Lync 2013 Server / Roles & Components

Lync
2013 Server / Roles & Components
Front End
User authentication and registration
Presence information and contact card exchange
Address book services and distribution list expansion
IM functionality, including multiparty IM conferences
Web conferencing, PSTN Dial-in conferencing and A/V conferencing (if deployed)
Application hosting, for both applications included with Lync Server (for example, Conferencing Attendant and Response Group application), and third-party applications
Primary store for user and conference data. Information about each user is replicated among Front End Servers in the pool
Optionally, Monitoring, to collect usage information in the form of call detail records (CDRs) and call error records (CERs). This information provides metrics about the quality of the media (audio and video) traversing your network for both Enterprise
Voice calls and A/V conferences.
Web components to supported web-based tasks such as web scheduler and join launcher.
One Front End pool runs the Central Management Server DB, which manages and deploys basic configuration data to all servers running Lync
Optionally, Archiving, to archive IM communications and meeting content for compliance reasons.
Optionally, if Persistent chat is enabled, Persistent Chat Web Services for Chat Room Management and Persistent Chat Web Services for File Upload/Download.
Back End
Database server running Microsoft SQL Server
Provide the DB services for the Front End pool
Acts as backup store for the pool’s user and conference data
Primary stores for other DB’s like Response Group
High Availability for the BE DB is provided via SQL Mirroring
Optional Witness to enable automatic failover for BE
SQL Sever 2008 R2 or higher required for SQL Mirroring
Edge Server
Enable users to communicate and collaborate with users outside the organization’s firewall
Comprises four separate server roles
Access Edge – Acts as a secure proxy for all remote Lync signaling traffic
Remote Access
Federation
Public IM Connectivity (PIC)
Web Conferencing Edge – Enable remote users to participate in Web conferences with internal or remote workers
A/V Edge – Responsible for secure relay of A/V media among internal, external, and federated contacts
XMPP Gateway – Allows IM/P with XMPP federated contacts
Reverse Proxy
Simple URL Publishing – Required for users to join Lync meetings
Web Conferencing Content – Users download meeting content (PowerPoint, Whiteboard, and Poll data) via Lync Web Services when in meeting
Address Book & Distribution List Expansion – Required for users to download Lync Address Book and perform DL expansion
User Certificates – Provides client certificate authentication via Lync Web Services
Device Updates – Provides software updates to Lync IP endpoints
Mobility – Provides connectivity for mobile clients via Lync Web Services
Mediation Server
Translates signaling and media between Lync Server and PSTN, IP-PBX, or SIP Trunk
Can be co-located on Front End or separated as stand-alone Server dependent on call volume
Role facilitates dial-in conferencing
Capacity
Co-located = 150 Concurrent Calls
Standalone = 1100 Concurrent Calls
Persistent Chat
Enable users to participate in multiparty, topic-based conversations that persist over time
Pchat Front End server role runs persistent chat service
Pchat Back End server stores chat content and compliance events
Geographic DR is provided via stretched pool and SQL log shipping to replicate DB info
150k provisioned users / 80k concurrent users
Archiving
Uses SQL Server 2008 R2 or SQL Server 2012 for DB
Capable of archiving the following:
Peer-to-peer IM
Multiparty IM
Web Conferences, including uploaded content and events
A/V for peer-to-peer IM and web conferences
Web conferencing annotations and polls
Monitoring
Agent that runs on each Front End Server that collects and manages information from the Front End and Mediation Servers
Stored on SQL Server DB
Leverages SQL Server Reporting Services for creation of reports related to call quality and metrics
Office Web Apps Server
External server leveraged for rendering PowerPoint slides within the Lync client and Lync Web App
Typically leveraged within SharePoint deployments to deliver browser-based versions of Microsoft Office applications
System Center Ops Mgr
Health configuration in Lync Server 2013 is built around System Center Operations Manager and the use of Lync Server Management Packs. These Management Packs include a number of new features and enhancements, including:
Feature
Description
Synthetic Transactions
Windows PowerShell cmdlets that can be run from various locations to ensure that end user scenarios such as sign-in, presence, IM, and conferencing are readily available to end users.
Call Reliability Alerts
Database queries for Call Detail Records (CDR). These records are written by Front End Servers to reflect whether end users were able to connect to a call or why a call was terminated. These queries result in alerts that indicate when a wide range of end
users are experiencing connectivity issues for peer-to-peer calls or basic conferencing functionality.
Media Quality Alerts
Database queries that look at Quality of Experience (QoE) reports published by clients at the end of each call. These queries result in alerts that pinpoint scenarios where users are likely to be experiencing poor media quality during calls and conferences.
The data is built upon key metrics such as packet latency and loss, metrics that are known to directly contribute to call quality.
Component Health
Individual server components raise alerts by using event logs and performance counters. These alerts indicate failure conditions that can severely impact one or more end user scenarios. These alerts can also indicate a variety of other failure conditions,
including services not running, high failure rates, high message latency, or connectivity issues.
Dependency Health
Failures can occur for a variety of external reasons. The management packs now monitor and collect data for some of the critical external dependencies that might indicate severe issues, including IIS availability, CPU and memory usage of servers and processes,
and disk metrics.
Exchange UM
http://www.contactcenterarchitects.com/lync-2013-server-roles-components/

