Microsoft Skype for Business Server 2015

Hello LH, As far as the reverse proxy deployment goes, those objects are still tied together. The reason being is it is presenting the reverse proxy section as a whole. The objects created for reverse proxy are the same whether director role is enabled or not, the only difference is if director role is enabled then a pool is created based on the director pool member IP field in the iApp and the iRule attached to the 80/443(on external) VIP passes the majority of the traffic through to the director pool/big ip instead of the front end. Now the exception is when using split LTM's(as you are) where different sets of objects are created in different places. But in either case the only "dummy" fields would be including a front end fake pool member ip potentially, and depending on single/split some unnecessary LTM objects. But for reverse proxy this is not on our roadmap to break out.

In the case of the reverse proxy the best practice is to terminate SSL, this is for various reasons. So the iApp does require a valid cert and for ssl ports will use that cert selected.

For the 4443 objects not getting created, please download a slightly newer version of the rc posted here and retry, thanks! I was not able to reproduce the error you got about illegal sharing so if it still occurs with the new template then could you provide more details on the errors received?

Hi James, I have tried the latest version of the RC7 and with the version from afternoon 27.9.2016 everything seems to be OK. Both the missing Director 4443 issue and the illegal sharing issue while creating separate iApp just for the reverse proxy are gone.

It looks like I will split the config in 4 iApps (director, director_RP, frontend and frontend_RP), director iApps in one traffic group and frontend iApps in another one, which allows me the flexibility I wanted achieve.

thanks

LH

I was too fast :( the dummy FE IPs allowed to create the iApp for the director_RP config. But when I have tried to create the frontend_RP iApp, I got following error:

01070333:3: Virtual Server /Common/frontend_RP.app/frontend_RP_reverse_proxy_front_end_8080 illegally shares destination address, source address, and service port with Virtual Server /Common/frontend.app/frontend_front_end_ip_8080.

So I checked the frontend iApp and there is really an 8080 VS and pool, which isn't supposed to be there, unless I would have chosen to configure the reverse proxy section of the template, right?

regards

LH

The front end section of the iApp does in fact create a port 80 and port 8080 set of VS's and pools as part of the front end server services. So if you are trying to use the same IP for your front end VIP as well as the same IP for your RP reverse proxy virtual server in the secondary iApp then it will throw the error you got. You need to make sure each service has a unique IP preferably. Does that explain your issue?

Hi James, I think I understood the issue and that another IP would solve that. What I don't understand is why there is 8080 being created as part of the reverseproxy-less frontend iApp. IMHO the 8080 is supposed to be used just in the reverse proxy scenario.

regards

LH

Hello LH, If you take a look at the following link that shows the HLB ports for front end services it has 8080 on there for client/device retrieval of root certs. https://technet.microsoft.com/en-us/library/gg398833.aspx

So that is why the port exists, however the sharing issue you ran into is also fixed, please download the template and retry with shared IP's.

Thanks,

Hello James would it be possible to make the SIP monitor optional in future version? Some customers do use the iApp exclusively for Reverse Proxy and do not run sip services on their pool, which makes them remove the strict update and remove that monitor.

Thanks

Alex

Hello Amolari, This is not in our roadmap as of now... thanks for bringing this edge case to our attention though and we will log it for possible inclusion in future versions of the iApp as suggested.

Thanks,

Hello James, finally I have used the latest template, so I can confirm, there is no more a ilegal sharing error. But I have noticed that the name of the Virtual server is ending with _reverse_proxy_front_end_8081. Is this the solution or a typo? Also there is a double underscore in both the pool names.

thanks

LH

Correct, to fix the port sharing issue the solution(in this scenario of split LTM's and shared IP) will use 8081 in between the LTM's to carry that traffic, but front end and back end ports will stay as expected. Thanks for pointing out the double underscore.