Enabling Lync Media to Bypass a VPN Tunnel

re: Enabling Lync Media to Bypass a VPN Tunnel

Kevin Peters — Fri, 21 Sep 2012 15:38:25 GMT

Hi Austin,

If you block the traffic on the server side there is still the possibility of Peer to Peer connectivity (from one Lync client to another) over the tunnel. So unless you also block internal client subnets from reaching VPN subnets that wouldn't resolve the problem for all media flows.

Hope this helps!

Kevin

re: Enabling Lync Media to Bypass a VPN Tunnel

Austin Bailey — Thu, 20 Sep 2012 23:11:13 GMT

Great Article!

I have one question for you though. If I was to give my VPN users a separate DHCP pool, could I implement the firewall rules on the Lync server side rather than the client side? It would be a gigantic undertaking to modify all of my mobile users windows firewalls to make the suggested change. My thought is to block the VPN IP Subnet on the servers themselves so that the client would be forced to look at the edge for connectivity. Thoughts?

re: Enabling Lync Media to Bypass a VPN Tunnel

Jason — Thu, 19 Jan 2012 01:23:18 GMT

Has anyone that implemented this noticed that the Lync client takes a long time to login when on VPN? Just a nusance, otherwise this solution rocks! Users "Internal" flag is set to fale when on VPN and traffic is routing over the Internet tunnel exclusively - excelelnt article!

re: Enabling Lync Media to Bypass a VPN Tunnel

Mac alvano — Mon, 16 Jan 2012 10:01:22 GMT

Nice article, keep it up good work, kevin and randy!

does link media bypass <a href="bestvpnservice.com/.../strong_vpn.html">strong vpn</a>?

re: Enabling Lync Media to Bypass a VPN Tunnel

Kevin Peters — Thu, 12 Jan 2012 17:48:05 GMT

Hi Jason,

You would want to use a separate DNS server for VPN clients, so public IPs are provided to the VPN users (bypassing the tunnel), but internal IPs are still provided to your internal users. This could not be done from the same DNS server, so you'd need to create at least one, specifically for serving the VPN connections.

HTH,

-Kevin

re: Enabling Lync Media to Bypass a VPN Tunnel

Jason — Thu, 12 Jan 2012 15:51:19 GMT

Same goes for meet and dialin, I already have these registered on internal DNS using internal IP's.

re: Enabling Lync Media to Bypass a VPN Tunnel

Jason — Thu, 12 Jan 2012 15:46:49 GMT

I am confused, I already have an internal DNS entry for "Sip.contoso.com" pointing to an internal address, this suggests resolving it to the edge interface. What will happen to internal users?

re: Enabling Lync Media to Bypass a VPN Tunnel

soder — Sat, 19 Nov 2011 14:00:28 GMT

Finally, this has been properly documented. I have to start testing it, and if works, becomes part of my implementation best practices list. Good job!

re: Enabling Lync Media to Bypass a VPN Tunnel

seo training noida — Sat, 19 Nov 2011 06:43:29 GMT

Thank you

Your blog is very Informative.

re: Enabling Lync Media to Bypass a VPN Tunnel

Peyton McManus — Fri, 18 Nov 2011 19:51:23 GMT

Nice article guys!