Hi,
Thank you for sharing the information. It is useful for others who not understand Lync Server Roles and Components. You time and effort are appreciated.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Similar Messages

Iphone and ipad Lync Client Randomly cannot sign in to Lync 2013 Server

I have a Lync 2013 environment that will allow all clients to connect from inside and outside of the network except for ios devices. iOS devices are sometimes able to connect and sometimes not. When they are not able to sign in they receive a message stating,
"An Error Occurred in Lync. Please retry. If the problem persists, contact your support department"
I have run tests using the Microsoft Remote Connectivity Analyzer and all tests come back green. I have also used the Lync Connectivity Analyzer and get the results below:
Starting Lync server autodiscovery
Starting automatic discovery for secure (HTTPS) internal channel
Server discovery failed for secured internal channel against
https://lyncdiscoverinternal.earenfroe.com/
Starting automatic discovery for unsecure (HTTP) internal channel
Server discovery failed for unsecured internal channel against
http://lyncdiscoverinternal.earenfroe.com/
Starting automatic discovery for secure (HTTPS) external channel
Server discovery succeeded for secure (HTTPS) external channel against URL
https://lyncdiscover.earenfroe.com/
Starting automatic discovery for unsecure (HTTP) external channel
Server discovery failed for unsecured external channel against
http://lyncdiscover.earenfroe.com/
Starting the requirement tests for Lync Mobile 2013 App
Starting tests for Mobility (UCWA) service
Completed tests for Mobility (UCWA) service
Your deployment meets the minimum requirements for Lync Mobile 2013 App.
Anyone have any suggestions on where to go next? Troubleshooting an intermittent connection issue that only affects one mobile platform is tough...especially when all the testing tools say everything is configured correctly :)
Thanks in advance!
Tom

I have the same problem, and we have netscaller as revrse proxy solution and we have the required records created for mobility.
with lync2010 mobility it is working fine, but with lync 2013 mobiltity we have intermittent issue with error e2-3-33 error
raghu
I had the same problem (e2-3-33 on mobile devices at random times) and it turns out it was McAfee antivirus causing the UCWA service to crash repeatedly. The workaround for it is outlined in the below blog entry I found as well as the below Microsoft document.
Long story short you want to run follow the steps outlined in the workaround section below (I copied it from the linked MSFT document)
http://support.microsoft.com/kb/2997513
http://lynclounge.blogspot.com/2014/07/lync-mobility-issues-event-ids-1309.html
WORKAROUND
he following procedures must be performed on all Lync Server 2013 FE server and Director Lync 2013 server roles. To
perform these procedures, first open a command prompt as an administrator.
Windows Server 2008 R2
On the Start menu, type cmd.exe in the Windows search feature, and then press Enter.
Right-click cmd.exe, and then click Run as administrator.
Windows Server 2012
Press the Windows key to access the Start page.
Use the Windows search feature to locate cmd.exe.
Right-click cmd.exe, and then click Run as administrator.
In the Command Prompt window, follow these steps:
Navigate to the %install drive%:\Windows\System32\inetsrv> directory prompt.
Enter the following command, and then press Enter:
appcmd set config /section:applicationPools /[name='LyncUcwa'].recycling.disallowOverlappingRotation:true
Enter the following command, and then press Enter:
appcmd set config /section:applicationPools /[name='LyncUcwa'].processModel.shutdownTimeLimit:0.00:00:30
To confirm the changes from steps 2–3, enter the following command, and then press Enter:
appcmd list apppools lyncucwa /config
The following information should be returned to the console to confirm the update to the LyncUcwa application pool
settings:
<add name="LyncUcwa" autoStart="true" managedRuntimeVersion="v4.0" managedPipelneMode="Integrated" startMode="AlwaysRunning">
<processModel identityType="NetworkService" idleTimeout="00:00:00" shutdownTieLimit="00:00:30" />
<recycling disallowOverlappingRotation="true">
<periodicRestart time="00:00:00">
<schedule>
</schedule>
</periodicRestart>
</recycling>
<failure />
<cpu />
</add>

Lync 2013 client is deployed but user accounts are not migrated from OCS to Lync 2013 Server - how to open Lync meetings automatically in the Lync Web Plug-in

We have in our enterprise the following scenario:
1 - Lync 2013 client is installed
2 - User accounts are not migrated to Lync 2013 Server, users are using Office Communicator as their main tool
3 - Users receive Lync 2013 meeting requests but when try to access them, Lync 2013 client launches and shows error. Users will need to open the browser and paste the URL to the address bar but this still open
4 - We cannot use the workaround of adding "?SL=1" to the Lync 2013 meeting URL as the user base is large and manual workaround is not accepted
5 - Question: is there any automated way, via egistry key or GPO setting, so that users temporarily (until their accounts are migrated to Lync 2013 server) can bypass Lync 2013 client completely and automatically open all Lync 2013 meetings
on the browser, using Lync Web Plug-in?

Thanks for the response,
First, I should have mentioned clearly that users have Office Communicator 2007 client and Lync 2013 client installed in their machines. Their accounts are not migrated yet to Lync 2013 server.
Second, we are using IE9 and IE10. The issue is that users CAN join Lync 2013 meetings with their browsers but have to paste the URL manually to browser and add "?SL=1" otherwise, if they just click at the "Join Online Meeting" or "Join
Lync Meeting" URL it launches Lync 2013 client which shows error because is not configured yet, as they are using OCS client and migrating slowly to Lync 2013 server.
Is there a Group Policy setting or a registry key from Microsoft that can be turned on to these users machines and make will all Lync meeting requests to be opened in IE browser instead of Lync 2013 client. We need a way to ignore
Lync 2013 client until user accounts are migrated to Lync 2013 Server. Manually typing URLs is not an option in a big organization, can't explain thousands of users of different levels what to do.
We are regretting the decision not to separate Lync 2013 from Office 2013 package we deployed recently. If Lync 2013 is uninstalled then all Lync meeting requests are opened in browser without an issue.

What are the ports required for the Audio, Video and A/V conferencing when the following end points are enabled for QoS in Lync 2013 server?

Hi All,
What are the ports required for the Audio, Video and A/V conferencing when the following clients are enabled for QoS in Lync 2013 server?
Client Type
Port range and Protocol required for Audio
Port range and Protocol required for
Video
Port range and Protocol required for
A/Vconferencing
Windows Desktop Client
Windows mobile App
Iphone
Ipad
Andriod phone
Andriod Tablet
MAC desktop client
Please advise. Many Thanks.

