Microsoft Lync Server 2010 Resource Kit: External User Access

re: Microsoft Lync Server 2010 Resource Kit: External User Access

Attila — Mon, 24 Oct 2011 10:37:25 GMT

Hi Randy, on page 37: "In this scenario, two remote Lync 2010 users...", but diagram shows one Lync user inside.

Thanks for the explanation. For me the most mysterious are the ports on the external IP of the NAT device, since those are out of control. I know that using STUN (at least how it was before), you can figure out the behavior of the NAT device: so you make a "hole" by sending a packet to the STUN server and then you test from a 1st and 2nd IP of the STUN server if that "hole" lets in packages from what IP and port combinations.

I also know that now STUN is something more than just figuring out the NAT type. Are the STUN messages themselves testing and opening the ports for media?

It is also strange to me that internal users will use external IP of edge if relaying is needed with an external participant. It means, that internal clients will use the (site) local Internet access to connect the edge server. Doesn't it spoil the CAC?

I'm studying these because I'm experiencing random problems with Polycom HDX and RMX devices, especially when Lync clients are outside. Anyway, I keep learning and hopefully understand everything better soon.

re: Microsoft Lync Server 2010 Resource Kit: External User Access

Randy Wintle — Tue, 18 Oct 2011 23:04:37 GMT

Hi Attila, can you comment with some more specific details with errors in the diagrams?

As for your comment about allocation:

Ice will look at all available IPv4 addresses available on the client. Using these addresses in addition to the default port range, or administrator configured port range, the client will randomly allocate a pair of ports in that range per call. In addition, the client will also discover the closest public ip address which is being used for nat purposes and allocate ports there (these are the reflexive or home ip addresses). For the relay addresses, the client will send an allocate request to the av edge with the information provided in the initial MRAS response. The edge will validate the client credentials, then randomly allocate ports not current in use in the defined edge port range. The client combines all of this and sends with that initial INVITE. The callee will follow the same process and respond with a 200 OK. I think the chapter outlines the rest. If not, please feel free to ask any more questions, thanks!

re: Microsoft Lync Server 2010 Resource Kit: External User Access

DrRez — Tue, 18 Oct 2011 22:40:45 GMT

Attila, thanks for the feedback. Just sent a note to the authors on this.

re: Microsoft Lync Server 2010 Resource Kit: External User Access

Attila Kovács — Tue, 18 Oct 2011 09:08:33 GMT

Very nice material, I've learnt a lot from it. But I've found some figures confusing and not in sync with the scenario (e.g. peer-to-peer call flow). It would be also good to see IPs on the network diagrams. A bit more details about how candidate IP-port pairs are obtained would be good to.

re: Microsoft Lync Server 2010 Resource Kit: External User Access

DrRez — Tue, 27 Sep 2011 23:09:56 GMT

Great job on this chapter Randy and Dustin. You both rock!