Lync publishing on UAG

re: Lync publishing on UAG

aputnam — Wed, 08 May 2013 16:22:12 GMT

You recommend publishing Lync into a separate trunk. How do you address the issue of the Lync trunk going on the same IP and port as the other trunks (exchange)?

re: Lync publishing on UAG

Ben Ari — Wed, 12 Dec 2012 21:15:14 GMT

To Bill and others, the blog comments are not the appropriate platform for asking technical questions, esp. outside the scope of the article. Please post your questions on the UAG support forum at social.technet.microsoft.com/.../forefrontedgeiag or contact me directly via the Email Blog Author link on the top right of the page.

re: Lync publishing on UAG

Bill — Wed, 12 Dec 2012 15:26:28 GMT

Hi. Can the same wildcard cert be applied to multiple trunks? I would assume as different needs will require different authentication methods and each trunk can only have a single type of authentication that it would be necessary to apply the wildcard cert across many trunks. So, will a single wildcard cert be enough to accomplish any type of publishing needs on the UAG?

I am thinking of Lync in particular. It would be easier to be able to use a single wildcard cert on the UAG so I don't have to worry about what needs to be included in the SAN for different trunks publishing OWA, Outlook Anywhere, Sharepoint, Intranets, etc.

I would then only need a particular SAN cert on the Lync Edge since that will have externally facing IPs to accomplish other Lync client needs.

Does that make sense?

One last question regarding certs. I currently use ISA 2006 to publish my Exchange services (OWA, ActiveSync, Etc.). Both my ISA2006 and Exchange Server have certs installed so they can communicate. Am I correct that when using UAG to publish Exchange services like OWA, Outlook Anywhere, ActiveSync, etc. that I no longer need certs on the Exchange box since once a client reaches the UAG box traffic from the UAG to Exchange can be over standard http?

Thanks.

Bill

re: Lync publishing on UAG

Mike L — Mon, 10 Dec 2012 22:05:18 GMT

Matt B, I am running this configuration with a wildcard cert and it works fine for Lync 2010 and Lync mobile clients (I do have a SAN cert for the Lync edge server though). I have not tested other devices (such as Lync phones). Hope this helps.

re: Lync publishing on UAG

Matt B — Thu, 13 Sep 2012 20:37:59 GMT

Is the requirements for a non-wildcard cert for Lync specific to UAG? Because we are publishing Lync via TMG with a wildcard certificate just fine. That would be disappointing.

re: Lync publishing on UAG

Ben Ari — Wed, 23 May 2012 17:20:26 GMT

I'm afraid UAG does not have the ability to do this when connecting to the URL directly.

re: Lync publishing on UAG

Cajuntank — Wed, 23 May 2012 06:15:20 GMT

I have this resolved thanks to your reply with the exception of when I go to the site now from the Internet, I am having to append the url with the the /dialin to get to the page even though the application url clearly has that in there. Any ideas?

re: Lync publishing on UAG

Ben Ari — Tue, 22 May 2012 00:24:11 GMT

UAG needs it's own, separate public hostname, that's different than the names used by the application. This allows UAG to identify requests that pertain to UAG's administrative website (InternalSite). You can access Lync by using it's public hostname, but the UAG needs the hostname as well.

re: Lync publishing on UAG

Cajuntank — Mon, 21 May 2012 19:30:24 GMT

I am new to TMG and UAG, so excuse me if I'm not even close on this, but you're including the public host name in the SAN certificate due to you wanting to go through the portal address instead of the primary publishing URL. Can you not use the primary publishing FQDN of Lync (ie...lyncweb.domain.com) as the public host name and wouldn't need to have yet another name in the certificate?

re: Lync publishing on UAG

Erez Ben Ari — Fri, 04 May 2012 16:18:41 GMT

Answer to RenhsrakJ: This was a type in the image, and I've replaced it with the correct one. Thank you for bringing this to my attention!

Erez