Determining Your Infrastructure Requirements for Microsoft Lync Server 2010

Published: September 2010

This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a non-disclosure agreement. Copyright © 2010 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, ActiveSync, ActiveX, Excel, Forefront, Groove, Hyper-V, Internet Explorer, Lync, MSDN, MSN, OneNote, Outlook, PowerPoint, RoundTable, SharePoint, Silverlight, SQL Server, Visio, Visual C++, Windows, Windows Media, Windows PowerShell, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners.

Contents
Determining Your Infrastructure Requirements............................................................................1 Determining Your System Requirements..................................................................................1 Hardware and Software Platform Requirements...................................................................1 Additional Software Requirements........................................................................................2 Network Infrastructure Requirements.......................................................................................4 Active Directory Domain Services Requirements, Support, and Topologies.............................6 Active Directory Domain Services Support...........................................................................6 Supported Active Directory Topologies..................................................................................7 Active Directory Infrastructure Requirements......................................................................12 Domain Name System (DNS) Requirements.........................................................................13 Determining DNS Requirements.........................................................................................14 DNS Requirements for Front End Pools.............................................................................17 DNS Requirements for Standard Edition Servers...............................................................20 DNS Requirements for Simple URLs..................................................................................21 DNS Requirements for Automatic Client Sign-In.................................................................23 Certificate Infrastructure Requirements..................................................................................25 Certificate Requirements for Internal Servers.....................................................................26 Certificate Requirements for External User Access............................................................31 Port Requirements.................................................................................................................33 Ports and Protocols.............................................................................................................33 IPsec Exceptions................................................................................................................44 Internet Information Services (IIS) Requirements...................................................................46 IIS Requirements for Front End Pools and Standard Edition Servers.................................47

Determining Your Infrastructure Requirements
You need to identify and understand the infrastructure requirements for your deployment, so you can plan how to meet those requirements before you deploy Microsoft Lync Server 2010 communications software. • • • • • • Network Infrastructure Requirements Active Directory Infrastructure Requirements Domain Name System (DNS) Requirements Certificate Infrastructure Requirements Port Requirements Internet Information Services (IIS) Requirements

Determining Your System Requirements
All servers running Microsoft Lync Server 2010 communications software must meet certain minimum system requirements. System requirements for Lync Server 2010 include the server hardware, the operating system to be installed on each server, and related software requirements, such as the Windows updates and other software that must be installed on the servers. Important: Lync Server 2010 is available only in a 64-bit edition, which requires 64-bit hardware and a 64-bit edition of Windows Server. A 32-bit edition of Lync Server 2010 is not available with this release. The exception is the Microsoft Lync Server 2010, Planning Tool, which is available in a 32-bit edition. • • Hardware and Software Platform Requirements Additional Software Requirements

Hardware and Software Platform Requirements
Platform requirements for Microsoft Lync Server 2010 communications software include the server hardware and the operating systems to be installed on the servers. These server requirements apply to each server on which you plan to deploy Lync Server 2010, including each Front End Server, each Edge Server, and each add additional Lync Server role. Server requirements also include the hardware and software for the database servers in your deployment, such as the Back End Server. For details about the supported platforms for servers in a physical topology and clients, see the Supported Hardware and Server and Tools Operating System Support sections in the Supportability documentation. For details about supported hardware for virtualized topologies, see Running in a Virtualized Environment in the Planning for Other Features documentation.

Determining Your Infrastructure Requirements for Microsoft Lync Server 2010

Note: For details about other system requirements for client computers and devices, see Client Software and Infrastructure Support in the Supportability documentation.

Additional Software Requirements
In addition to the hardware and operating system requirements for server platforms, Microsoft Lync Server 2010 communications software requires the installation of additional software on the servers you deploy. Note: For details about the platform requirements for Lync Server 2010 servers, see Hardware and Software Platform Requirements. For details about system requirements for client computers and devices, see the Planning for Clients and Devices documentation. Windows Update Requirements Before deploying Microsoft Lync Server 2010 communications software, you must install the following operating system updates: • Knowledge Base article 968929, "Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0)," at http://go.microsoft.com/fwlink/?linkid=197390 • For each server that has Internet Information Services (IIS) installed, you must install the following updates: • IIS URL Rewrite module at http://go.microsoft.com/fwlink/?linkid=197391 • IIS Application Request Routing module at http://go.microsoft.com/fwlink/? linkid=197392 Message Queuing Microsoft Lync Server 2010 communications software uses the Message Queuing (also known as MSMQ) technology with the following server roles: • • • • • Front End Server Mediation Server Archiving Server Monitoring Server A/V Conferencing Server

The Message Queuing service must be enabled on all servers prior to deploying any of the above listed server roles. Message Queuing can be installed as an optional feature in Windows Server 2008. Microsoft .NET Framework Requirements Microsoft .NET Framework 3.5 with SP1 is required for Microsoft Lync Server 2010. Setup prompts you to install this prerequisite, and it automatically installs it if it is not already installed on the computer. .NET Framework 4.0 can be installed on the same computer as well, but does not take the place of .NET Framework 3.5 with SP1, which is the required version for Lync Server 2010.

2

If you install Lync Server 2010 by using the Lync Server Deployment Wizard. We recommend that you install Windows Media Format Runtime before you install Microsoft Lync Server 2010 communications software. For details. The Windows Media Format Runtime is required to run the Windows Media Audio (WMA) files that these applications play for announcements and music.5 SP1 package.mum /ignorecheck 3 . Download the Microsoft .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Note: If you install Lync Server 2010 by using the command line. Announcement. To install the Windows Media Format Runtime on servers running Windows Server 2008 R2.NET Framework.exe /online /add-package /packagepath: %windir%\servicing\Packages\Microsoft-Windows-Media-FormatPackage~31bf3856ad364e35~amd64~~6. you must install Windows Media Format Runtime on Front End Servers. If you choose not to install it.microsoft. and Administration and Requirements for the Planning Tool sections.com/fwlink/?linkid=197399. you should immediately install the following updates: Additionally.NET 3.NET Framework 3. and it automatically installs it if it is not already installed on the computer. it will prompt you to install it and then you must restart the server to complete installation.5 with SP1. Publishing. use the following command: %systemroot%\system32\dism. see the Topology Builder Requirements for Installation. Setup prompts you to install this prerequisite.5 Service Pack 1 (Full Package) at http://go. If Lync Server 2010 does not find this software on the server. Lync Server 2010 only supports the 64-bit edition of the .16385. Notes: • After installing the .1. Download the Microsoft Visual C++ 2008 Redistributable Package (x64) at http://go.microsoft. Windows Media Format Runtime Requirements To use the Call Park. Microsoft Visual C++ 2008 Redistributable Package Requirements The Microsoft Visual C++ 2008 redistributable is required to run Microsoft Lync Server 2010 communications software. Setup terminates. and Response Group applications. you need to manually install this prerequisite on the server. as well as the appropriate updates.NET Framework 3.com/fwlink/?linkid=197398.7600. Note: If you install Lync Server 2010 by using the command line. you need to manually install this prerequisite on the server where you plan to install. installation of the administrative tools and the Planning Tool requires installation of Microsoft .

" at http://go. In general. and BITS 4. "Windows Management Framework (Windows PowerShell 2. whether the site has only a single Edge Server deployed or has multiple Edge Servers deployed).microsoft.exe /quiet /ip /m:%windir %\servicing\Packages\Microsoft-Windows-Media-FormatPackage~31bf3856ad364e35~amd64~~6. WinRM 2.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 To install the Windows Media Format Runtime on servers running Windows Server 2008. 4 .mum Windows PowerShell Version 2.5 Microsoft Lync Server 2010 communications software uses Windows Installer technology to install. servers should be in a network that supports 1 Gbps Ethernet or equivalent.0.0 Lync Server 2010 Management Shell is a management interface of Microsoft Lync Server 2010. you can integrate by using either T1/E1 lines or SIP trunking. Audio/Video Network Requirements Network requirements for audio/video in a Lync Server 2010 deployment include the following: • The external firewall can be configured as a NAT (that is.0.0.0.0).0. Windows Installer version 4. • In Front End pool topologies. For PSTN integration. use the following command: %systemroot%\system32\pkgmgr. most servers should be in a network that supports more than 1 Gbps. It requires Windows PowerShell command-line interface version 2. used to automate the administration of Lync Server 2010.18000.5 is available as a redistributable component for the Windows Server operating system. especially when supporting audio/video (A/V) conferencing and application sharing. uninstall. and maintain various server roles.com/fwlink/?linkid=197395. see Knowledge Base article 968929. For details about downloading Windows PowerShell version 2. as well as the server operating system.0. The size of the LAN is dependent on the size of the topology: • In Standard Edition topologies. Network Infrastructure Requirements The network adapter card of each server in the Microsoft Lync Server 2010 communications software topology must support at least 1 gigabit per second (Gbps).com/fwlink/?linkid=197390.5 from the Microsoft Download Center at http://go. For details about this requirement.microsoft. you should connect all server roles within the Lync Server 2010 topology using a low latency and high bandwidth local area network (LAN).6001. You must remove previous versions of Windows PowerShell prior to installing Windows PowerShell version 2. see Firewall and Port Requirements for External User Access in the Planning for External User Access documentation. Download Windows Installer 4. a scripting language and command-shell environment. Windows Installer Version 4.

• If you use IPsec. the ability of the Lync Server media endpoints to dynamically deal with varying network conditions (for example. we recommend disabling IPsec over the port ranges used for A/V traffic. and it is important to find and eliminate the weak points. Lync Server media endpoints can adapt to varying network conditions and support loads of three times the throughput (see previous paragraph) for audio and video while still retaining acceptable quality. Latency is the one network impairment that Lync Server media components cannot reduce. the media subsystem is designed to work within this existing infrastructure. In an under-provisioned network. during peak usage periods. at the cost of some reduction in the voice quality. 5 .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 • If your organization uses a Quality of Service (QoS) infrastructure. Conferencing Network Requirements The bandwidth that is used to download conference content from the IIS server depends on the size of the content that is uploaded. For details. Also. • Provision your network to ensure a maximum end-to-end delay (latency) of 150 milliseconds (ms) under peak load. • For links that cannot be correctly provisioned in the short term (for example a site with very poor WAN links). see IPsec Exceptions. do the following: • Provision your network links to support throughput of 45 kilobits per second (Kbps) per audio stream and 300 Kbps per video stream. you let the elasticity of the Lync Server media endpoints absorb the difference between that traffic volume and the peak traffic level. temporary high packet loss) is reduced. However. • To cope with unexpected spikes in traffic above this level and increased usage over time. if enabled. there is a decrease in the headroom otherwise available to absorb sudden peaks in traffic. do not assume that this adaptability will support an underprovisioned network. In this scenario. To ensure optimal media quality. • For network links where provisioning is extremely costly and difficult. consider disabling video for certain users. you may need to consider provisioning for a lower volume of traffic. A bidirectional audio or video session consists of two streams.

Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Active Directory Domain Services Requirements. Support. as well as Office Communications Server 2007 and Office Communications Server 2007 R2 schema extensions. For details about topology support. Lync Server 2010 still stores the following in AD DS: • Schema extensions • User object extensions • Extensions for Office Communications Server 2007 and Office Communications Server 2007 R2 classes to maintain backwards compatibility with previous supported versions • Data (stored in Lync Server extended schema and in existing classes) • User SIP URI and other user settings • Contact objects for applications (for example. much of this information is stored in the Central Management store instead of AD DS. the Response Group application and the Conferencing Attendant application) • • • Data published for backward compatibility A service connection point (SCP) for the Central Management store Kerberos Authentication Account (an optional computer object) This section describes the AD DS support requirements for Lync Server 2010. In Lync Server 2010. instead of relying on Active Directory Domain Services (AD DS) for this information as in previous versions. Supported Domain Controller Operating Systems Lync Server 2010 supports domain controllers running the following operating systems: • • • Windows Server 2008 R2 operating system Windows Server 2008 operating system Windows Server 2008 Enterprise 32-Bit 6 . In This Section • • • Active Directory Domain Services Support Supported Active Directory Topologies Active Directory Infrastructure Requirements Active Directory Domain Services Support Microsoft Lync Server 2010 communications software uses the Central Management store to store configuration data for servers and services. but User object schema extensions. and Topologies Previous versions of Office Communications Server relied on Active Directory Domain Services (AD DS) to store all global settings and groups necessary for the deployment and management of Office Communications Server. see Supported Active Directory Topologies. are still stored in AD DS.

or at least Windows Server 2003.microsoft. Windows Server 2008. Users and Computer objects are often placed in specific organizational units (OUs) with permissions inheritance disabled to help secure administrative delegation and to enable use of Group Policy objects (GPOs) to enforce security policies. Supported Active Directory Topologies Microsoft Lync Server 2010 communications software supports the same Active Directory Domain Services (AD DS) topologies as Microsoft Office Communications Server 2007 R2 and Microsoft Office Communications Server 2007.local is supported. Support for Read-Only Domain Controllers Lync Server 2010 supports Active Directory Domain Services (AD DS) deployments that include read-only domain controllers or read-only global catalog servers. All forests in which you deploy Lync Server 2010 must be raised to a forest functional level of Windows Server 2008 R2. For details. at http://go. see "Preparing a Locked Down Active Directory Domain Services" in the Deployment documentation. but a root domain named local is not supported. For example.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 • • The 32-bit or 64-bit versions of the Windows Server 2003 R2 operating system The 32-bit or 64-bit versions of the Windows Server 2003 Forest and Domain Functional Level You must raise all domains in which you deploy Lync Server 2010 to a domain functional level of Windows Server 2008 R2. “Information about configuring Windows for domains with single-label DNS names”. as long as there are writable domain controllers available. a forest with a root domain named contoso. Windows Server 2008. The following topologies are supported: • • • • • Single forest with single domain Single forest with a single tree and multiple domains Single forest with multiple trees and disjoint namespaces Multiple forests in a central forest topology Multiple forests in a resource forest topology The following figure identifies the icons used in the illustrations in this section. 7 .com/fwlink/?LinkId=143752. see the Knowledge Based article. or at least Windows Server 2003. Domain Names Lync Server does not support single-labeled domains. For details about what is required to deploy Lync Server in a locked-down environment. Locked Down AD DS Environments In a locked-down AD DS environment. Lync Server 2010 can be deployed in a locked-down Active Directory environment.

you must deploy all the Front End Servers in the pool within a single domain. The following figure illustrates a Lync Server deployment in a single domain Active Directory topology. the domain where you create users can be different from the domain where you deploy Lync Server. Multiple Domains Another Active Directory topology supported by Lync Server is a single forest that consists of a root domain and one or more child domains. if you deploy a Front End pool. a user icon shows the domain where the user account is homed. However. a single domain forest. is a common topology. Lync Server support for Windows universal administrator groups enables cross-domain administration. Single domain topology Single Forest. In this type of Active Directory topology. User accounts include the following: • • User accounts within the same domain as the Lync Server pool User accounts in a different domain from the Lync Server pool 8 .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Key to topology illustrations Single Forest. and the arrow points to the domain where the Lync Server pool resides. In this figure. Single Domain The simplest Active Directory topology supported by Lync Server 2010. The following figure illustrates a deployment in a single forest with multiple domains.

The following figure illustrates a single forest with multiple trees. a solid line points to a Lync Server pool that resides in the same or a different domain. In this figure.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 • User accounts in a child domain of the domain with the Lync Server pool Single forest with multiple domains Single Forest. a user icon shows the domain where the user account is homed. Multiple Trees A multiple-tree forest topology consists of two or more domains that define independent tree structures and separate Active Directory namespaces. and a dashed line points to Lync Server pool that resides in a different tree. User accounts include the following: • • • User accounts within the same domain as the Lync Server pool User accounts in a different domain from (but the same tree as) the Lync Server pool User accounts in a different tree from the Lync Server pool 9 .

the directory synchronization product synchronizes the corresponding contact in the central forest.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Single forest with multiple trees Multiple Forests. and each user-only domain. Microsoft Forefront Identity Manager (FIM) 2010. which is in a separate forest. The following figure illustrates a central forest topology. The schema in the separate user forests does not need to be extended. or Microsoft Identity Lifecycle Manager (ILM) 2007 Feature Pack 1 (FP1). The central forest also hosts user accounts for any users in this forest. Users can search for and communicate with other users in any forest. such as Microsoft Identity Integration Server (MIIS). • The directory synchronization product automates the addition and deletion of contact objects in the central forest as user accounts are created or removed. In this figure. there are two-way trust relationships between the domain that hosts Lync Server. Central forest topologies use contact objects in the central forest to represent users in the other forests. Users can view presence of other users in any forest. which is in the central forest. manages the life cycle of user accounts within the organization: When a new user account is created in one of the forests or a user account is deleted from a forest. Central Forest Lync Server 2010 supports multiple forests that are configured in a central forest topology. A central forest has the following advantages: • • • Lync Server servers are centralized within a single forest. A directory synchronization product. 10 .

one forest is dedicated to running server applications.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Central forest topology Multiple Forests. When a new user account is created in one of the user forests or a user account is deleted from a forest. Microsoft Forefront Identity Manager (FIM) 2010. you create one disabled user object in the resource forest for every user account in the user forests. The resource forest hosts the server applications and a synchronized representation of the active user object. This topology provides the benefit of limiting the need to extend the Active Directory schema to a single forest (that is. The user forests have a forest-level trust relationship with the resource forest. Resource Forest In a resource forest topology. 11 . manages the life cycle of user accounts. If Microsoft Exchange is already deployed in the resource forest. The following diagram illustrates a resource forest topology. the disabled user accounts might already exist. such as Microsoft Exchange Server and Lync Server. the resource forest). such as MIIS. or Microsoft Identity Lifecycle Manager (ILM) 2007 Feature Pack 1 (FP1). The resource forest acts as a shared services environment for the other forests where user objsects reside. Companies that need to isolate Active Directory administration for security reasons often choose this topology. When you deploy Lync Server in this type of topology. the directory synchronization product synchronizes the corresponding user representation in the resource forest. This topology can be used to provide a shared infrastructure for services in organizations that manage multiple forests or to separate the administration of Active Directory objects from other administration. but it does not contain logon-enabled user accounts. A directory synchronization product.

or Windows Server 2003. ensure that your Active Directory infrastructure meets the following prerequisites: • All domain controllers (which includes all global catalog servers) in the forest where you deploy Lync Server 2010 run Windows Server 2008 R2 operating system.microsoft. see "Raising domain and forest functional levels" at http://go. Lync Server 2010 supports the universal groups in the Windows Server 2008 and Windows Server 2003 operating systems. Members of universal groups can include other groups and accounts from any domain in the domain tree or forest and can be assigned permissions in any 12 . Windows Server 2008. Windows Server 2008. the 32-bit or 64-bit versions of the Windows Server 2003 R2 operating system. • All domains in which you deploy Lync Server 2010 are raised to a domain functional level of Windows Server 2008 R2.com/fwlink/?LinkId=125762. Windows Server 2008 Enterprise 32-Bit.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Resource forest topology Active Directory Infrastructure Requirements Before you start the process of preparing Active Directory Domain Services (AD DS) for Microsoft Lync Server 2010 communications software. • The forest in which you deploy Lync Server 2010 is raised to a forest functional level of Windows Server 2008 R2. Windows Server 2008 operating system. or the 32-bit or 64-bit versions of the Windows Server 2003 operating system. or Windows Server 2003. Note: To change your domain or forest functional level.

if your organization wants to support it). Domain Name System (DNS) Requirements To deploy Microsoft Lync Server 2010 communications software. • To allow unified communications (UC) devices that are not logged on to discover the Front End pool or Standard Edition server running Device Update Service. and support for automatic client sign-in (that is. and send logs. it is not necessary to add one domain to another to enable an administrator to manage both. • To allow clients to discover the Front End pool or Standard Edition server used for various SIP transactions. Microsoft Lync Server 2010 communications software uses Domain Name System (DNS) in the following ways: • To discover internal servers or pools for server-to-server communications. simplifies the management of a Lync Server deployment. you must create Domain Name System (DNS) records that enable the discovery of clients and servers. combined with administrator delegation.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 domain in the domain tree or forest. • • • • • Determining DNS Requirements DNS Requirements for Front End Pools DNS Requirements for Standard Edition Servers DNS Requirements for Simple URLs DNS Requirements for Automatic Client Sign-In 13 . obtain updates. • To allow external servers and clients to connect to Edge Servers or the HTTP reverse proxy for instant messaging (IM) or conferencing. • To allow external UC devices to connect to Device Update Service through Edge Servers or the HTTP reverse proxy and obtain updates. For example. Universal group support.

Determining DNS Requirements Flow Chart 14 .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Determining DNS Requirements Use the following flow chart to determine Domain Name System (DNS) requirements.

the term split-brain DNS means the following (using contoso.com However.com for which it is authoritative The internal contoso._tcp SRV record is created in the external DNS contoso.com as an example): Internal DNS: • • Contains a DNS zone called contoso. _sipinternaltls.com.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Split-Brain DNS Like network address translation (NAT). then automatic configuration of the Lync 2010 client will work fine as long as the _sipinternaltls. For this document.com. For example.com • All Lync Server 2010 servers and clients running Microsoft Lync 2010 in the corporate network point to the internal DNS servers for resolving queries to contoso.com zone. If automatic configuration is required for Lync clients.com.com._tcp. if split-brain DNS is not in use then client automatic configuration will not work unless one of the workarounds described below is implemented. Edge Server in the perimeter network • DNS A records for the reverse proxy internal interface of each reverse proxy server in the perimeter network • All Lync Server 2010 servers in the perimeter network point to the internal DNS servers for resolving queries to contoso. 86400 IN SRV 0 0 5061 sip.com zone contains: • DNS A and SRV records for all servers running Microsoft Lync Server 2010 communications software in the corporate network • DNS A and SRV records for the Edge internal interface of each Lync Server 2010.contoso.com zone contains: • DNS A and SRV records for Lync 2010 client auto configuration (optional) • DNS A and SRV records for the Edge external interface of each Lync Server 2010.com.com the first SRV record will work for automatic configuration as follows: _sipinternaltls. the term split-brain DNS is defined several different ways. This was also the case with earlier versions of Communicator. This is because Lync 2010 requires that the domain of the target host match the domain of the user’s SIP URI._tcp. this record will not be used by Lync for automatic configuration even though it is a valid SRV record because the client’s SIP domain is contoso. not litwareinc.litwareinc.contoso.com for which it is authoritative The external contoso.contoso.com External DNS: • • Contains a DNS zone called contoso. Edge Server in the perimeter network • DNS A records for the reverse proxy external interface of each reverse proxy server in the perimeter network Automatic Configuration without Split-Brain DNS If split-brain DNS is used. 86400 IN SRV 0 0 5061 sip. However. if a user signs in as cstest01@contoso. 15 . select one of the following options: • Put host records on each client machine.

168. If that fails.10.92 • Then.com.10.com.91 192.com.com.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 • Use Group Policy objects (GPOs) to populate the correct server values.10.com. if there are three front end servers in a pool named pool01.microsoft. /dsprimary dnscmd .168.10. @ A 192. create a DNS A record for pool01.net but signs into Lync as cstest01@contoso.contoso. a SIP XXX error is returned). • If you are creating an entire zone in the internal DNS is not an option.com pool01.com 192. • If it gets to the end without a successful connection.contoso.contoso. • Create a . @ SRV 0 0 5061 access. • If the SIP REGISTER attempt fails (for example. /zoneadd access. (for example.contoso.168.contoso. /dsprimary dnscmd . see http://go. the client tries the next IP address in its cache.com pool01.contoso. the client attempts to connect to the front end server a SIP REGISTER.contoso.com. but it does automate the process of manual configuration. Note: This option does not enable automatic configuration._tcp.com.com. For example. the SRV records associated with automatic configuration are not required. /zoneadd _sipinternaltls. the client has intelligence built in to try each subsequent IP address in its cache. and cache them as follows: pool01.168.contoso.90 192. tries to connect to a server in a pool by connecting to one of the IP addresses resulting from the DNS A query for the pool fully qualified domain name (FQDN).168. dnscmd .10. • If the TCP SYN request succeeds. /recordadd access. @ A 192.contoso. a Lync 2010 client or SIP server). /recordadd access. the user is notified that no Lync Server 2010 servers are available at the moment. and populate those zones using dnscmd. the following will happen: • The Lync 2010 client will query DNS for pool01.com/fwlink/?LinkId=200707. For example. create an internal DNS zone called contoso. DNS Load Balancing DNS load balancing is typically implemented at the application level.91 For details. if a user is homed on pool01. 16 ._tcp.com and inside it.90 dnscmd . so if this approach is used.contoso.contoso.com zone in the internal DNS that matches the external DNS zone and create DNS A records corresponding to the Lync Server 2010 pool used for automatic configuration.exe as follows: dnscmd .com.com and get back three IP addresses (not necessarily in this order). /recordadd _sipinternaltls.contoso. the client attempts to establish a Transmission Control Protocol (TCP) connection to one of the IP addresses in its cache using a TCP SYN request. The application.contoso. you can create dedicated zones that correspond to the SRV records that are required for automatic configuration.

Therefore. If multiple DNS SRV records with equal priority and weight are returned. Response Group application. and Call Park application) • • • Draining of UCAS applications Load balancing server-to-server (as well as client-to-server) connections for SIP traffic Load balancing client to Web Conferencing Edge traffic • Load balancing other HTTP(s) traffic between server running Lync Server (for example. with a different IP being returned every time a DNS A record query is resolved by the DNS Server. DNS Requirements for a Front End Pool Deployment scenario DNS requirement Front End pool with multiple Front End Servers and a hardware load balancer (whether or not DNS load balancing is also deployed on that pool) An internal A record that resolves the fully qualified domain name (FQDN) of the Front End pool to the virtual IP (VIP) address of the load balancer. DNS Requirements for Front End Pools This section describes the Domain Name System (DNS) records that are required for deployment of Front End pools. the connection fails. DNS Records for Front End Pools The following table specifies DNS requirements for a Microsoft Lync Server 2010 Front End pool deployment.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Note: DNS-based load balancing is different from DNS round robin (DNS RR) which typically refers to load balancing by relying on DNS to provide one IP address corresponding to one of the servers in a pool. DNS load balancing is used for the following: • Load balancing Lync Server SIP servers (for example. Focus) DNS load balancing cannot be used for the following: • • DCOM traffic Client-to-server web traffic If multiple DNS records are returned to a DNS SRV query. Typically DNS RR only enables load balancing. but does not enable failover. the Access Edge service always picks the DNS SRV record with the lowest numerical priority and highest numerical weight. if the connection to the one IP address returned by the DNS A query fails. the Access Edge service will pick the SRV record that came back first from the DNS server. Director and Access Edge) • Load balancing Unified Communications Application Services (UCAS) applications (for example. For example. DNS round robin is less reliable than DNS-based load balancing. Lync Server Registrar. Microsoft Lync 2010 Attendant. 17 .

A set of internal A records that resolve the FQDN of each server in the pool to the IP address of that server. see Updating Devices in the Planning for Clients and Devices documentation. Important: If you have an existing deployment of Windows Server Update Services (WSUS) in Microsoft Office Communications Server 2007. For details. For details. An internal A record with the name ucupdatesr2. An internal A record that resolves the FQDN of the Front End pool to the IP address of the single Enterprise Edition Front End server. but a user has never logged into the device. There must one A record for each server in the pool. see DNS Load Balancing in the Planning for Other Features documentation. see DNS Requirements for Automatic Client Sign-In. In the situation where an UC device is turned on.<domain> over port 5061 that maps to the FQDN of the Front End pool that authenticates and redirects client requests for sign-in.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Deployment scenario DNS requirement Front End pool with DNS load balancing deployed A set of internal A records that resolve the FQDN of the pool to the IP address of each server in the pool. devices obtain this information though in-band provisioning the first time a user logs in. For details. the A record allows the device to discover the Front End pool hosting Device Update Service and obtain updates. Otherwise. For each supported SIP domain._tcp. an SRV record for _sipinternaltls. Front End pool with DNS load balancing deployed Front End pool with a single Front End Server and a dedicated Back-End Database but no load balancer An internal URL for conferencing that is different from the default pool FQDN An internal A record that resolves the host name portion of the URL to the virtual IP of the conferencing load balancer (or single Front End Server if appropriate). you Automatic client sign-in Device Update Service discovery by unified communications (UC) devices 18 .<SIP domain> that resolves to the IP address of the Front End pool that hosts the Device Update Service.

19 .contoso.contoso. webcon. see Determining DNS Requirements. In this case. DNS A record for webcon.com ee-pool.com that resolves to the VIP address of the load balancer used by the Front End Servers.com DNS A record for eepool.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Deployment scenario DNS requirement have already created an internal A record with the name ucupdates.contoso.contoso.com ee-pool. The following table shows an example of the DNS records required for the internal Web farm FQDN. For Microsoft Office Communications Server 2007 R2. For details.contoso.contoso.<SIP domain>. A reverse proxy to support HTTP traffic An external A record that resolves the external Web farm FQDN to the external IP address of the reverse proxy. the load balancer distributes SIP traffic to the Front End Servers and HTTP(S) traffic to the Web Components Servers.com DNS A record for the eepool. you must create an additional DNS A record with the name ucupdates-r2. Example DNS Records for Internal Web Farm FQDN Internal Web farm FQDN Pool FQDN DNS A record(s) ee-pool.contoso.<SIP domain>. Clients and UC devices use this record to connect to the reverse proxy.com that resolves to the VIP address of the load balancer used by the Web Components Servers.com that resolves to the virtual IP (VIP) address of the load balancer used by the Enterprise Edition Front End Servers in the Front End pool.

see Updating Devices in the Planning for Clients and Devices documentation. the A record allows the device to discover the server hosting Device Update Service and obtain updates.<domain> over port 5061 that maps to the FQDN of the Standard Edition server that authenticates and redirects client requests for sign-in.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 DNS Requirements for Standard Edition Servers This section describes the Domain Name System (DNS) records that are required for deployment of Standard Edition servers. you must create an additional DNS A record with the name ucupdates-r2. but a user has never logged into the device.<SIP domain>. For each supported SIP domain. For details.<SIP domain>. Automatic client sign-in Device Update Service discovery by unified communications (UC) devices 20 . see DNS Requirements for Automatic Client Sign-In. you have already created an internal A record with the name ucupdates. devices obtain the server information though in-band provisioning the first time a user logs in. Otherwise. an SRV record for _sipinternaltls._tcp. In the situation where an UC device is turned on. For Office Communications Server 2007 R2. Important: If you have an existing deployment of Windows Server Update Services (WSUS) in Office Communications Server 2007. For details. DNS Requirements for a Standard Edition Server Deployment scenario DNS requirement Standard Edition server An internal A record that resolves the fully qualified domain name (FQDN) of the server to its IP address. DNS Records for Standard Edition Servers The following table specifies DNS requirements for Microsoft Lync Server 2010 Standard Edition server deployment. An internal A record with the name ucupdatesr2.<SIP domain> that resolves to the IP address of the Standard Edition server hosting Device Update Service.

the server that the DNS A record resolves to determines the correct client software to start. and the Admin simple URL is optional. For details. and Admin. The Domain Name System (DNS) records that you need to support simple URLs depend on how you have defined these simple URLs. DNS Requirements for Simple URLs Microsoft Lync Server 2010 communications software supports the following three simple URLs for conferencing: Meet. Clients and UC devices use this record to connect to the reverse proxy. After the client software is started.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Deployment scenario DNS requirement A reverse proxy to support HTTP traffic An external A record that resolves the external Web farm FQDN to the external IP address of the reverse proxy. users are directed to the appropriate server for meeting content no matter which server or pool the simple URL DNS A records resolve to. 21 . Simple URL Option 1 In Option 1. see Determining DNS Requirements. you create a new SIP domain name for each simple URL. You are required to set up simple URLs for Meet and Dial-In. Note: When a user clicks a simple URL meeting link. it automatically communicates with the pool where the conference is hosted. Dial-In. There are three different ways you can define the URLs. This way.

the DNS A record must resolve to the IP address of one Standard Edition server in your organization. 22 . Simple URL Option 2 With Option 2. Alternatively.contoso. If you have more than one SIP domain in your organization and you use this option. which resolves lync. you will create DNS A records for both https://meet. you must create Meet simple URLs for each SIP domain and you need a DNS A record for each Meet simple URL. the DNS A record must resolve to the IP address of one Standard Edition server in your organization. It requires a DNS A record that resolves the URL to the virtual IP (VIP) address of a Front End pool. you need a DNS A record that resolves the URL to the IP address of the Director. and so on (one for each SIP domain in your organization) https://dialin.com https://admin.com. If you have not deployed a pool and are using a Standard Edition server deployment. it should resolve to the IP address of the load balancer of a Front End pool.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Simple URL Option 1 Simple URL Meet Example https://meet.com Dial-in Admin If you use Option 1. the DNS A record must resolve to the IP address of one Standard Edition server in your organization.com. if you have multiple SIP domains and you want to minimize the DNS record and certificate requirements for these simple URLs.fabrikam. Otherwise.com.contoso. Therefore. If you have not deployed a pool and are using a Standard Edition server deployment.com to the IP address of the load balancer of a Front End pool.contoso. you need a DNS A record that resolves the URL to the IP address of the Director.com.fabrikam. use Option 3 as described later in this topic.com. If you have not deployed a pool and are using a Standard Edition server deployment. the DNS A record must resolve to the IP address of one Standard Edition server in your organization.com and fabrikam. Otherwise. If you have not deployed a pool and are using a Standard Edition server deployment. • For the Dial-in simple URL.contoso. https://meet. you need only one DNS A record. if you have one deployed.contoso. if you have one deployed.contoso. • The Admin-in simple URL is internal only.com and https://meet. For example. all simple URLs are based on the domain name lync. if you have both contoso. it should resolve to the IP address of the load balancer of a Front End pool. you must define the following: • For each Meet simple URL.

or you can designate a dedicated server or pool for this purpose that hosts no users.com/contosoSIPdomain/Admin https://lync.com/contosoSIPdomain/Meet https://lync.fabrikam.contoso.com/fabrikamSIPdomain/ Dialin Admin https://lync. 23 . https://lync.contoso.com/fabrikamSIPdomain/Meet Dial-in https://lync. For high availability.contoso. • Create an internal DNS SRV record to support automatic client sign-in for this server or pool.com/fabrikamSIPdomain/Admin DNS Requirements for Automatic Client Sign-In This section explains the Domain Name System (DNS) records that are required for automatic client sign-in.contoso.contoso.com/contosoSIPdomain/Dialin https://lync.com/Meet. we recommend that you designate a Front End pool for this function.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Simple URL Option 2 Simple URL Meet Example https://lync. and so on (one for each SIP domain in your organization) https://lync.com/Admin Dial-in Admin Simple URL Option 3 Option 3 is most useful if you have many SIP domains. This can be an existing server or pool in your organization that hosts users. you can skip this topic.contoso. To support automatic client sign-in.contoso.contoso.com/Meet. you must: • Designate a single server or pool to distribute and authenticate client sign-in requests. If you plan to require your clients to connect manually to Microsoft Lync Server 2010 communications software. and you want them to have separate simple URLs but want to minimize the DNS record and certificate requirements for these simple URLs.com/Dialin https://lync. you can configure your clients to use automatic discovery to sign in to the appropriate Standard Edition server or Front End pool. Simple URL Option 3 Simple URL Meet Example https://lync. When you deploy your Standard Edition servers or Front End pools.contoso.

<domain> . For example. The following table shows some example records required for the fictitious company Contoso._tcp.com Note: By default.contoso.com pool01. For details about configuring SIP domains. see Operations.com._tcp. SIP domain refers to the host portion of the SIP URIs assigned to users. if SIP URIs are of the form *@contoso. Do not create this SRV record for additional internal servers or pools. Example of DNS Records Required for Automatic Client Sign-in with Multiple SIP Domains FQDN of Front End pool used to distribute sign-in requests SIP domain DNS SRV record pool01. queries for DNS records adhere to strict domain name matching between the domain in the user name and the SRV record.contoso. An organization can also support multiple SIP domains.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Note: In the following record requirements.for internal TCP connections (performed only if TCP is allowed) You only need to create a single SRV record for the Front End pool or Standard Edition server or that will distribute sign-in requests. see the Planning for Clients and Devices documentation.contoso.contoso.com retail. which supports SIP domains of contoso.contoso.com domain over port 5061 that maps to pool01.com is the SIP domain. you must create an internal DNS SRV record that maps one of the following records to the fully qualified domain name (FQDN) of the Front End pool or Standard Edition server that distributes sign-in requests from Lync clients: • _sipinternaltls.com domain over port 5061 that maps to pool01.com An SRV record for _sipinternaltls.contoso. For details._tcp. The SIP domain is often different from the internal Active Directory domain.contoso.contoso. Create only one SRV record for the designated server or pool. Important: Only a single Front End pool or Standard Edition server can be designated to distribute sign-in requests. <domain> .com. 24 . you can configure the DisableStrictDNSNaming Group Policy.com contoso.retail.for internal TLS connections • _sipinternal. To enable automatic configuration for your clients.com and retail._tcp. If you prefer that client DNS queries use suffix matching instead.com An SRV record for _sipinternaltls. contoso.

contoso. application sharing.com domain over port 5061 that maps to pool01. Auto-enrollment is supported for internal servers running Lync Server. 25 .com Front End pool must include the following in its Subject Alternative Name: • • sip.com Example of Required DNS Records If the administrator at Contoso configures pool01.contoso.com domain over port 5061 that maps to pool01. and conferencing For Lync Server 2010.contoso.com Certificate Infrastructure Requirements Microsoft Lync Server 2010 communications software requires a public key infrastructure (PKI) to support TLS and mutual TLS (MTLS) connections.contoso._tcp.retail. The Contoso organization supports the SIP domains of contoso.com as the pool that will distribute its sign-in requests. the following common requirements apply: • • • • All server certificates must support server authorization (Server EKU).Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Example of the Certificates and DNS Records Required for Automatic Client Sign-In This example uses the same example names in the preceding table. retail.contoso._tcp.com and retail.contoso.contoso. Auto-enrollment is not supported for Lync Server Edge Servers.com.contoso.contoso.com • SRV record for _sipinternaltls. Lync Server 2010 uses certificates for the following purposes: • • • • TLS connections between client and server MTLS connections between servers Federation using automatic DNS discovery of partners Remote user access for instant messaging (IM) • External user access to audio/video (A/V) sessions.contoso. the following DNS records are required: • SRV record for _sipinternaltls.com Example of Required Certificates In addition. All server certificates must contain a CRL Distribution Point (CDP). the certificate that is assigned to the Front End Servers in the pool01.com <user>@contoso.com sip. and all of its users have a SIP URI in one of the following forms: • • <user>@retail.

policy. For a list of public CAs that provide certificates that comply with specific requirements for unified communications (UC) certificates and have partnered with Microsoft to ensure they work with the Lync Server Certificate Wizard. Note that server enhanced key usage (EKU) is automatically configured when you use the certificate wizard to request certificates. private key. nonexportable.com On Standard Edition server.com. You can use the Microsoft Lync Server 2010 certificate wizard to request these certificates.com detects any SIP domains you specified during setup and automatically adds them to the Subject Alternative Name." at http://go. A/V Conferencing Server. the server If this pool is the auto-logon server for clients and strict DNS FQDN is the same as the matching is required in group pool FQDN. The following table shows the certificate requirements for these servers. The following tables show certificate requirements by server role for Front End pools and Standard Edition servers. SAN=se01.contoso. The wizard SAN=sip. All these are standard web server certificates. Although an internal enterprise certification authority (CA) is recommended for internal servers.com. Enterprise Edition Front End Server. Certificates for Standard Edition Server Subject name/ Common Certificate name Subject Alternative Name Example Comments Default FQDN of the pool FQDN of the pool and the FQDN of the server If you have multiple SIP domains and have enabled automatic client configuration. the certificate wizard detects and adds each supported SIP domain FQDNs.contoso.contoso. If this pool is the auto-logon server for clients and strict DNS SN=se01. see article Microsoft Knowledge Base 929395. you can also use a public CA.fabrikam. Mediation Server.com/fwlink/?LinkId=140898.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Certificate Requirements for Internal Servers Internal servers that are running Microsoft Lync Server 2010 communications software and that require certificates include Standard Edition server.microsoft. "Unified Communications Certificate Partners for Exchange 2007 and for Communications Server 2007. 26 . and Director. then you also need SAN=sip.

contoso.fabrikam.contoso. • Internal SAN=meet.com.contoso.sipdomain (for each SIP domain you have). Web internal FQDN of the server Each of the following: SN=se01. If you have multiple Meet simple URLs. (which is the SAN=dialin.contoso.contoso. you must include all of them as Subject Alternative Names. you must include all of them as Subject Alternative Names.contoso. SAN=webcon01.com.com • Dial-in simple URL • Admin simple URL If you have multiple Meet simple URLs.com. 27 .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Subject name/ Common Certificate name Subject Alternative Name Example Comments matching is required in group policy.contoso. SAN=dialin.com.contoso.com. SAN=se01.com FQDN of the server) • Meet simple URLs • Dial-in simple URL • Admin simple URL Internal web FQDN cannot be overwritten in Topology Builder.com. • External SAN=meet. then you also need entries for sip.com.contoso. Web FQDN SAN=meet. same as the SAN=admin.com.fabrikam. web FQDN SAN=meet. Web external FQDN of the server Each of the following: SN=se01.com.

contoso.contoso.contoso. then you also need the Subject SAN=sip.fabrikam.contoso. Alternative SAN=sip.contoso. SN=eepool.com. Web Internal FQDN of the server Each of the following: SN=ee01.contoso. • Internal SAN=meet.com The wizard detects any SIP domains you specified during If this pool is the auto-logon server for clients and strict DNS setup and automatically matching is required in group adds them to policy. web FQDN SAN=meet.com. you must include all of them as Subject 28 . SAN=ee01.com.contoso. If you have multiple Meet simple URLs.com FQDN of the server) • Meet simple Internal web FQDN cannot be overwritten inTopology Builder.fabrikam. SAN=ee01. If this pool is the auto-logon server for clients and strict DNS matching is required in group policy.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Certificates for Front End Server in a Front End Pool Subject name/ Common Certificate name Subject Alternative Name Example Comments Default FQDN of the pool FQDN of the pool and FQDN of the server. (which is the SAN=dialin.com.com. then you also need entries for sip.contoso. same as the SAN=admin.com. If you have multiple SIP domains and have enabled automatic client configuration.com.com Name.com.sipdomain (for each SIP domain you have).contoso. SAN=eepool. the certificate wizard detects and adds each supported SIP domain FQDNs.

com.sipdomain (for each SIP domain you have).Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Subject name/ Common Certificate name Subject Alternative Name Example Comments URLs • Dial-in simple URL • Admin simple URL Alternative Names. SAN=meet.com Web Internal FQDN of the server Each of the following: SN=dir01. then you also need entries for sip. • Internal web SAN=dir01.com. SN=dir-pool.com If this Director pool is the autologon server for clients and strict DNS matching is required in group policy. SAN=dialin.com • Dial-in simple URL • Admin simple URL If you have multiple Meet simple URLs.com.fabrikam. then also SAN=sip. FQDN of the Director pool If this pool is the auto-logon server for clients and strict DNS matching is required in group policy.com. SAN=webcon01. FQDN (which is SAN=meet.contoso.com. Certificates for Director Subject name/ Certificate Common name Subject Alternative Name Example Default FQDN of the Director pool FQDN of the Director. you must include all of them as Subject Alternative Names.contoso. Web external FQDN of the server Each of the following: SN=ee01.contoso. • External SAN=meet.fabrikam. SAN=dir01.contoso.com.com.contoso.com.contoso.contoso. the same as the SAN=dialin. Web FQDN SAN=meet.contoso.com.fabrikam. SAN=dir-pool.contoso.com.contoso.contoso.contoso. FQDN of the 29 .com.com. SAN=sip.

30 . the A/V Conferencing Servers in it each need the following certificates. SAN=webcon01.com Web external FQDN of the server Each of the following: SN=dir01. If you collocate A/V Conferencing Server with the Front End Servers.com • External SAN=meet. Certificates for Standalone A/V Conferencing Server Subject name/ Certificate Common name Subject Alternative Name Example Default FQDN of the pool Not applicable SN=av-pool.com.contoso.com. Web FQDN SAN=meet.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Subject name/ Certificate Common name Subject Alternative Name Example server) • Meet simple URLs • Dial-in simple URL • Admin simple URL SAN=admin. the Mediation Servers in it each need the following certificates.contoso.com.contoso.com simple URL • Admin simple URL If you have a standalone A/V Conferencing Server pool.contoso.fabrikam.contoso.contoso. the certificates listed in the “Certificates for Front End Server in Enterprise Pool” table earlier in this topic are sufficient. the certificates listed in the “Certificates for Front End Server in Enterprise Pool” table earlier in this topic are sufficient.com If you have a stand-alone Mediation Server pool. (If you collocate Mediation Server with the Front End Servers. • Dial-in SAN=dialin.

see Knowledge Base article 929395.contoso. • The subject name of the certificate is the access Edge external interface fully qualified domain name (FQDN) or hardware load balancer VIP (for example.net. This leaves the Edge internal interface. plus the A/V Authentication Edge internal interface.com/fwlink/?LinkId=140898.contoso. SAN=sip. 31 . it must be created as exportable. For details.com).contoso.contoso. and the A/V authentication Edge internal interface. which can use either a private certificate issued by an internal certification authority (CA) or a public certificate. • The subject alternative name list contains the FQDNs of the following: • The access Edge external interface or hardware load balancer VIP (for example.com).com Certificate Requirements for External User Access Microsoft Lync Server 2010 communications software supports the use of a single public certificate for Access and Web Conferencing Edge external interfaces.contoso.com.<sipdomain> (need one entry per SIP domain) SN=sba01. access. with the same certificate used on each Edge server in the Edge pool. access. are: • The certificate must be issued by an approved public CA that supports subject alternative name. the subject alternative name must also contain the access Edge FQDN because Transport Layer Security (TLS) ignores the subject name and uses the subject alternative name entries for validation. SAN=sip." at http://go. • If the certificate will be used on an Edge pool.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Certificates for Standalone Mediation Server Subject name/ Certificate Common Name Subject Alternate Name Example Default FQDN of the pool FQDN of the pool SN=medsvrpool.microsoft. "Unified Communications Certificate Partners for Exchange Server and for Communications Server.net.fabrikam.net Certificates for Survivable Branch Appliance Subject name/ Certificate Common name Subject Alternate Name Example Default FQDN of the appliance SIP. Requirements for the public certificate used for access and web conferencing Edge external interfaces. Note: Even though the certificate subject name is equal to the access Edge FQDN. SAN= medsvr-pool.contoso.

sip. the A/V authentication certificate that is installed on each Edge Server must be from the same CA and must use the same private key. webcon.com. csedge. It must also be exportable if you request the certificate from any computer other than the Edge Server. the A/V authentication certificate that is installed on each Edge Server must be from the same CA and must use the same private key. This means that the certificate must be exportable. • No subject alternative name list is required.contoso. it must be created as exportable. also include any SIP domain FQDNs used within your company (for example.com). 32 . Requirements for the private (or public) certificate used for the Edge internal interface are as follows: • The certificate can be issued by an internal CA or an approved public certificate CA. • If using client auto-configuration. • If the certificate will be used on an Edge pool. This means that the certificate must be exportable. load-balanced Edge Servers at a site.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 • The web conferencing Edge external interface or hardware load balancer VIP (for example. if it is to be used on more than one Edge Server.contoso. Note: The order of the FQDNs in the subject alternative names list does not matter. It must also be exportable if you request the certificate from any computer other than the Edge Server. If you are deploying multiple.com).com). If you are deploying multiple. sip. • The subject name of the certificate is the Edge internal interface FQDN or hardware load balancer VIP (for example.fabrikam.contoso. if it is to be used on more than one Edge Server. with the same certificate used on each Edge Server in the Edge pool. load-balanced Edge Servers at a site.

even if DNS load balancing is used for SIP traffic on this pool). if this server is part of a pool). because that is when Lync Server opens the required ports in the firewall.) Required Ports (by Server Role) Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Front End Servers Lync Server Front-End service 5060 TCP Yes Used by Standard Edition servers and Front End pools for listening to client connections from 33 . Additionally. the DNS load balancing will automatically ensure that the ports (that is. Additionally. all ports with a value of Yes must be open on the hardware load balancer. For details about firewall configuration for edge components. The following table lists the ports that need to be open on each server role. the Does this port need to be open on the load balancer? column indicates whether this port must be open on the load balancer too (that is. video. and panorama video. those with a value of Yes in this column) are open. Values of Yes (must be open on the hardware load balancer even if you are using DNS load balancing) indicate that load balancing for this port must occur on the pool’s hardware load balancer (that is. This section includes the following topics: • • Ports and Protocols IPsec Exceptions Ports and Protocols This section summarizes the ports and protocols used by servers and clients in a Microsoft Lync Server 2010 communications software deployment. see Firewall Requirements for External User Access in the Planning for External User Access documentation. (If you are using only a hardware load balancer for a pool. IPsec must be disabled over the range of ports used for the delivery of audio. if Internet Protocol security (IPsec) is deployed in your organization. If you are using Domain Name System (DNS) load balancing for this pool.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Port Requirements Microsoft Lync Server 2010 communications software requires that specific ports on the firewall be open. Note: Windows Firewall must be running before you start the Lync Server 2010 services on a server. for each port.

Used for DCOM based operations such as Moving Users. User Replicator Synchronization. Front End Servers Lync Server Front-End service 444 HTTPS Yes Front End Servers Lync Server Front-End service 135 DCOM and remote procedur e call (RPC) Yes (must be open on the hardware load balancer even if you are using DNS load balancing) No Front End Servers Lync Server IM 5062 Conferencing service Lync Server 8057 TCP Used for incoming SIP requests for instant messaging (IM) conferencing. Used to listen for Front End Servers TCP No 34 . Used for communication between the Focus (the Lync Server component that manages conference state) and the individual servers. and Address Book Synchronization.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Microsoft Lync 2010 (TCP). Front End Servers Lync Server Front-End service 5061 TCP (TLS) Yes Used by Standard Edition servers and Front End pools for all internal SIP communications between servers (MTLS). for SIP communications between Server and Client (TLS) and for SIP communications between Front End Servers and Mediation Servers (MTLS).

Media port range used for video conferencing. No Used for incoming SIP requests for audio/video (A/V) conferencing.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Web Conferencing service Front End Servers Lync Server Audio/Video Conferencing service Lync Server Audio/Video Conferencing service Web Compatibility service 5063 (TLS) Persistent Shared Object Model (PSOM) connections from client. 35 . Front End Servers Lync Server Web Compatibility service 443 HTTPS Used for communication from Front End Servers to the Web farm FQDNs (the URLs used by IIS Web components). Front End Servers Lync Server Web Compatibility service 8080 TCP Used for IIS Web components for external access. TCP Front End Servers 5750165335 TCP/UD P No Front End Servers 80 HTTP Yes (must be open on the hardware load balancer even if you are using DNS load balancing) Yes (must be open on the hardware load balancer even if you are using DNS load balancing) Yes (must be open on the hardware load balancer Used for communication from Front End Servers to the Web farm FQDNs (the URLs used by IIS Web components) when HTTPS is not used.

Used for incoming SIP requests from the PSTN gateway to the Mediation Server. Used for incoming SIP requests from the PSTN gateway to the Mediation Server. Front End Servers that also run a Collocated Mediation Server Front End Servers that also run a Collocated Mediation Server Front End Servers that also run a Collocated Mediation Server Front End Servers 5070 TCP Yes Lync Server Mediation service Lync Server Mediation service Lync Server Application Sharing service Lync Server Application Sharing service 5067 TCP (TLS) Yes 5068 TCP Yes 5065 TCP No Front End Servers 4915265335 TCP No 36 . Used for incoming SIP listening requests for application sharing. Used by the Mediation Server for incoming requests from the Front End Server to the Mediation Server. Front End Servers 5072 TCP Yes Used for incoming SIP requests for Microsoft Lync 2010 Attendant (dial in conferencing). Media port range used for application sharing.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes even if you are using DNS load balancing) Front End Servers Lync Server Conferencing Attendant service (dial-in conferencing) Lync Server Conferencing Attendant service (dial-in conferencing) Lync Server Mediation service 5064 TCP No Used for incoming SIP requests for dial-in conferencing.

Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Front End Servers Lync Server 5073 Conferencing Announcement service TCP Yes Used for incoming SIP requests for the Lync Server Conferencing Announcement service (that is. Used for incoming SIP requests for the Call Park application. Used by Quality of Experience (QoE) agent on the Front End Server. Used for call admission control by the Bandwidth Policy service for A/V Edge TURN traffic. Used for incoming SIP requests for the Audio Test service. Front End Servers Lync Server Call Park service Audio Test service 5075 TCP Yes Front End Servers 5076 TCP Yes Front End Servers 5066 TCP No Front End Servers Lync Server QoE Monitoring Service Lync Server Response Group service Lync Server Response Group service Lync Server Bandwidth Policy Service Lync Server Bandwidth Policy Service 5069 TCP Yes Front End Servers 5071 TCP Yes Front End Servers 8404 TCP (MTLS) No Front End Servers 5080 TCP Yes Front End Servers 448 TCP Yes 37 . Used for outbound Enhanced 9-1-1 (E9-11) gateway. Used for incoming SIP requests for the Response Group application. Used for incoming SIP requests for the Response Group application. for dial-in conferencing). Used for call admission control by the Lync Server Bandwidth Policy Service.

Used for incoming SIP requests from the PSTN gateway. and Mediation Server. and Lync Server Audio/Video Conferencing service). All internal servers Various 4915257500 TCP/UD P N/A Directors Lync Server Front-End service 5060 TCP Yes Directors Lync Server Front-End service Lync Server Mediation service Lync Server Mediation service 5061 TCP Yes Mediation Servers 5070 TCP Yes Mediation Servers 5067 TCP (TLS) Yes 38 . Used for internal communications between servers and for client connections. Media port range used for audio conferencing on all internal servers. Used by the Mediation Server for incoming requests from the Front End Server.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Front End Servers where the Central Management store resides CMS Replication service 445 TCP No Used to push configuration data from the Central Management store to servers running Lync Server. Used by Standard Edition servers and Front End pools for listening to client connections from Lync 2010(TCP). Used by all servers that terminate audio: Front End Servers (for Lync Server Conferencing Attendant service. Lync Server Conferencing Announcement service.

Reverse proxy servers 80 Reverse proxy servers 443 TCP N/A Reverse proxy servers 8080 TCP N/A 39 . Used for message queuing and RPC operations. Used for SIP/TLS communication with the internal network to the Web services cluster. Used by the reverse proxy to listen on the external interface for incoming requests from external users for Web components information and file downloads.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Mediation Servers Lync Server Mediation service Lync Server Mediation service Lync Server Monitoring service 5068 TCP Yes Used for incoming SIP requests from the PSTN gateway. distribution group expansion as well as Address Book information. Mediation Servers 5070 TCP (MTLS) Yes Monitoring Servers 135 Message N/A Queuing and remote procedur e call (RPC) Message N/A Queuing and RPC TCP N/A Archiving Servers Lync Server Archiving service 135 Used for message queuing and RPC operations. Used by the reverse proxy to listen on the external interface for incoming requests from external users. Used for SIP requests from the Front End Servers.

Used for SIP/MTLS communication for remote user access or federation and public Internet connectivity. and STUN/TCP inbound and outbound media communications for accessing internal media and A/V sessions. Used for SIP/MTLS authentication of A/V users. Used to listen for PSOM/MTLS communications from the Web Conferencing Server on the internal interface of the Web Conferencing Edge Server. Communications flow outbound through Edge Servers All edge services (external interface) 443 TCP Yes Edge Servers Lync Server Access Edge service (internal and external interface) Lync Server Web Conferencing Edge service (internal interface) 5061 TCP Yes Edge Servers 8057 TCP No Edge Servers Lync Server Audio/Video Edge Authentication 5062 TCP Yes 40 . Reverse proxy servers 4443 TCP N/A Used by the reverse proxy to listen on the internal interface. Used for SIP/TLS communication for external users accessing internal Web conferences. Traffic from port 443 on the external interface is redirected to this port.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Traffic from port 80 on the external interface is redirected to this port.