Out of the box, 1024-65535 for all of the client ports. :)
https://technet.microsoft.com/en-us/library/gg398833.aspx
You'll want to tune your client ports a bit
https://technet.microsoft.com/en-us/library/jj204760.aspx as seen here, and then the client ports would use those ranges which is easier to set QoS markings. I'm not sure the mobile clients respect that setting.
Elan's got the best writeup for Windows clients here:
http://www.shudnow.net/2013/02/16/enabling-qos-for-lync-server-2013-and-various-clients-part-1/
However, the marking of the packets is the tricky part. Windows can do it via Group Policy, but for the other clients you'll need to have the network specifically prioritize ports regardless of DSCP markings. You have to do it based on ports
as the traffic could be peer to peer.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Lync 2011 for MAC and Lync 2013 Server Std

Hello,
We are using a Lync 2013 Std (single-server) as a POC. It works fine for Windows-clients but I cannot connect using Lync 2011 for MAC from any MAC machine.
Using automatic configuration, I cannot connect to the Lync server.
Using manual configuration (I tried putting in just the server name and adding port 5061 to it, both to no avail) I keep getting 'Sign in to Lync failed. Please verify your credentials and try again.'.
Lync server is on the latest CU version with all components, MAC clients are on update 140321.
I noticed that Lync tries to create the OC_keycontainer_username@domain, but it seems not te be created. It flashes by and disappears again when the client fails to login. I have imported the Lync server certificate, issued by our windows 2012
root CA, on the Mac clients and have stored it in the 'Login' container.
Does anybody know if Lync2011 for Mac is supported for use with Lync server 2013 Std?
Cheers

Hi,
To clear cached data and corrupted certificates in Lync, you can do the following steps:
First, delete the following folders:
Users/Home Folder/Library/Caches/com.microsoft.Lync
Users/Home Folder/Documents/Microsoft User Data/Microsoft Lync History
Then, delete any corrupted or cached certificates. To do this, follow these steps:
1. Open the Keychain Access certificate management utility. To do this, in Finder, click Applications, click Utilities, and then click Keychain Access. Or, search for Keychain Access by using Spotlight.
2. In the left pane, click login, and then click Certificates.
3. In the right pane, find a certificate that's named Unknown or Communications Server, select it, and then delete it.
Note: You may have to unlock your keychain by using your password.
4. Close Keychain Access.
5. Restart Lync for Mac.
You can refer to Lync Mac for Lync Server online, but similar for Lync on-premises:
http://support.microsoft.com/kb/2629861
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Cannot share desktop - Lync 2013 server and Windows 8 (64-bit) client

Currently my new Lync server cannot share a desktop through a Lync 2013 client installed on a Windows 8 workstation. The client is patched up with the latest MS patches (much beyond the patch issues noted about a year ago, the patches in question do not
even show up as installed).
I get the same "An error occurred during the screen presentation" message. I do have a NVIDIA video cards on the workstations, but they too are patched up. The same systems have no issues sharing desktop screens in the Lync 2013 client on Windows
8 systems when they are connected to a Lync 2010 server.
I have no idea where to go from here. Any suggestions or help is greatly appreciated.

Did this issue happen to other Lync 2013 client?
As you mentioned that you can used the same Lync 2013 to sharing desktop screen when it connects Lync Server 2010 while you couldn’t share desktop screen when it connects to Lync Server 2013,
I think it is related with Lync Server.
Please check if you can find any errors on Lync Front End Server.
Check all Lync server services are all started.
Lisa Zheng
TechNet Community Support

Lync 2013 Edge server compatibility with Lyn 2010 Front end Pool

Hi All,
Technet article (http://technet.microsoft.com/en-us/library/jj688121.aspx) says the following:
If your legacy Lync Server 2010 Edge Server is configured to use the same FQDN for the Access Edge service, Web Conferencing Edge service, and the A/V Edge service, the procedures in this section are not supported. If the
legacy Edge services are configured to use the same FQDN, you must first migrate all your users from Lync Server 2010 to Lync Server 2013, then decommission the Lync Server 2010 Edge Server before enabling federation on the Lync Server 2013 Edge Server.
Can you tell me why it is you have to change the External Lync Web services URL during a migration to Lync 2013 from Lync 2010. What purpose does this serve?
Also can you clarify this and explain why this is required, why would you have to migrate all of your users, would a Lync 2013 Edge not talk to a Lync 2010 front-end?
Any help would be much appreciated. MANY THANKS.

Thank you very much for all your inputs.
We still have few questions:
Questions:
Can you tell me if Lync 2010 users will be able to login using mobility if we repoint the reverse proxy (TMG) web services publishing rule to the Lync 2013 server? Remember both systems Lync 2010 and 2013 are using the same web
services URL so they will both end up at the Lync 2013 server. Alternatively if not we will migrate all users to 2013, this is not a problem
In addition to this I cannot find anything that states how Exchange UM will operate when you are running from a backup pool and the exchange UM contacts are not available because they are homed on the server that is down. This
configuration is 2 x standard edition servers pool paired. How can we make sure Exchange voice mail works during a pool failover?
Call Park is not clear to me I read the following:
Lync Server 2013 provides new disaster recovery mechanisms in the form of failover and failback processes. These failover and failback processes support recovery of Call Park functionality by allowing
users who are homed in the primary pool to leverage the Call Park application of the backup pool when an outage occurs in the primary pool. Support for disaster recovery of the Call Park application is enabled as part of the configuration and deployment of
paired Front End pools.
Is this saying we need to deploy Call Park in the DR pool and use a different range of orbit numbers, or can we use the same range in the DR pool?
Further, I can see that Common Area Phones will be fine as they will log into the DR pool automatically. Response Groups need to be exported and imported to the DR pool. Incidentally these did not migrate well at all and have
caused us a big headache!
Any inputs will be greatly appreciated. Thanks again for all of your time.

Exchange Server 2013 Multi Role Server Hardware Setup

Is below a good ok setup for a multi role exchange server??
Any suggestions?
1.8TB of data (databases split to 18 databases at 100GB each), nightly archive runs so databases will not grow past 100GB each
25 GB of logs daily, logs cleared nightly by backup
Dell PowerEdge R620
Dual Xeon E5-2620
128GB RAM
Single PERC710P RAID Controller
10 x 900GB 10K RPM Drives (2 Volumes)
Volume 1: OS/Apps/Logs - 4 x 900GB, RAID 10 = 1.5TB
Volume 2: Databases - 6 x 900GB, RAID 10 = 2.5TB

Hi,
To get the multiple Exchange 2013 roles hardware requirements, I recommend you use Exchange 2013 Server Role Requirements Calculator:
http://blogs.technet.com/b/exchange/archive/2013/05/14/released-exchange-2013-server-role-requirements-calculator.aspx
If you have any question, please feel free to let me know.
Best regards,
Angela Shi
TechNet Community Support

Lync 2013 Clients in Child Domain Log "The server returned HTTP status code '403 (0x193)' with text 'Forbidden'."

Hey All, I am really stumped on this one.
Environment - Is using split DNS
Forest Root Domain - Contains new Lync 2013 Server Standard, ADDS, DNS, Enterprise CA, Workstations
Clients in this domain connect and work beautifully. No errors.
Child Domain - ADDS, DNS, Workstation, Lync 2013 client
Client autodiscovers, and then asks for a password. Enter the password and this comes up...
Can't sign in to Lync, You didnt get signed in, It might be your sign-in address or logon credentials.. blah blah blah"
Client log shows
Error:
There was an error communicating with the endpoint at 'https://domainlync13srv.Domain.net/WebTicket/WebTicketService.svc'.
The server returned HTTP status code '403 (0x193)' with text 'Forbidden'.
The server understood the request, but cannot fulfill it.
As far as i can tell certificates are correctly configured with all the SAN's possible in my forest. The user is correctly set up in Lync control panel. Autodiscovery seems to be working as it should. EWS is working correctly.
Repaired client, removed cached creds, has all lync 2013 updates no dice
Thank you all!

