Lab setup multiple SIP domains for federation

Question

I have been setting up multiple Lync 2013 lab environments and have a question about my external DNS environment. I have installed server 2012R2 on the host running the lab with its own domain (contoso.local). I have this server which hosts a separate domain,
Hyper-V and a CA, this is what I am using for my external environment. The network IP is 10.0.0.0/16.
I set up a server called vRouter that has 3 NICs. In Hyper-v I have 3 virtual switches configured. One for the External environment - 10.0.0.0/16 (not necessary for lab, setup to transfer needed files from internet to VMs), one for 192.168.1.0/24, and one
with 192.168.2.0/24. The virtual router has RRAS installed and can route traffic between 192.168.1.0/24 and 192.168.2.0/24.
My VMs for the lab are as follows.
1test.local
AD1.1test.local -192.168.1.100
FE1.1test.local - 192.168.1.200
Edge1 - 192.168.1.210int, 10.0.5.10ext
2test.local
AD2.1test.local -192.168.1.100
FE2.1test.local - 192.168.1.200
Edge2.1test.local - 192.168.1.210int, 10.0.6.10ext
Both environments have users that can log into lync and message each other.
When installing the Edge servers I used the same FQDN and IP for the external interface since all ports are open and firewalls have been disabled internally. I installed the internal certificate from the AD server which has CA role in each environment. On
the external device I used the Host's CA to get certificates for both Edge servers. The Edge servers have 2 NICs one on their expected internal environment with no Gateway. And one on the external environment. These servers are not part of any domain. however
I did add the contoso.local to the primary DNS suffix when domain membership changes under system properties. I then created the two following A records on the host computer (10.0.0.0\16 network, contoso.local) to be able to see router their external traffic.
Edge1.contoso.local 10.0.5.10
Edge2.contoso.local 10.0.6.10
Both of these FQDNs are what is in my topology for the Access Edge service, Web Conferencing Edge Service, and A/v Edge Service with the same IP using different ports in both environments.
Both environments are set up to support the other SIP domain. However when I try to add a user from the other domain I cannot communicate with that user nor see their presence.
I looked over my external DNS settings and realized that I had not set a SRV record on the 10.0.0.0\16 network(external).
I then realized that if I try to add the traditional _sipfederationtls._tcp.contoso.local I will have 2 conflicting entries.
One for:
_sipfederationtls._tcp.contoso.local - 10.0.5.10 (1test.local edge)
and one for:
_sipfederationtls._tcp.contoso.local - 10.0.6.10 (2test.local edge)
Should I spin up another VM and make that a DC with a CA and trust it to the host computer, set up conditional forwarders. Something like Trust.local and correct the DNS, topology builder FQDN, and certificates on the second edge server?
Edge2.trust.local
Or can I add a new zone to my host computer then correct the DNS, topology builder FQDN, Certificates?
Or am I missing another external DNS record on my contoso.local environment?
Can I set up a CNAME entry that will mask the second edge server?
Any input would be appreciated.
Thanks

Answer 1

If contoso.com is not a sip domain, then you won't need that DNS record at all.  Those records are autodiscover records that Lync uses based upon the sip domain. 
So you'd need
_sipfederationtls._tcp.1test.local
and
_sipfederationtls._tcp.2test.local
What effectively happens, is when someone on the outside tries to IM
[email protected], their Lync edge server will see the 1test.local and query the appropriate above record for it so it knows where to communicate.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications