Should I use the “Use a single FQDN & IP Address.” option when deploying the Lync Server 2010 Edge Server?

I’ve been asked several times from various clients about whether they should use the Use a single FQDN & IP Address. feature:

… that Lync Server 2010 now provides when deploying an Edge server and as with any design questions, my answer is: “It depends.”  Since the answer doesn’t add much value, I’ve decided to write this blog post to outline the benefits and drawbacks of the 2 choices.  Note that the following are simply the ideas I have off the top of my head while writing this post and it most likely doesn’t cover all aspects but it should serve as a good start to knowing what the implications are.

Feature	Benefits	Drawbacks
Using a single FQDN & IP Address	Reduces the amount of public certificates or SAN entries for a certificate required for the Edge services. Reduces the amount of public DNS records required. Reduces the amount of public DNS records required. Cost savings for purchasing certificates and obtaining additional public IPs.	The use of non standard ports may cause connectivity problems from networks that block non standard ports.
Using multiple FQDN & IP Addresses	The ability to use standard ports (i.e. SSL 443 for all 3 services) will decrease the chances of connectivity problems from network that block non standard ports.	Increases the amount of public certificates or SAN entries for a certificate required for the Edge services. Increases the amount of public DNS records required. Increases the amount of public IPs required.

Restrictions when using a single FQDN & IP Address

The combination of FQDN and port number must be unique.

Restrictions when using multiple FQDN & IP Address

The combination of FQDN and port number must be unique.

 

So what would I recommend?  I almost always prefer to use multiple FQDN and IP addresses for the Edge services deployment because of the ability to use standard ports.  There have been many instances where I’ve worked at client offices where VPN through non-standard ports and MSN messenger doesn’t work but because my OCS / Lync client uses port 443, I was able to connect back to the office.  With that being said, I have done some small OCS 2007 R2 deployments in the past where the use of a single FQDN and IP address would have worked for the client because they may not readily have IP addresses available and they know that Edge will only be used by people working from home networks that don’t block any outbound ports.