Lync Edge - Ports for internal NIC

Hello,
I know that Microsoft says that Edge should have 2 NICs where one is connected to DMZ, another one is connected to LAN. At the same time, all Microsoft diagrams show that Lync Edge is between two firewalls.
We have a client who insist that Lync Edge should not be connected directly to LAN, so we are trying to set it up using two different DMZ. The problem that I have is firewall ports. Different diagrams show me different ports, but none of them show me everything.
For example, what ports should be opened to request certificate for Internal CA? My firewall guy tells me that he opened ports 80 and 443 but Lync Wizard cannot connect to Internal CA.
Does anyone have a list of ports/protocols/directions that should be opened for Internal DMZ firewall?
Thank you. Eric.

To request certificate for Lync Edge server, you user Lync Wizard to create the certificate request file and request the certificate via the web to a Windows Server CA.
You need to open the port 80 and port 443 between Edge Server and Windows Server CA.
Microsoft diagrams only describe the traffic between Lync Edge Server and Front End Server.
Lisa Zheng
TechNet Community Support

Similar Messages

Lync Edge functional for external client but federation is not working

Hi,
I am working on Lync Edge Server from couple of weeks but unfortunately, I can't federate with Skype and other partners. First of all I want to mention following things:
1. Lync 2013 Front-End Server is fully functional for Internal Users
2. Lync 2013 Reverse Proxy is fully functional for Mobile Users
3. Lync 2013 Edge Server is fully functional for External Users except Federation.
Let me share Edge Server current configuration with you.
1. Lync Edge Pool have two NICs, Internal (Private IP) and External (3 Public IPs with default gateway and External DNS)
2. Host File have entries for Lync front-end server
3. Local CA certificate for Internal Interface and Starfield CA Certificate for External interface with required SAN e.g., acs.domain.com etc
4. Skype is searching my domain URIs but added contact is showing offline in skype
5. Lync 2013 Basic client is showing Presence Unknown for Skype contacts (Skype contacts already merged with Live ID)
6. Test-CSFederatedPartner cmdlet is also giving 504 error while testing from Front-end server.
This is production environment actually so please let me know if I am missing something.

Verify that you configure SRV Record on External DNS {SRV Record _sipfederationtls._tcp.<domain> on port 5061 and SRV Record _sip._tls.<domain> on port 443}
Also Verify that you enable lync federation on Lync topology and publish it
On a Front End server, open Topology Builder. Expand Edge pools, then right click your Edge server or Edge server pool. Select Edit properties.
In Edit Properties under General, select Enable federation for this Edge pool (Port 5061). Click OK.
Click Action, select Topology, select Publish. When prompted on Publish the topology, click Next. When the Publish is finished, click Finish.
On the Edge server, open the Lync Server Deployment wizard. Click Install or Update Lync Server System, then click Setup or Remove Lync Server Components. Click Run Again.
At Setup Lync Server components, click Next. The summary screen will show actions as they are executed. Once the deployment is done, click View Log to view available log files. Click Finish to complete the deployment.
For configuration of lync federation, you can check blow link
http://technet.microsoft.com/en-us/library/jj204800.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"

Lync edge server for site with 2500 users

Dear All,
I have a question with regards to the implementation of lync edge server deployment.
One of our client having lync deployment with 4000 users in a central site with 3 FE EE and edge pool with 2 Edge servers, there are planning for a new site with 2500 users.
what will be the best method for the site implementation , shall we deploy a SE Fe server and all the external communication through the Central site Edge server?
or is it required to have a separate pool for site?
please help me

Agree with the others. So, there's two questions, "what will be the best method for the site implementation?" and "is it required to have a separate pool for site?".
The best method I'd suggest is use Enterprise Edition Lync so you can perform pool pairing for resiliency, and have a local edge pool as the others suggested. You have enough users to support this, and with growth you might want to be able to scale
up anyway.
Is it required? Not at all. You can send them all through the central site edge server, it's possible and fully supported. It's up to you, but I'd suggest the separate pool.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

How Lync desktop sharing works for internal users

Hi,
How Lync desktop sharing, Aplication sharing & A/v conferencing works Internally ?
is it uses Webconfrencing Edge server & A/V Conf Edge server for internal users also...
I have confusion on this please help me and guide me how to deploy internally.
does it works with edge server internally if yes how ?
Thanks !!!

No internal to internal conferencing, A\V and desktop share does not use the Edge Server. This is all handled by the Front End Server\s.
For assistance on deploying please refer to http://gallery.technet.microsoft.com/Lync-Server-2012-9d6fe954
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Lync Sorted blog

Deploy Lync Edge Server.

Hi,
We have a Lync 2013 Server. We're plan to deploy a Lync Edge Server. I just read some articles about the depoyment. I'm wondering why Lync Edge Server cannot be installed on a server with one NIC. We've 1 firewall, configured with a interface in the
LAN subnet and a interface configured in the DMZ subet. I want to install the Lync Edge Server with one NIC configured in the DMZ subnet and route all the internal traffic trought the firewall. But none of the articles recommend this scenario. Why not?

Hi,
You're Lync 2013 Edge server requires two network interfaces, each residing on a different subnet - this part isn't debatable and is required in order to be a supported deployment (much less have it actually work). However its not uncommon to come across
your scenario.
As you only have a single firewall, your two options are;
1.) External interface of the Edge server in the existing DMZ subnet, and Internal interface of the edge server directly on the LAN. (this is the least preferred option of all scenarios, but is a supported topology)
2.) External interface of the Edge server in the existing DMZ subnet, and then create a second DMZ subnet to put the internal interface of the Edge server in. You would have to create an interface on your existing firewall in this subnet as well, essentially
routing traffic back to the same firewall hardware but via a different subnet. This is commonly referred to as a 'three-legged' firewall. From there the traffic can go to the LAN. This is also supported, and is more preferred than option one
The optimal solution, and the one you have probably seen in diagrams is to have back to back firewalls creating a true DMZ with the Edge server sat in between, The external interface of the edge server is on the same subnet as the internal facing adaptor
on the outer firewall, and the internal interface of the edge server is on the same subnet as the external facing adaptor of the inner firewall. This is the preferred solution, but not achievable in your current setup without the introduction of additional
components.
Of the two options applicable to you (1and2), option 2 is preferred. Both are considered less secure than option 3 from a security perspective as there is only a single firewall to breach, where as option three has layered security.
This is a very common scenario for smaller organisations - feel free to ask any further questions.
Kind regards
Ben
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems or queries.
For Fun: Gecko-Studio | For Work:
Nexus Open Systems

Can I leverage Skype Lync O365 integration for full phone system?

Have O365 enterprise and need new phone system for startup. Can I leverage Skype for voice account and leverage Lync/ exchange features together?
we are want no on premise environment.
can I do this without Lync server? if not, does Lync server exists as a subscription?
Layman's terms please.
thanks in advance!

The equipment needed is at minimum a Lync server (if you use a SIP trunk from an ITSP) otherwise you will also need a voice gateway. The license comes as part of an E4 subscription.
http://office.microsoft.com/en-us/business/office-365-enterprise-e4-business-software-FX104034562.aspx
Without knowing the requirements and scoping it out properly, based on you saying that it's a home office environment I'd be more inclined to use the ITSP.
If you scroll to the very bottom of the page I've linked to - you will see this: "Lync enterprise voice capabilities require a customer
to purchase and deploy Lync Server, either on-premises or in a hosted data-center, to enhance or replace traditional PBX systems"
If this helped you please click "Vote As Helpful" if it answered your question please click "Mark As Answer"
Georg Thomas | Lync MVP
Blog www.lynced.com.au | Twitter
@georgathomas
Lync Edge Port Check (Beta)

