Publish Lync Externally without Reverse Proxy

Question

Hello All,
     Well let me start out by saying I'm well aware that publishing lync externally without a reverse proxy is not suggested due to security measures. To get to the point I have the following questions regarding setting this up. As of right now
I have lync fully working internally only. 
Here is my current setup
1 standard front end server with one nic card that has two ip addresses assigned to it and is signed with our internal CA,
I also have an edge server that has two interfaces. One interface is facing external with three public IP addresses with the AV one set as the primary, This interface has a public UC cert applied to it. The other interface is using a private ip address that
has a cert from our internal CA.
My questions are as follow
1. I currently have a GoDaddy UCC cert that allows me to have 5 San's. I'm trying to maximize this cert but am unsure of how to configure the SAN's. Which sans should be on the certificate so that I can use it for the edge server (av.domain.com/webconf.domain.com/access.domain.com)
and lync front end external cert (lync.domain.com and meet.domain.com). I also have a wildcard cert from GoDaddy for *.domain.com however I can not attach SAN's to it I was wondering if this could be used for meet.domain.com or autodiscover.domain.com?
2. Regarding external DNS entries so far I have the following:
webconf.domain.com -> to the ip for webconf on edge server public interface
av.domain.com -> to the ip for av on edge server public interface
access.domain.com -> to the IP for the access on edge server public interface
lync.domain.com -> to the IP configured for external access on the lync front end server ( I have configured IIS on this site to listen to port 80 and 443 as stated in Ken Lasko's blog post)
meet.domain.com -> to the IP configured for external access on the lync front end server
     Now my question is do i need to add the autodiscover.domain.com and if so where do I point this entry to? Also can how can I configure this setup to work with lync mobile device. 

Answer 1

As for the Reverse proxy if going that route:
External DNS
lyncdiscover.domain.edu -
Point to Reverse Proxy Public IP
lync.domain.edu (this is used as our external webservices url) -
Point to Reverse Proxy Public IP 
meeting.domain.edu (/meet and /dialin for the simple url's) - Point to Reverse Proxy Public IP
sip.domain.edu (this is currently pointing to our external edge server access ip) - Correct
av.domain.edu (this is currently pointing to our external edge server av ip) - Correct 
webcon.domain.edu (this is currently pointing to our external edge server webconf ip)  - Correct
Internal DNS
You should setup Split DNS or pinpoint zones as meet/Lyncdiscover/sip/dialin records should be created for the domain.edu: http://technet.microsoft.com/en-us/library/gg398758.aspx
Lyncdiscover.domain.edu - Not required Internally but should point to the private IP (external interface) of the Reverse
proxy to direct 443 to 4443.
lync.domain.edu -Point
to the private IP (external interface) of the Reverse proxy to direct 443 to 4443
Lyncdiscoverinternal.edu - pointed to front end server ip
meeting.domain.edu - pointed to front end server ip
lgcclync2013.domain.cc (this is our FE server) - pointed to our front ender server ip  - correct
Cisco ASAs don't allow hair-pining of the firewall this is why the internal dns needs to have the lync.domain.edu pointing to an internal IP that can redirect 443 to 4443
(reverse proxy) instead of pointing to the Public IP of the reverse proxy: http://technet.microsoft.com/en-us/library/hh690030.aspx
Hi Michael,
     Thank you for all your help. I've set up and configured both the external dns and the IIS ARR, but now I'm running into an error when I try to connect any of the following sites https://lyncdiscover.domain.edu, https://meeting.domain.com,
https://lync.domain.edu I get an Internal 500 error. When I check the Microsoft Remote Connectivity Analyzer under
Lync Autodiscover Web Service Remote Connectivity Test I get the following error
Testing HTTP authentication methods for URL https://lyncdiscover.domain.edu/Autodiscover/AutodiscoverService.svc/root/user.
HTTP authentication test failed.
Additional Details
An HTTP 500 response was returned from IIS7.
Headers received:
Content-Length: 1208
Content-Type: text/html
Date: Wed, 01 Jan 2014 14:56:12 GMT
Server: Microsoft-IIS/8.0
Elapsed Time: 286 ms.
I created 3 server farms on the IIS ARR sever
Lync.domain.edu which is being directed to lgcclync2013.domain.cc ports 8080 and 4443 LyncDiscover.domain.edu which is being directed to lgcclync2013.domain.cc ports 8080 and 4443                      
                              meeting.domain.edu which is being directed to lgcclync2013.domain.cc ports 8080 and 4443 When I ping lgcclync2013.domain.cc from the IIS Server it resolved
correctly to the right IP address.