I am an IDIOT.
I did not prepare the child domain with the LYNC setup tool. Logged on to a file server in the child domain with domain admin rights and sure enough the setup said the domain was "partial". Ran the setup and bam it all started working.

Lync 2013 Edge & Web proxy

Hi Everyone
I'm having a little trouble getting my head around the setup for Lync external access.
I have setup an ADFS server, Lync 2013 server(works internally), 2012 web proxy server(doing nothing) and an edge server(currently doing nothing).
My understanding is that the Edge and Web proxy server are in "parallel", I.E, they both face the WAN as they perform different tasks.
The problem I have is that I'm unsure how to map everything correctly, I also don't understand how an external Lync client will get it's config. If my domain setup is:
something.domain.internal, and I would like to register a DNS entry externally as something.domain.external. How do I map those correctly via the web proxy and edge server? Sending the request via the firewall is easy enough, however I'm unsure how I'm supposed
to define them on my servers. Is the Lync server supposed to know about the external URL? Or does it not care?

Hi,
The Edge Servers run the services that allow external access to IM and presence, conferencing, audio/video, and other media services. You can also configure the Edge Server to federate with other Lync Server and other XMPP deployments.
Lync Server uses the reverse proxy to publish a number of features, such as conferencing meetings, conference join locations, the address book, distribution list expansion, downloading meeting content, device updates, Mobility services, and more. Any reverse
proxy that can meet the requirements for publishing the necessary resource locations can be used.
You just need to define the Edge information in topology builder and publish it. Then configure the server as defined in topology and install local configuration store, setup Lync components and assign certificate. Here is a topology that
using private IP addresses and NAT.
http://technet.microsoft.com/en-us/library/gg399001.aspx
Here are other resource how to publish Lync Server web services
http://blogs.technet.com/b/dodeitte/archive/2013/10/29/how-to-publish-lync-server-2013-web-services-with-windows-server-2012-r2-web-application-proxy.aspx
https://social.technet.microsoft.com/wiki/contents/articles/9807.how-to-configure-forefront-tmg-2010-as-reverse-proxy-for-lync-server-2010.aspx
Kent Huang
TechNet Community Support

Lync 2013 mobile sign in error

I try sign in to Lync in my Windows Phone, and get error - Check my password. My password correct. For diagnose I enable "Failed Request Tracing Rules" on IIS on Lync 2013 Server and view only one warning from DirectoryListingModule - HttpStatus
403 Forbidden. I try reinstall web components on Server but no relult. How I can fix this?
If I create file "C:\Program Files\Microsoft Lync Server 2013\Web Components\External Website\default.aspx", I view blank page for
https://lyncdiscover.mydomain.com
If I enable Directory Browsing for Lync Server External Web Site, I view folder content for
https://lyncdiscover.mydomain.com and in "Failed Request Tracing Logs" I see OCSAuthModule - HttpStatus 401 Unauthorized

Hi,
The error message indicate the client is having an issue authenticating with Lync Server 2013. Please double check that Authentication Delegation is verified on the reverse proxy publishing rule configuration.
Client may authenticate directly. If the reverse proxy publishing rules are set to No delegate and client cannot authenticate directly, it fails to sign-in when it reaches the step to provide credentials to request a token after MEX retrieval.
More details you can refer to the link below, it is for Lync server 2010 but similar for Lync server 2013:
http://blogs.technet.com/b/nexthop/archive/2012/02/21/troubleshooting-external-lync-mobility-connectivity-issues-step-by-step.aspx
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Lync 2013 client installation using SCCM

Hi everyone,
I have been performed Office 2013 installation in my domain. For this puprpose, I used SCCM 2007 R3.
At the beginning I customized this installation using OCT. I have excluded Lync from my Office 2013 distribution package, because we use Communicator Server 2007. Afterwards, I found that it is possible to use Lync 2013 with OCS 2007: http://www.technipages.com/lync-2013-fix-cannot-sign-in-because-the-server-version-is-incompatible-with-microsoft-lync-error.html
How can I silently deploy Lync on workstations, which already have received Office 2013 without Lync? If I simply try to add Lync feature in my package using OCT, silent installation stops on "Add/remove/repair components..." (which,
we, of course, cannot see during a silent setup).