Lync edge and two NICs, DMZ and NAT

I am in the process of setting up my lync 2013 edge server and i seem to be stuck. We run a external firewall and an internal firewall and have a DMZ where all of my public facing servers sit that resides between these two I have things
like my webservers and edge transport for my exchange servers in here., I am in the process of creating my new edge pool topology and have a question. I am going to NAT my Edge servers from the external firewall so the public IP address is something
like 12.xx.xxx.xxx and then the DMZ subnet is 192.168.3.x. For my internal IP address I put the internal IP of my edge server which is 192.168.3.17 and for external setting i put the 12.xx.xxx.xxx IP address even though there is not a NIC in the edge
server that has that IP since it is NAT'd from my firewall. Will that work? The reason i ask is everyone seems to say that this edge server has to have two NICs that has one connected to my DMZ subnet and the other to my LAN subnet but doesn't
that mean you have a huge hole with a Windows server with one foot in the DMZ and the other in the LAN? Is htere a way to utilize only one NIC in an Edge server? I guess i am trying to see if it will work like the edge transport role in exchange.
thanks.

No, you shouldn't ever have an edge server with one foot in the DMZ and one foot in the LAN. That somewhat defeats the purpose of a DMZ since you've just created a path around your firewall. What you need is in effect two DMZs, one that communicates
only with the Internet, and one that communicates only with the internal network. This is where the two NICs come into play.
The external facing NIC would get private IPs typically (though they can be public) which are in turn NAT'd to public IPs. The topology builder knows about the private IPs, but for the A/V edge, there's also a section where you let it know that the
edge will be NAT'd and what the public IP for the A/V edge is.
You can get away with just one NIC, on just one subnet. People have had issues, and it's not supported, but I personally have gotten this to work without issue on several occasions.
So, if you simply can't have two DMZs, you could give the box one NIC and four IPs. 192.168.3.17, 18, 19, and 20. Assign 17 as the internal NIC, and 18, 19, and 20 as the access edge, web edge, and av edge. In the topology builder, specify
the 192.168.3.X addresses, but also put the 12.xx.xxx.xxx address in the public section. Put persistent routes on the box so that it knows to use the Internal firewall to get to internal addresses, and the default route should be the external firewall
(I suspect this is in place for other boxes in the DMZ unless they only talk to the Internet). Open your ports, add your DNS, install Lync and you should be good.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

Lync edge internal Certificate

Hi guys, i have an interesting problem. I'm switching my TMg server for a Palo Alto server, and when i do an external test, it fails and its showing my internal cert not the SAN certificate bound to the external dmz nic, and yes i've reassigned the certs
multiple times to make sure.
Any one ever see anything like this. works perfectly on TMG :|

I have 1 Lync Standard Frontend and 1 Edge, the edge server has 2 NICs, 1 internal and 1 in the DMZ with three IPs and 1 to 1 NAT. It has static routes for the internal network.
I'm aware there is no SAN requirement for internal. What i cant figure out is why externally tests are seeing the internal certificate.
Testing remote connectivity for user test@i*.com to the Microsoft Lync server.
Specified remote connectivity test(s) to Microsoft Lync server failed. See details below for specific failure reasons.
Additional Details
Elapsed Time: 16269 ms.
Test Steps
Attempting to resolve the host name sip.i*.com in DNS.
The host name resolved successfully.
Additional Details
IP addresses returned: 190.********
Elapsed Time: 186 ms.
Testing TCP port 443 on host sip.i*.com to ensure it's listening and open.
The port was opened successfully.
Additional Details
Elapsed Time: 193 ms.
Testing the SSL certificate to make sure it's valid.
The SSL certificate failed one or more certificate validation checks.
Additional Details
Elapsed Time: 15560 ms.
Test Steps
The Microsoft Connectivity Analyzer is attempting to obtain the SSL certificate from remote server sip.i*.com on port 443.
The Microsoft Connectivity Analyzer successfully obtained the remote SSL certificate.
Additional Details
Remote Certificate Subject: CN=cerberus.*.com, Issuer: CN=ICONS-CA, DC=i*, DC=com.
Elapsed Time: 15501 ms.
Validating the certificate name.
Certificate name validation failed.
<label for="testSelectWizard_ctl12_ctl06_ctl02_ctl01_tmmArrow">Tell
me more about this issue and how to resolve it</label>

Lync Edge and Proxy server public DNS records port forwarding rules

Hi All
I have question in regards to port forwarding rules for port 443 of simple url.
I have 4 public ip addresses.
1 edge server (4 nics , 3 running with different ip for sip, meet and dialin in DMZ network, 1 connected to internal local network).
1 proxy server (2 nics, 1 running with an ip which is in DMZ same as edge, and 1 connected to internal local network)
1 front end (lync 2013 standard installed.) connected to internal local network
1 office web apps . connected to internal local network
The question is that I am using 3 public ip addresses respectively on public DNS records for sip, meet and dialin(av) and using port 443 which has been set on edge server. So , I can use 3 DMZ network ip address on edge for sip, meet
and dialin (av) port forwarding from 3 public ip addresses as per in Microsoft document.
However, I also have a reverse proxy .Hence, my understanding is all public DNS records except SIP and port 443 should be pointed and port forwarded to reverse proxy ip address which is in DMZ network as it would redirect 443 and 80 to 4443 and 8080 to front
end.
Now the question has been clear, if simple URLs public DNS record and port forwarding rules for port 443 should be pointed to reverse proxy server, why they need to be set on each ip address and port number in Front end server topology to edge server?
If anyone knows, please give a help how to set it correct and what is supposed to be a correct configuration for a topology lync 2013

Hi George
Thanks for your reply. Attached is my topology which could make my it bit clear. You may see the public dns host record from the image. I set sip, meet, dialin , and owa 4 host records. The first 3 records are pointed to lync edge by doing a NAT with port
443 which is the same as per you said. However my understanding is they should be pointed to reverse proxy instead as for instance, I need meet.xxx.com with port 443 to be redirected to port 4443 through reverse proxy server to the front end. So when the external
customers who do not have lync client installed to their machine then we can shoot a lync meeting and send to them via outlook and they just need to click on join lync meeting link in the email to join in such a meeting based on IE. (Is my understanding correct?)
If lync web meeting works like so , then the question is why I need to set three SAME addresses in front end topology builder for edge and make them point to edge server instead?　
１. Access Edge service (SIP.XXX.COM) ---> I understand that it is used for external login lync front end.
2. Webconf edge server(Can I set to meet.xxx.com which is the same as simple URL that points to reverse proxy?) ----> If I can set this address to be the same as simple url address that points to reverse proxy, why should it need to be NATed to edge
instead? TO BE HONEST, if I HAVE tested, if I set this url as sip.xxx.com which means to use a single FQDN and ip address with port 444 and points simple url meet.xxx.com to reverse proxy, it will still work to join lync meeting sent by
outlook.I DO NOT REALLY UNDERSTAND WHAT this URL used for at this stage.
3. AV edge --- same as webconf
Regards
Wen Fei Cao

Clarification about source and destination IPs for internal clients and Edge server

I just wanted to get some clarification on the correct traffic flow between internal Lync clients and the Edge server.
From all the diagrams I've looked at I was under the impression that if internal clients need to hit the Edge server to talk to external clients they should always do so through the Edge Internal interface which bridges to the Edge External interface and
out to the internet. Specifically port 3478 from the Edge AV External interface to the internal clients.
We aren't seeing that in our environment. When internal clients are talking to external clients we see the Edge AV External interface communicating directly with the internal client. In fact we found this out because after the migration to Lync
2013 external users couldn't created a AV connection to internal users on either the Lync servers. We saw traffic on 3478 being dropped between the Edge AV External interface and the internal client. Once we opened that port AV traffic worked.
We never put this rule in until we introduced Lync 2013. Lync 2010 didn't seem to require it.
Is that the correct flow?

