Forum Discussion
Josh_41258
Jul 31, 2012Nimbostratus
Lync SSL Config
I'm using the newest deployment guide and iApp template for Lync 2010. I have a question regarding the "Front End Virtual Server" configuration in the iApp template. This section creates a VS on TCP/443 for the FE. The pool members are also 443. However, there are no SSL profiles assigned to the VS.
When I browse to the VS via HTTPS, I am presented the internal SSL certificate that IIS on the FE is using. Is this how the VS is supposed to be configured? Shouldn't it be using both client and server SSL profiles instead of just passing the encrypted data back to the FE servers?
Thanks,
Josh
- mikeshimkus_111Historic F5 AccountHi Josh, actually, because that traffic is SIP over port 443, there is no benefit in decrypting it. So it's more efficient simply to pass it through.
- Josh_41258NimbostratusMike,
- mikeshimkus_111Historic F5 AccountI'm sorry, I got confused for a minute. It's the Edge scenario where the Access service uses port 443 but is really SIP traffic, and web services go through the reverse proxy. Internally, you do want to hit the FE 443 VIP for web services, with the exception of Lync Mobility. If Mobility is configured to allow external clients, internal Mobility clients actually need to get directed to the external reverse proxy VIP.
- Josh_41258NimbostratusOk, so the "front_end_ip_443" VIP should be configured for pass-through SSL, and not have any SSL profiles assigned to it? No mobility here.
- mikeshimkus_111Historic F5 AccountThat's correct. IIRC, because Lync doesn't allow offloading SSL and there's little to gain from decrypt-reencrypt, we pass it through.
- Josh_41258NimbostratusMike,
- Ryan_Korock_46Historic F5 AccountFor the Lync Edge Services, *only* the Edge Servers need the cert/keys, and not the BIG-IP.
- Josh_41258NimbostratusRyan,
- Josh_41258NimbostratusWould someone mind clarifying the SSL settings on the reverse proxy external and internal VIPs? The iApp assigns serverssl and clientssl profiles to each, but the serverssl profiles don't actually have a key or cert assigned to them. Is this correct? In essence, this means that I could achieve the same effect by not applying any serverssl profile to either VIP, correct?
- mikeshimkus_111Historic F5 AccountThis is correct. The serverssl profiles do not require a cert or key. They are used by the BIG-IP to open an encrypted "client" connection to the pool members. If your servers are expecting an encrypted connection, the connection will fail unless you assign a serverssl profile to the VIP.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects