Dealing with resolving internal URLs externally in a non-split DNS scenario

Question

Hi all -
I submitted this yesterday under a different banner but thought I'd try this forum as well.
I have a client who wishes to have internal URLs resolvable from outside the network and they do not have split DNS.  He scenario is this:
UserA sends a link to UserB in an email.  Internally the URL is MySIte.Acme.int.  UserB picks up the email on his mobile device whilst travelling and wants to gain access to it.  However the external namespace of the company is
Acme.com.  Obviously the link will not resolve outside of the corporate network.
So far I have received recommendations for using a VPN, however this is not an option for them.  In a past life I seem to recall something about alternate access mappings (or something like that) and wondered if this was the way to do make the links
resolvable. And, if so, if someone could point me to a good article on how to implement this it would be much appreciated.
Alternatively I was wondering if there is some magic that can be done with URL rewrites or an edge device like UAG or TMG.
Any guidance or suggestions would be greatly appreciated!
Kind regards,
Wren

Answer 1

What I would do is create a new internal DNS zone named Acme.com, create an A record of "mysite" pointing to the IP currently used by mysite.acme.int, and then simply add AAMs (or better yet, replace AAMs as the AAM the user is coming in on is
what will be reflected in that email).
http://blogs.msdn.com/b/sharepoint_strategery/archive/2013/05/25/alternate-access-mappings-explained.aspx
https://technet.microsoft.com/en-us/library/cc263208.aspx
URLRewrite won't work because the Acme.int domain is not resolvable on the Public Internet.
So the plan of action should be:
Go to Central Admin -> Delete -> select Remove SharePoint from IIS Web Site, and then choose the option to Delete the IIS web site. Change the AAM for the Web Application under Application Management -> Configure Alternate Access Mappings. Click
Edit Public URLs, choose the Web Application hosting mysite.acme.int, and then change the Default Zone AAM to https://mysite.acme.com. Go back to Manage Web Applications, highlight the Web Application (you'll see the new AAM reflected here), then click on
Extend. Create a new IIS site, change the port number (likely 443) with the appropriate host header (mysite.acme.com), select Use SSL, then click OK.
So a couple of caveats:
1) All SharePoint servers hosting this Web Application must have the SSL certificate matching mysite.acme.com prior to re-extending it.
2) If you have any hard coded URLs (e.g. to images) on any SharePoint site within mysite.acme.com, you'll break their links and you will need to manually reconfigure them.
3) If you've made any manual changes to the web.config, you will need to recreate those changes. It might be a good idea to grab a copy of the web.config for that Web Application (IIS Site) before deleting the site.
4) Use SSL! You do not want to send NTLM in the clear over the public Internet. It can be easily intercepted and decrypted.
Hope that helps.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.