Deploying Lync Server 2010 Edge Server

It’s been such a busy month with multiple projects on the go that I’ve only been able to whatever caught my eye on my long list of “to-blogs” so while I had these Edge server deployment screenshots for awhile, I never really got the chance to put them together for this post.  Now that I have a bit of time over the long weekend, I figure there’s no better way to spend it than to knock this one off my list. :)

Preparing the Edge Server

There are quite a few tasks required before you can actually begin installing Edge services onto the server you’ve allocated for this server role and the first item you should turn your attention to is the network interface configuration.  Make sure you have 2 NICs for your Edge server as shown in the following screenshot:



The NIC I’ve labeled Internal will be the NIC that is connected to your internal network while the NIC labeled Local Area Connection (sorry, I forgot to name it properly when I did the screenshot) will be the NIC that is connected to either your DMZ network or directly to the internet.
I was actually quite happy with the amount of detail in the documentation I saw in the LS_Deploy_Edge_Dir.doc document for the Set Up Network Interfaces for Edge Servers:

**How you configure your Edge server’s NICs will depend on your network topology such as whether there are DNS servers available in the perimeter network.



**Great note about not accessing the internal DNS servers as this is a security risk.



**I find static routes have always been one of the items administrators deploying Edge services tend to miss.  The Edge server will have 2 NICs and you can only assign 1 gateway to it which should be for your external interface and therefore getting to the internal subnets will require static persistent routes.



**If there are no DNS servers in the perimeter network then the host file will be used to resolve internal names.



External DMZ NIC Configuration

This is what the DMZ NIC settings for the Edge server looks like:



**Note: My apologies for the missing default gateway in the screenshot above.  The external DMZ NIC is supposed to be configured with a default gateway while the internal DMZ leg does not.

I always prefer to disable the Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks for the external network so there is less surface area for attacks.



Make sure you put the additional 3 IPs if the configuration will be multiple FQDN and IP addresses:



I prefer to uncheck the Register this connection’s addresses in DNS because the external DNS servers being public, will not allow you to register the server name anyways:



There is no reason to enable NetBIOS for the public interface:



Internal NIC Configuration

This is what the internal NIC settings for the Edge server looks like:



Internal DNS Resolution

Since the environment I’m using for this example does not have DNS servers in the perimeter network, I will be using the host file to resolve the internal Lync pool:





Since the Edge server is not a part of the domain, it will not register its name and IP in the internal DNS servers so in order for your internal pool to be able to look up the Edge server, you will need to create an A record manually:



Configure a DNS Suffix for the Edge Server

A DNS suffix is automatically added if a server is joined to the domain but since the Edge server isn’t and shouldn’t be, we will need to manually add it:















Installing .NET Framework 3.5.1 Features

As with other Lync server roles (i.e. front-end, monitoring), the Edge server will need .NET Framework 3.5.1 installed:





Import internal certificate authority’s root certificate

Domain joined servers automatically trust the domain’s enterprise certificate authority but since the Edge is not joined to the domain, you’ll need to manually export and import it:





Defining the Edge Topology

Once the Edge server has been configured, the next step is to define and then publish the topology:



Fire up Topology Builder:



Right click on the Edge pools folder and select New Edge Pool…:



The wizard to define a new edge pool will launch:



This example will demonstrate how to define a single computer pool:



Select the settings as it pertains to your environment:



**For more information about the Use a single FQDN & IP Address checkbox, see my previous post: http://terenceluk.blogspot.com/2011/02/should-i-use-use-single-fqdn-ip-address.html

For the purpose of this example, the Use a single FQDN & IP Address checkbox was no checked so fill in the appropriate FQDNs:



Specify the internal interface’s IP address:



Specify the external (or NAT-ed) IP addresses for SIP Access, Web Conferencing, and A/V Conferencing:



If you’ve selected the checkbox The external IP address of this Edge pool is translated by NAT:



Then you will now be asked for the public IP address:



Select the front-end pool in your environment:



You can then choose to associate the Edge server with your pool:



Clicking the Finish button will bring you back to the Topology Builder:



With the new topology defined, proceed with publishing it:









Exporting the Topology for the Edge Install

Since the Edge server is not a part of the domain, there is no easy way for it to download the topology during the install which is why we will need to manually export the topology on your front-end server and copy it over to the Edge server:



Open up the Lync Server Management Shell and execute:
Export-CsConfiguration -FileName <fileNameOfYourChoice.zip>



Copy the zip package to your Edge server:



Installing Edge Server

Launch setup.exe from the Lync installation binaries:











Choose Install or Update Lync Server System from the Deployment Wizard:



Select Install Local Configuration Store:



There is no option to retrieve the topology from the CMS because the Edge server is not joined to the domain so choose Import from a file and locate the zip package we copied over from the front-end server:













Once the local configuration store has been installed, proceed with step 2: Setup or Remove Lync Server Components:









Once the Edge server components has been installed continue with setting up the internal and external certificates:



