIP domain will need to be added a a vanity domain in Office 365
6. Same as above, just add as vanity domain
7. Any added domains need to be setup as per Office 365 documentation, nothing special needs to be done for UM integration.
Check this out for more info - http://lyncinsider.com/instant-messaging/how-to-connect-lync-server-to-exchange-online-part-1/
Andrew Morpeth
Lync Server Specialist - Auckland, NZ
Check out my blog

Https front end and http backend

Hi there....I am having a small issue....I have a web app that is https based....I have installed the cert on the CSS, and DNS for this app points to the VIP....the client is wanting to have an https front end, and then load balance in http to the backend servers....the issue I am running into is that this only works if I have an active port 80 rule on that same VIP....if I suspend the port 80 rule and only leave the port 443 rule active on that VIP, it doesn't work....please see appropriate config portions below....Thanks in advance!
Sandeep
ANy suggestions? I have been trying this for a couple of days now...it works fine if the backend sessions are also https, but the client has changed their requirement....
ssl-proxy-list SSL1
ssl-server 1
ssl-server 1 rsakey app1-test
ssl-server 1 rsacert app1-test
ssl-server 1 vip address 10.19.55.10
ssl-server 1 cipher rsa-with-rc4-128-md5 10.19.55.10 81
backend-server 1
backend-server 1 port 81
backend-server 1 server-ip 10.19.55.132
backend-server 1 ip address 10.19.55.132
backend-server 2
backend-server 2 port 81
backend-server 2 server-ip 10.19.55.133
backend-server 2 ip address 10.19.55.133
backend-server 3
backend-server 3 port 83
backend-server 3 server-ip 10.19.55.132
backend-server 3 ip address 10.19.55.132
backend-server 4
backend-server 4 port 83
backend-server 4 server-ip 10.19.55.133
backend-server 4 ip address 10.19.55.133
backend-server 5
backend-server 5 port 85
backend-server 5 server-ip 10.19.55.132
backend-server 5 ip address 10.19.55.132
backend-server 6
backend-server 6 port 85
backend-server 6 server-ip 10.19.55.133
backend-server 6 ip address 10.19.55.133
active
service webserver002:81
ip address 10.19.55.132
port 81
keepalive port 2199
keepalive type tcp
protocol tcp
active
service webserver003:81
ip address 10.19.55.133
port 81
keepalive port 2199
keepalive type tcp
protocol tcp
add ssl-proxy-list SSL1
active
service webserver002:83
ip address 10.19.55.132
port 83
add ssl-proxy-list SSL1
keepalive port 2399
keepalive type tcp
protocol tcp
active
service webserver003:83
ip address 10.19.55.133
port 83
keepalive port 2399
keepalive type tcp
protocol tcp
add ssl-proxy-list SSL1
active
service webserver002:85
ip address 10.19.55.132
port 85
add ssl-proxy-list SSL1
keepalive port 2599
keepalive type tcp
protocol tcp
active
service webserver003:85
ip address 10.19.55.133
port 85
keepalive port 2599
keepalive type tcp
protocol tcp
add ssl-proxy-list SSL1
active
service SSL_Front
slot 2
type ssl-accel
keepalive type none
add ssl-proxy-list SSL1
active
owner app1-test
content app-test_back
vip address 10.19.55.10
add service webserver002:81
add service webserver003:81
add service webserver002:83
add service webserver003:83
add service webserver002:85
add service webserver003:85
balance aca
protocol tcp
port 81
active
content app1-test_front
vip address 10.19.55.10
application ssl
add service SSL_Front
protocol tcp
port 443
advanced-balance ssl
balance aca
active

Thanks for the quick reply....there is another port 80 rule setup for that vip....I was using that to test with the app until I got the front end https rules working....
my port 80 rules just says listen to 10.19.55.10 on port 80 and load balance btwn the webervers on port 8x in the back end...
I am trying to do https front end and http backend....
no where in my SSL config have I configured port 80....but when I suspend that rule it all fails....
I am wondering if the backend server sessions are happening properly?
I don't fully get what you mean by "You need to have the rule in port 443 to match traffic coming from the client and the clear text rule (port 81) to match traffic already decrypted coming from the SSL module"
Haven'tI done that?
Thanks again!
Sandeep

Removing admin password form Access 2003 database front end and back end

We have a legacy database that has been passed down from the original creator, who is no longer with the organization. It was created in Access 2003. It has a front end and a back end. The original admin password can not be located and we are in the process
of upgrading this application to 2010. Is there a way to remove that password so we can make changes to the original files?

Hi,
What password are you talking about, the one created with the workgroup manager? That will be difficult since 2010 doesn't have the workgroup manager anymore. You can still use the database in the 2010 environment but you can't make any changes to the original
database without the password.
Maurice

Front end and Back end experience in SAP BW

Hi Friends...
Can ne1 plz explain wht things in SAP BW come under Front end and Back end experience......Thanks in advance

Generally, back-end would consist of the taks associated with configuration of data targets (ODS, Cubes), working with extractors, mapping data to the data targets, writing transfer/start rtn/update rules, and creating Infopkgs/ Process Chains.
Front-end deals with the use of the BW - writing queries, workbooks, web (although I think some of the infrastructure aspects of web reporting. e.g. javascript/templates might really could be considered backend). Think of Front-end as all of the client/customer/user facing components.

What is BW Front-end and Whats BW Back-end? Technica ? Functional?

Hi Gurus,
Can some one throw light on the diff between a BW Front-end and BW BAck-end? How will u diff the responsibilities of a Functional BW Consultant and Technical BW Consultant?
thanks
kishore karnati

Hi,
BW Front end is the one that deals with reporting. Eg: BEx
BW back end is the one that deals with the components that stores data which is used for the reporting purpose.
Eg: R3
Functional consultant comes into picture when there is a need to understand the functional aspects of a requirement, say for example, you have a requirement to use Sales Order in your BW application, as a pure BW person, you wont know what a Sales Order is about. A functional consultant has the ability here to map the sales order requirement in the BW application. This means that, he knows what field and what table this sales order relates to. This way, a functional consultant maps the user requirements to the technical detail in the system.
A pure BW consultant is one who knows how to setup data extraction from source system , how to build various components in a BW system, how to schedule a load, how to troubleshoot in case of any issues in the BW application.
Hope this helps..
Assign points if this helps...
Thanks,
Raj

Front end and console ports are down for switch WS-C3750X-48PF-S

We have a switch WS-C3750X-48PF-S in the stack and front end and console ports stopped working and are down.
I have tried to replug power cable but this didn't help, please let me know if I could replug stack power for this switch without outage of other switches in the stack, since switches are connected into the ring
Please let me know what might be the possible root cause
#sh switch stack-ports
  Switch # Port 1 Port 2
    2 Down Ok
    3 Ok Ok
    4 Ok Down

Hello,
There is a problem with the stacking connection between switch 4 and 2. Can you try replacing the stacking cable between these switches?

Configuring Lync 2010 Mobility with Front end and Edge Server

Similar Messages

Maybe you are looking for