You could utilize Config.xml to deploy Lync client. This will make installation silently.
http://technet.microsoft.com/en-us/library/jj204651.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.
Hi Juke,
Thanks for you answer. But actually not all is clear for me. In this article, I can see this:
"By default, the Config.xml file that is stored in the core product folder (for example, \product.WW) directs Setup to install that product. For example, the Config.xml file in the following folder installs Lync 2013:
\\server\share\Lync15\Lync.WW \Config.xml"
But in my Office 2013 installation folder, the Lync.WW folder does not exist.
Should I create it (and Config.xml too) manually? Can I remove other folders like Excel, Word from Office2013 installation folder?

Deploy Lync Edge Server.

Hi,
We have a Lync 2013 Server. We're plan to deploy a Lync Edge Server. I just read some articles about the depoyment. I'm wondering why Lync Edge Server cannot be installed on a server with one NIC. We've 1 firewall, configured with a interface in the
LAN subnet and a interface configured in the DMZ subet. I want to install the Lync Edge Server with one NIC configured in the DMZ subnet and route all the internal traffic trought the firewall. But none of the articles recommend this scenario. Why not?

Hi,
You're Lync 2013 Edge server requires two network interfaces, each residing on a different subnet - this part isn't debatable and is required in order to be a supported deployment (much less have it actually work). However its not uncommon to come across
your scenario.
As you only have a single firewall, your two options are;
1.) External interface of the Edge server in the existing DMZ subnet, and Internal interface of the edge server directly on the LAN. (this is the least preferred option of all scenarios, but is a supported topology)
2.) External interface of the Edge server in the existing DMZ subnet, and then create a second DMZ subnet to put the internal interface of the Edge server in. You would have to create an interface on your existing firewall in this subnet as well, essentially
routing traffic back to the same firewall hardware but via a different subnet. This is commonly referred to as a 'three-legged' firewall. From there the traffic can go to the LAN. This is also supported, and is more preferred than option one
The optimal solution, and the one you have probably seen in diagrams is to have back to back firewalls creating a true DMZ with the Edge server sat in between, The external interface of the edge server is on the same subnet as the internal facing adaptor
on the outer firewall, and the internal interface of the edge server is on the same subnet as the external facing adaptor of the inner firewall. This is the preferred solution, but not achievable in your current setup without the introduction of additional
components.
Of the two options applicable to you (1and2), option 2 is preferred. Both are considered less secure than option 3 from a security perspective as there is only a single firewall to breach, where as option three has layered security.
This is a very common scenario for smaller organisations - feel free to ask any further questions.
Kind regards
Ben
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems or queries.
For Fun: Gecko-Studio | For Work:
Nexus Open Systems

Lync 2013 Hosting

Hi,
I want to host a lync 2013 server for my external clients and users. What would be the considerations, and requirements and server roles to host a server?
My requirement is Web scheduling, meetings. Sharing, Text chats only for external users.
Now we have a local domain testdomain.local using Active Directory.
One live domain which is mydomain.com
Please suggest me the solution for Lync 2013 Hosting for external users.
Thanks