Edge Servers 50.00059.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes service (internal interface) Edge Servers Lync Server Audio/Video Edge service (internal and external interfaces) Lync Server Audio/Video Edge service port range 3478 UDP Yes the internal firewall. This port range always needs to be opened outbound for TCP. Used by Lync 2010 to find the Registrar FQDN Edge Servers All Edge services (internal interface) 4443 TCP No Clients 67/68 DHCP N/A 41 . If you federate with an organization running Microsoft Office Communications Server 2007 R2 or Microsoft Office Communications Server 2007. This port must be opened on every individual Edge Server. Used to push configuration data from the Central Management store to the Edge Server. you must open this range both outbound and inbound.999 RTP/TC P. and for both TCP and UDP. Used for STUN/UDP inbound and outbound media exchange. RTP/UD P No Used for inbound and outbound media transfer through the external firewall. not on the load balancer.

and Registrar FQDN. clients use PSOM). Used by clients for audio port range (minimum of 20 ports required). Used by the devices listed to find the Lync Server 2010 certificate. Used by clients for video port range (minimum of 20 ports required).Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes (if DNS SRV fails and manual settings are not configured). Clients 68916901 TCP N/A Used for file transfer between Lync 2010 clients and previous clients (clients of Office Communicator 2007 R2. Used by clients for peerto-peer file transfer (for conferencing file transfer. Office Communications Server 2007. provisioning FQDN. Used by clients for application sharing. Clients 102465535 102465535 102465535 TCP/UD P TCP/UD P TCP N/A Clients N/A Clients N/A Clients Microsoft Lync 2010 Phone Edition for Aastra 6721ip common area phone Microsoft Lync 2010 Phone Edition for Aastra 6725ip desk phone 102465535 67/68 TCP DHCP N/A N/A 42 . and Live Communications Server 2005).

Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Does this port need to be open Component (server role or client) Service name Port Protocol on the load balancer? Notes Microsoft Lync 2010 Phone Edition for Polycom CX500 common area phone Microsoft Lync 2010 Phone Edition for Polycom CX600 desk phone 43 .

Recommended IPsec Exceptions Destination Rule name Source IP IP Protocol Source port Destination port Filter action A/V Edge Server Internal Inbound A/V Edge Server External Inbound A/V Edge Server Internal Outbound A/V Edge Server External Outbound Mediation Server Inbound Mediation Server Outbound Conferencing Attendant Inbound Conferencing Attendant Outbound A/V Conferencing Inbound A/V Conferencing Server Outbound Exchange Inbound Any A/V Edge Server Internal A/V Edge Server External Any UDP and Any TCP UDP and Any TCP UDP & TCP Any Any Permit Any Any Permit A/V Edge Server Internal A/V Edge Server External Any Any Permit Any UDP and Any TCP UDP and Any TCP UDP and Any TCP UDP and Any TCP UDP and Any TCP Any Permit Mediation Server(s) Any Permit Mediation Server(s) Any Any Any Any Any Permit Any Any Any Any Any Permit Permit Permit A/V UDP and Any Conferencing TCP Servers UDP and Any TCP UDP and Any A/V Any Conferencing Servers Any Exchange Unified Any Permit Any Permit 44 . and panorama video. IPsec must be disabled over the range of ports used for the delivery of audio.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 IPsec Exceptions For enterprise networks where Internet Protocol security (IPsec) (see IETF RFC 4301-4309) has been deployed. video. The following table explains the recommended IPsec exception settings. The recommendation is motivated by the need to avoid any delay in the allocation of media ports due to IPsec negotiation.

Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Destination Rule name Source IP IP Protocol Source port Destination port Filter action Messaging Application Sharing Servers Inbound Application Sharing Server Outbound Exchange Outbound Any Application Sharing Servers Any TCP TCP Any Any Permit Application Sharing Servers Exchange Unified Messaging Any TCP Any Any Permit Any UDP and Any TCP UDP Any Permit Clients Any Specified Any media port range Permit 45 .

microsoft.microsoft.com/fwlink/?linkid=197392 Security Note If you are using IIS 7. The table below describes the additional role services that must be installed when the Web Server (IIS) role is enabled on Windows Server 2008. available at http://go.0 on a Windows Server 2008 operating system. Lync Server 2010 Setup disables kernel mode authentication in IIS. When the Web Server (IIS) role is enabled on Windows Server 2008. Role service Feature Common HTTP Features Application Development Application Development Application Development Application Development Health and Diagnostics Health and Diagnostics Security Security Management Tools Management Tools HTTP Redirection ASP.com/fwlink/?linkid=197391. This topic describes the specific IIS features required to support Lync Server 2010. 46 . Important: If you are running Windows Server 2008 R2.microsoft.1 of the URL Rewrite module.com/fwlink/?linkid=197394. various role services are installed by default.NET .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Internet Information Services (IIS) Requirements Several Microsoft Lync Server 2010 communications software components require Internet Information Services (IIS).NET Extensibility ISAPI Extensions ISAPI Filters Logging Tools Tracing Basic Authentication Windows Authentication IIS Management Scripts and Tools IIS 6 Management Compatibility You must install the following additional components to enable features in Lync Server: • IIS URL Rewrite module at http://go. • IIS Application Request Routing module at http://go. The topics in this section describe the requirements of specific components for IIS. you must install version 1.

.NET . Virtual Directories for Internal Access Feature Virtual directory URI Refers to Address Book Server https://<Internal FQDN>/ABS/int/Handler Location of Address Book 47 .NET Extensibility Internet Server API (ISAPI) Extensions ISAPI Filters HTTP Logging Logging Tools Tracing Windows Authentication Request Filtering Static Content Compression IIS Management Console IIS Management Scripts and Tools Tracing AnonymousAuthenticationModule ClientCertificateMappingAuthenticationModule Lync Server 2010 requires the following IIS modules to be installed: The following table lists the URIs for the virtual directories for internal access and the file system resources to which they refer. the Microsoft Lync Server 2010 installer creates virtual directories in IIS for the following purposes: • • • • To enable users to download files from the Address Book Service To enable clients to obtain updates (for example. Microsoft Lync 2010) To enable conferencing To enable users to download meeting content • To enable unified communications (UC) devices to connect to Device Update Service and obtain updates • • • • • • • • • • • • • • • • • • • • • To enable users to expand distribution groups To enable phone conferencing To enable response group features Static Content Default Document HTTP Errors ASP. and Directors.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 IIS Requirements for Front End Pools and Standard Edition Servers For Standard Edition servers and Front End Servers.

http://<Internal FQDN>/RgsClients For Front End pools in a consolidated configuration. Location of meeting content for internal users.asmx Phone Conferencing http://<Internal FQDN>/PhoneConferencing/Int http://<Internal FQDN>/RequestHandler Device updates Response Group application Note: http://<Internal FQDN>/RgsConfig. the location of the Address Book Web Query service that provides global address list information to internal Microsoft Lync 2010 Mobile clients. you must deploy IIS before you can add servers to the pool. Location of phone conferencing data for internal users. Location of the Device Update Service Request Handler that enables internal UC devices to upload logs and check for updates. Also. Location of Response Group ConfigurationTool. Conf http://<Internal FQDN>/Conf/Int Device updates http://<Internal FQDN>/DeviceUpdateFiles_Int Meeting Group Expansion and Address Book Web Query service http://<Internal FQDN>/etc/place/null http://<Internal FQDN>/GroupExpansion/int/service. Location of the Web service that enables group expansion for internal users. Location of unified communications (UC) device update files for internal UC devices. Client updates http://<Internal FQDN>/AutoUpdate/Int Location of update files for internal computer-based clients. Location of conferencing resources for internal users.Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Feature Virtual directory URI Refers to Server download files for internal users. 48 .

49 .Determining Your Infrastructure Requirements for Microsoft Lync Server 2010 Security Note: You must use the IIS administrative snap-in to assign the certificate used by the IIS Web component server.

Sign up to vote on this title
UsefulNot useful