Lync Server 2010 Deployment Guide Update

Posted By mikeshimkus on 05/11/2012 10:14 AM

 

Robert,

 

We've tested using APM for accessing simple URLs, and it's pretty straightforward. Unfortunately, as of right now we don't support authentication of the Lync client, which needs reverse proxy to download the address book, or Lync Mobility clients. If you wanted to secure the meeting and simple URLs with APM, you could simply create another virtual server to which DNS for those URLs points, apply your access policy to it, and make the internal reverse proxy virtual server the pool member.

 

Mike

 

 

Sorry Mike, just to be clear APM does not support authentication? Isn't that it's job (or at least pawn it off the AD servers)

 

 

 

 

 

Can you elaborate a little more on this please.

 

 

 

 

 

 

Thanks,

 

 

 

 

 

 

Bob James

 

 

APM does support authentication, but not for the Lync client or Lync Mobility. Much like Outlook Anywhere with APM, a specific iRule will need to be created to support authenticating these clients. A request has been created for this but I cannot tell you when it will be available, unfortunately.

Hi,

 

 

What's the default persistence set to for this? It seems to take 3-5 minutes for the clients to switch over to another FE server if one dies. Is this normal as per the client source affinity or cookie?

 

 

Thanks in advance, (And thanks Mike - too bad the sales force doesn't know this and are selling it as a solution)

 

 

Bob James

I'll check into why you were told APM fully supports Lync.

 

 

When you say your FE server dies, does it get marked down by the monitor? If so, the BIG-IP should instantly pick another pool member. If not, it could be a monitor issue. Can you post the config for the monitor in question?

 

 

I'll like to request that you open a support ticket for these issues. It'll help us track them and also help get these features into the product.

 

thanks

I have a ticket open. It's a pretty base config as we are only using the front end servers now. And the downloaded iAPP template. I've gone through the guide and verified all the settings but did notice there is no Oneconnect profile for 8080 as per the documents so I'm not sure if this is an issue or not, but the template didn't have one.

 

 

We tried stopping the services, shutting down the server and disabling it in monitoring. All with the same results. I feel this is normal behaviour based on using the template and all the setting.

 

 

We'll see what we find out tomorrow. Could also be a client setting for Lync which the server guyswill investigate.

 

 

Thanks,

 

 

Bob James

I searched for your ticket, but couldn't find it. Can you send me a private message on DevCentral with your case information?

 

thanks

We are working on deploying Lync in our firm and currently only have the FE servers LB with the f5.

 

 

When a user dials in for a conference and is asked to enter a conference ID; once they do sometimes it goes through and finds it fine. majority of the time there is a 8-10 sec delay and it occasionally can find it but usually after a delay we see a failure with a system message usually stating "sorry but I’m having trouble accessing the system"

 

 

Has anyone seen this? We have our f5 Field Engineer looking into it but currently we are not sure what is going on. I also have a support ticket open with some traces.

 

 

Thanks!

 

 

 

Shahram,

 

 

Could you please give us an update as to how your implementation turned out? I am also in a similar situation as you.. I need to use NAT'd IP's for the external edge roles.

 

 

Thanks,

 

 

Josh

Josh,

 

From what I have seen the external edge servers need a public IP (can't be Natted) because they present thei internal IP back to the Internet client. The first communication goes to the VIP then after load balancing the client may talk to the host. This is why MS says they have to be public IP's.

 

 

I have the NAT working on an older version but it's not officially supported.

 

 

Let me know if yours works externally

 

 

Bob James

Robert,

 

 

I have heard success stories from people using NAT, and the Topology builder actually allows you to specify a NAT address for the A/V role. I believe that the only real restriction for the A/V role is that you cannot use SNAT. This is a pretty good reference: http://www.shudnow.net/2012/04/25/lync-2010-edge-servers-and-ip-requirements-nat-vs-public-ip/

 

 

Still working on the config, but I'll update as soon as I get things working.

 

 

Josh