yes as Thamara said you have to install the Edge Role in order to login Externally.
check this for installing Edge server
http://social.technet.microsoft.com/wiki/contents/articles/16931.installing-lync-2013-edge-server.aspx
http://www.orcsweb.com/blog/cory-granata/installing-lync-2013-edge-server/
For installing Reverse proxy
http://blogs.technet.com/b/nexthop/archive/2013/02/19/using-iis-arr-as-a-reverse-proxy-for-lync-server-2013.aspx
http://jaapwesselius.com/2014/03/16/using-arr-for-reverse-proxy-with-lync-2013/
SAN
Certificate Requirements
check
for SAN certificate requirements for External access
https://technet.microsoft.com/en-us/library/gg398094.aspx
you required this names to be included in your san certificate
SN = sip.domain.com
SAN = meet.domain.com
SAN= admin.domain.com
SAN= dialin.domain.com
DNS
Records which needs to be created.
check
this for creating External DNS records.
https://technet.microsoft.com/en-us/library/gg398758.aspx
Check
this for adding Routable domain to Lync
http://blog.ucitsimple.com/2011/10/04/adding-new-sip-domains-to-lync/
For
detailed explanation check this great detailed blog how the Dns works for Internal domain and external domain. If your internal domain is different than external Domain
http://msunified.net/2013/08/07/lync-client-sign-in-and-dns-records-recommendations/
Whenever you see a helpful reply, click on Vote As Helpful & click on Mark As Answer if a post answers your question.

Lync 2013 Front End SIP/2.0 500 Compression algorithm refused

I've deployed a brand new Lync 2013 environment hosted on Windows Server 2012 R2 that is currently in co-existence mode with my Lync 2010 environment.
I have SCOM 2012 monitoring the environment and it recently started reporting that one or more of my front end servers
was in a critical state. Diving into it revealed the following perf counter threshold was being tripped:
Time Sampled: 3/26/2014 2:33:30 PM
Object Name: LS:SIP - Responses
Counter Name: SIP - Local 500 Responses
Instance Name:
First Value: 14287
Last Value: 14340
Delta Value: 53
Using OCSLOGGER.exe on the front end to capture logs, i trapped the following:
TL_INFO(TF_PROTOCOL) [11]9138.1C58::03/26/2014-19:12:39.098.0022c780 (SIPStack,SIPAdminLog::ProtocolRecord::Flush:ProtocolRecord.cpp(265))[120713120] $$begin_record
Trace-Correlation-Id: 120713120
Instance-Id: 7D80EB
Direction: outgoing;source="local"
Peer: poolA.contoso.com:63820
Message-Type: response
Start-Line: SIP/2.0 500 Compression algorithm refused
FROM: <sip:poolA.contoso.com>;ms-fe=FEserver1.contoso.com
To: <sip:poolA.contoso.com>;tag=F8B88CAB38613EB380773027C56D94AF
CALL-ID: 986f9f568c794ce39d33d7158376157b
CSEQ: 1 NEGOTIATE
Via: SIP/2.0/TLS 10.154.228.225:63820;ms-received-port=63820;ms-received-cid=C3D7C00
Content-Length: 0
ms-diagnostics: 2;reason="See response code and reason phrase";HRESULT="0xC3E93C0F(SIP_E_REACHED_CONFIGURED_LIMIT)";source="FEserver1.contoso.com"
Server: RTC/5.0
$$end_record
The only recent change made to the front end servers was making the registry change outlined in this article:
http://support.microsoft.com/kb/2901554/en-us so i'm wondering if that has something to do with it.

The MSFT support person said to re-apply CU5 to the Director servers and reboot. Since this is impactful to the environment and I would have to do reboots anyway, I opted to go the route of installing the more recent update so....
Last weekend I updated my Lync environment with what I think is considered CU6, the September 2014 updates for Lync 2013 Server (https://support.microsoft.com/kb/2809243) and still no luck. The front
end servers are fine; no excess SIP 500 errors occurring there but within 30 minutes of removing the SCOM override on the Director servers the alerts started firing again.
I reinstated the override in SCOM for the Directors and had my case with Premier support un-archived. The MSFT support person said if the alerts didn't go away she was going to have to engage the Lync product group for help. We'll see where it
goes from here.
JKuta

Lync 2013 Server / Roles & Components

Similar Messages

Maybe you are looking for