I would also really love to know the outcome of this but it looks like the thread is marked as "Answered" and it is not so.
I've been working with a troublesome Lync deployment in which internal users are having issues sharing their desktop with external and federated users. After opening up all the 50000-59999 range for TCP/UDP on the A/V Edge external interface things are working
much better, but we still see sporadic failures.
It lead us to start digging into the network traffic. We see that UDP traffic on port 3478 is being routed back from the external client to the Edge A/V's external interface, inside of the DMZ's perimeter, then directly to the internal client on the internal
network. It doesn't look like it's making a connection since the stream is so small, so I wonder if there is a design flaw in my topology?
There are persistent static routes on the Edge server that use the internal interface to route internally directed traffic over the internal gateway. Tracert confirms the flow, but in wireshark traces, running during successful connections, UDP port 3478
is still sending packets directly to the internal IP from Edge's A/V address.
We also see successfully connected sessions communicate on a different network route that we use to handle internet traffic rather than our Lync topology's route (the one defined for A/V traffic). The connection opens on ports in the 50000 range, but goes
over a router that we have not configured for such traffic. Is that possible?
Why is UDP traffic on 3478 trying to go directly to internal clients from external interface ?
It sounds like it's happening elsewhere... Is this a legitimate issue to be diagnosing? Has it been observed and/or resolved by others?

LYNC EDGE Server NIC Card Setup

Hello Guys,
I need Your help about setting up the NIC on my EDGE server. I already gone through the article about Set Up Network Interfaces for Edge Servers. as I understand there
are 2 NIC required on each EDGE server (1 Internal facing 7 another 1 is External facing). I just wanted to confirm is there any option to do this with only 1 NIC card or can we configure EDGE with 1 NIC only.?
Thanks in Advance.
Rishi Aggarwal
Regards Rishi Aggarwal

Possible? Yes, I do this on occasion against recommendations and best practices for companies who simply can't or won't set up a second DMZ (please don't split the NICs between your internal network and DMZ, it's just bad security). Everything
mostly seems to work just fine. But, recommended and supported? No.
Here's an article from David Paulino who's also been through it:
http://uclobby.com/2014/04/17/lync-edge-server-on-a-single-subnet/
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

DA server within a DMZ - ports needed for internal network

Hi,
I'm planning on adding a domain joined DA server in my DMZ. The DA server will have 2 NICs, one for the internal network and the other for the external. I'll be using two consecutive public IPv4 addresses.
On my external firewall I'll be opening the following ports for my DA server:
- Port 443 inbound and outbound
- UDP 3544 inbound and outbound.
On my Juniper firewall between the internal network and DMZ I'll be opening the following bi directional ports between my DC and DA server:
- IP Protocol 41 inbound and outbound.
TCP/UDP 53, 88, 3389, 389, 443, 445, 636, 3268, 3269
Am I right in thinking that in order for my DA clients to reach file shares (for example) I need to ensure that the required protocol and ports are open between my DA server and my file share (i.e. 443)? Doesn't this open a whole load of security holes?
Thanks
IT Support/Everything

Hi there - in a similar scenario on many customer sites i have done the following configurations on the Internal Firewalls
Internal IP of the DA Server ---> allow all traffic to selected VLAN's
The above rule is restricting traffic from the DA Server to the required VLAN's / Networks you specify, The reasoning being is that Direct Access requires full connectivity to your apps / infrastructure.
john davies

Lync Client uses wrong RTP Ports for calls from/to RGS with Agent Anonymity

We have QoS implemented and client ports for audio, video und application defined by Set-CsConferencingConfiguration. We also use firewalls in our LAN between the different VLANs for Clients, Servers and Gateways/SBC. Only RTP from the client with the defined
ports are allowed by the firewall. Media ByPass is enabled.
In all normal cases, the right ports will be used and marked by GPO with the right DSCP value. But if an agent get a call from a RGS which has agent anonymity enabled, the client uses a port in the range 1024-65535 for audio. Also if you make a call on behalf
of the RGS, the client use a random port between 1024-65535. As soon, as the source of the call is in another VLAN (e.g. a call from PSTN which comes in over a SBC in e separate VLAN), the firewall between the two VLANs block the RTP traffic.
We see the deny on the firewall log and in the SBC log we see, the reinvite for the media by pass with the IP of the agent and a not valid port. We also see, that no RTP from the client/agent will arrive the SBC and no RTP from the SBC will arrive the client/agent.
So the call will be disconnected, as soon as an agent wants accept the call.
Is there an additional setting to make sure, the Lync client always use the valid RTP port range?
This behavior exist in Lync 2010 and Lync 2013 clients.

Hi Holger,
Thanks for reply!
Sure! I set all AudioPorts on all Services, but the problem are not the ports used by the server, the problem are the ports used by the client. We set the client ports to 49152 with a count of 40. The client (2013 and also 2010) use these ports correctly in all
cases exept for call from/on behalf of an RGS with Agent Anonymity.
If we disable the RGS agent anonymity, restart the client of the agent, then the client uses also the correct source ports for RTP.
I've checked this behaviour now on 3 customer installations, our own productive installation and in our lab.
Because until now only one of our customers have firewalls between the internal VLANs, only this single customer have the issues...
Regards,
Stephan

M6800 disables internal NIC when "docked" in Port Replicator

When I "dock" my new Dell Precision M6800 laptop (i.e. place into a Port Replicator - either a Dell PR02X or PR03X - neither one works), the internal NIC is disabled and the only network connection available is through the wireless adapter. When not using the port replicator, the wireless adapter is turned off by the 'system' and the Ethernet LAN is connected as expected.
Both port replicators work fine with a different laptop (model M4600) and the M6800 connects properly when not using the port replicator. If I turn the wireless switch off and power up, I have no LAN connection at all.
I have downloaded and installed all the latest drivers from http://www.dell.com/support/home/us/en/04/product-support/product/precision-m6800-workstation
I have "Local Area Connection" above the Wireless adapter in "Adapters and Bindings"
I have also disabled all Power Management settings on the Ethernet Adapter.
System: Dell Precision M6800, Windows 7 Pro SP1 (64-bit), Intel Ethernet Connection I217-LM, Intel Dual Band Wireless-AC 7260, ...

Not sure if it applies to someone else, but I came upon this forum searching for a solution about my ethernet issues with the PR02x. (Ethernet port not working when connected to docking station)
Solution: Check the power supply of the docking station to see if it's comparable to the one supplied with the machine (12.3A @ 19.5 V Output). I replaced the power brick/adapter for the docking station and it works now.
Other solutions that I saw on another forum is adjusting the power management options for allowing it to turn off to save power or switching out the PR02x for the PR03x.
If I connected the ethernet cable directly to the back of the laptop, it would work. If I docked the laptop into a port replicator (with the same ethernet cable), it would only work on wifi only (wireless connection). If I connected the M6600 into the same port replicator, it would work with the ethernet connection (not wifi only).

Edge server for Lync 2013

Hi,
I have a lync server 2013 in my enviroment. Now users are accessing lync 2013 internally. i want to allow external users to access lync services like web scheduler etc. how we can configure edge server for lync 2013.
Thanks

Hi,
To install Edge Server follow this step by step guide
http://social.technet.microsoft.com/wiki/contents/articles/16931.installing-lync-2013-edge-server.aspx
http://www.orcsweb.com/blog/cory-granata/installing-lync-2013-edge-server/
Whenever you see a helpful reply, click on Vote As Helpful & click on Mark As Answer if a post answers your question.

Lync Edge - Ports for internal NIC

Similar Messages

Maybe you are looking for