Request and Assign a Certificate for the Internal Interface

The first certificate you’ll need is for the internal interface of the Edge server so select Edge internal and click on the Request button:





Select the Send the request immediately to an online certification authority:



Since the Edge server isn’t joined to the domain, the wizard will not be able to detect your internal CA:



What we’ll need to do is use the Specify another certification authority and manually type in the path to our internal CA.  Notice that the tip that existed with OCS 2007 R2’s wizard also no longer exists:



Specify the credentials that can request a certificate from your internal CA:



Using an alternate certificate template is not necessary so continue with the defaults:



Specify a friendly name for the certificate:



Fill in the information required for the certificate:





Unlike the front-end server deployment, the wizard doesn’t automatically populate additional entries for you:



I always prefer to put in the server name into the subject alternate name:



Review the summary:





--------------------------------------------------------------------------------------------------------------------------------------------------------------------

If you receive the following error message:

Command execution failed: Cannot connect to certificateAuthority.domain.com. Verify that you can connect to the server, have the appropriate permissions, and that you logged on with the correct credentials.



It’s most likely you’ve entered the incorrect credentials or you have network connectivity issues.  If you've configured the Edge server to use the host file to resolve internal server names, make sure you add an entry for your CA:



If you receive the following error after you’ve fixed the connectivity issues:
> Request CertificateRequest-CSCertificate -New -Type Internal -CA "venus.someDomain.com\Your CA X" -Country CA -State "Ontario" -City "Oakville" -FriendlyName "LyncEdge" -KeySize 2048 -PrivateKeyExportable $True -Organization "Your CA" -OU "IT" -DomainName "lyncedge" -CAAccount "domain\tluk" -CAPassword "****" -Verbose -Report "C:\Users\Administrator\AppData\Local\Temp\2\Request-CSCertificate-[2011_02_09][20_24_17].html"Creating new log file "C:\Users\Administrator\AppData\Local\Temp\2\Request-CSCertificate-b95d7045-45e6-4d35-a067-2f8e05ef5061.xml".Create a certificate request based on Lync Server configuration for this computer.A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. (Exception from HRESULT: 0x800B0109)The certificate was not imported.Issued thumbprint "" for use "Internal" by "venus.someDomain.com\Your CA X".Creating new log file "C:\Users\Administrator\AppData\Local\Temp\2\Request-CSCertificate-[2011_02_09][20_24_17].html".Warning: Request-CSCertificate failed.Warning: Detailed results can be found at "C:\Users\Administrator\AppData\Local\Temp\2\Request-CSCertificate-[2011_02_09][20_24_17].html".Command execution failed: Value cannot be null.Parameter name: thumbprint



See my previous post for the fix: http://terenceluk.blogspot.com/2011/02/requesting-lync-server-2010-edge.html

--------------------------------------------------------------------------------------------------------------------------------------------------------------------



Once the request completes, you can assign the certificate immediately to the internal interface:













Assign Certificates for the External Interface

Since the Lync Server 2010 Edge server I was deploying for this example is a replacement for another OCS 2007 R2 server, all that needs to be done is to export the 3 certificates (or 1 if it’s a SAN certificate) from the legacy OCS 2007 R2 server, import it onto the Lync Edge server and then assign it through the wizard.  If you’re using 1 certificate with multiple SAN entries for all 3 services, you can simply check the 3 checkboxes and assign the certificate.  If you’re using multiple certificates then you’ll need to assign them one after another:









--------------------------------------------------------------------------------------------------------------------------------------------------------------------

If you receive the following error:
> Assign CertificateSet-CSCertificate -Type AccessEdgeExternal,DataEdgeExternal,AudioVideoAuthentication -Thumbprint 3D38E6906DD8FB0B2D22E2B1F442543A16B60EA3 -Verbose -Confirm:$false -Report "C:\Users\Administrator\AppData\Local\Temp\2\Set-CSCertificate-[2011_02_09][21_20_06].html"Creating new log file "C:\Users\Administrator\AppData\Local\Temp\2\Set-CSCertificate-8db604ab-4bd7-4ede-a207-02df1c8e2ab3.xml".Assign the certificate to the Central Management Store.Creating new log file "C:\Users\Administrator\AppData\Local\Temp\2\Set-CSCertificate-[2011_02_09][21_20_06].html".Warning: Set-CSCertificate failed.Warning: Detailed results can be found at "C:\Users\Administrator\AppData\Local\Temp\2\Set-CSCertificate-[2011_02_09][21_20_06].html".Command execution failed: "3D38E6906DD8FB0B2D22E2B1F442543A16B60EA3" not found in MY certificate store or not trusted. To enable trust, install the root certificate in the Trusted Certification Authorities store.

 

See my previous post for the solution:  http://terenceluk.blogspot.com/2011/02/lync-server-2010-edge-server-public.html

--------------------------------------------------------------------------------------------------------------------------------------------------------------------





Once you’ve completed the assignment of certificates, you can proceed to start the Edge services:











… and now we’re done!