Category: Microsoft

Dec 12 2011

Mobility for Lync

Native Microsoft Mobility for Lync 2010 Is Here!

The mobility features of Lync have been sorely missed since Lync 2010 was release last November but Microsoft has made HUGE strides in their recent release. There are a few pre-requisites which we will cover as well as some gotchas to look out for. As of today the Windows Phone client (Mango required) is available in the Marketplace but the Apple iOS and Android clients have yet to appear. There should also be a Nokia client but I do not have a method to test so unfortunately I have nothing to report there.

Server Requirements

Before mobility can be configured the current Lync environment requires CU4 to already be installed. If this has not been done, first things first. There are also a few configuration requirements that must be met which while it didn't matter without mobility, now it does. Those include:

The Front-end pool internal web FQDN must be different from the external (even if you are using split-DNS)
HLBs may need to be updated changing their persistence to cookie-based and certificates installed to support SNAT
IIS Dynamic Content Compression is needed on the Directors and Front-End servers in order to install the mobility BITS

Once that is complete there is a mobility download that must be grabbed and server-based PowerShell commands that are run on a Front-End Server in the environment. The configuration includes updating DNS, requesting and installing new certificates, configuring ports etc. so let's begin.

Mobility Configuration

Configuring Mobility Ports

The first task completed when configuring mobility is running two PowerShell commands to configure the ports mobility will use inside and outside. Setting the ports will also 'inform; the bootstrapper process that mobility should be installed and configured. To set your ports simply launch Lync Server Management Shell (LSMS) and type:

Set-CsWebServer –Identity lspoolname.domain.com –McxSipPrimaryListeningPort 5086
Set-CsWebServer –Identity lspoolname.domain.com –McxSipExternalListeningPort 5087
Enable-CsTopology

You can see the internal listening port has been set at 5086 with the external ports set to 5087. The enable command sets the changes into the topology and the Lync environment is now aware that mobility should be there. The above two Set-CsWebServer commands with the MCX values will only work if CU4 is installed.

IIS COnfiguration

If the IID Dynamic Content Compression was not already added (listed as a pre-requisite above) now is the time to complete the process as without it setup will fail. If your base operating system for your Lync Front-End/Director server is Windows Server 2008, use the following command:

[from a command prompt] ServerManagerCMD.exe –Install Web-Dyn-Compression

If the base operating system for your Lync Front-End/Director server is Windows Server 2008 R2, use the following command:

[from PowerShell] Import-Module ServerManager; Add-WindowsFeature Web-Server, Web-Dyn-Compression

DNS COnfiguration

New DNS names have been established for the AutoDiscover process (think Exchange AutoDiscover). The new feature removes the need for you to configure the explicit server settings on the mobile clients (very nice). There are up to three different records that must be created, two of which are on the inside DNS. Two of the three records are CNAME DNS records while the third (required if split-DNS) is an 'A" record.

Internal DNS create CNAME record lyncdiscoverinternal and point it to the internal web services 'A' record
External DNS create CNSME record lyncdiscover and point it to the external web services 'A' record
Internal DNS (if using split-DNS) create 'A' record for your external web services name and configure it to the external IP

Installation of the Mobility BITS

The installation of the BITS is completed by downloading the new MSI, placing it in the expected folders, and running bootstrapper.

To begin, download the MSI at Microsoft's download center here. Save the MSI locally to each Front-End and Director server in the path C:\ProgramData\Microsoft\Lync Server\Deployment\cache\4.0.7577.0\setup. This is the location of the cached Lync 2010 installers. Once the MSI is in the correct path, launch LSMS and run C:\Program Files\Microsoft Lync Server 2010\Deployment\Bootstrapper.exe (NOTE: the path C:\Program Files\Microsoft Lync Server 2010\ may be different in your deployment based off of where Lync was installed)

Bootstrapper will detect the configuration/setting of the mobility ports and install the mobility BITS on the required servers.

Assuming push notifications are desired on the iOS and Windows Phone platforms, enter the following after the installation is complete (from LSMS):

Set-CsPushNotificationConfiguration -EnableApplePushNotificationService $true -EnableMicrosoftPushNotificationService $true
New-CsHostingProvider –Identity "LyncOnline" –Enabled $True –ProxyFqdn "sipfed.online.lync.com" –VerificationLevel UseSourceVerification
New-CsAllowedDomain –Identity "push.lync.com"

Certificates

Because there are new names internally and externally new SANs are required on both the internal and external certificates. The simplest way to request a new certificate is using the Lync Deployment application on a Front-End server (one per pool). The server has the ability to create both the internal and external certificates using the GUI. If you are in a multi-server pool I recommend having three separate certificates on the pool - one unique to each Front-End and the other two used on each Front-End (same certificate).

If you already have the Server Default certificate unique to the Front-End server (it will have the pool name, server name, and most likely 'sip'), then the next step is running the wizard again and ONLY selecting Web Services Internal. Running the wizard will include all known names for all supported SIP domains - this includes the internal web services FQDN as the CN and meet, dialin, lyncdiscoverinternal, and your lyncadmin name as SANs. If you use an external certificate provider, that certificate request can be sent off for processing.

Next launch the certificate wizard again this time making sure only Web Services External is selected, offline certificate is selected, and mark as exportable is checked. The results for the external certificate request will be a certificate with the external web services FQDN as the CN and meet, dialin, and lyncdiscover as SANs. Once the certificate has been processed externally you have two options. If you are using a Reverse Proxy where the certificate is required or a HLB, export the certificate from the server and import into the appropriate location. Assuming you are using an internal CA, you would then have the option to re-request an internal certificate for the external web services role. If you are NAT'ing directly to a single server (no HLB but a single point of failure) then you may leave the certificate as is.

Restart Pool/Director Servers and TEST

Once the configuration is complete, reboot the various servers and validate that there are no unexpected errors in the Lync logs in the Event Viewer. Once the servers are back online, assuming all is well launch LSMS and run the following command (replacing your two test users with appropriate names and accounts):

Test-CsMcxP2PIM -TargetFqdn lspoolname.domain.com -SenderSipAddress sip:user1@domain.com -SenderCredential "domain\user1" -ReceiverSipAddress sip:user2@domain.com -ReceiverCredential "domain\user2"

The result of the test should look like:

TargetUri : https://internalwebservicesname.domain.com:443/mcx
TargetFqdn : lspoolname.domain.com
Result : Success
Latency : 00:00:00
Error :
Diagnosis :

Exchange 2010 SP2 RTM

Microsoft's Exchange team has released Service Pack 2 for Exchange 2010 this morning. The team has not blogged about the release yet (I would expect it shortly this morning) but the link for the download is here. As an FYI, there is a new pre-requisite for the install - IIS 6 WMI Compatibility.

Posted by Brian Ricks at 7:13 AM - Categories: 2010 | Microsoft | Exchange | sp2

Apr 23 2011

PIN Authentication Login Fails on the Devices, NTP

PIN Authentication works using the Test-CsPhoneBootstrap cmdlet but fails on Lync devices

Recently I decided to 'play' with my Lync devices by moving them to a dedicated voice VLAN on my network. After doing so, I noticed I was unable to use PIN authentication. I found this extremely odd especially since I had just told a fellow colleague how simple the PIN process was. From the Lync 2010 servers the Test-CsPhoneBootstrap cmdlet was passing with a code of Success making me even more perplexed. Digging a bit deeper into the issue, I noticed that the phones authenticating using a PIN as well as my CX700 phones were taking a significant amount of time at boot while they were acquiring their time.

Comparing my two VLANs nothing stood out until I remembered I did not allow the new VLAN Internet access (why should the phones need to go out to the Internet after all?). Well, as it turns out, they were getting their time service from time.windows.com come even though my Windows domain controllers were configured as NTP servers and their SRV records existed in DNS.

The solution was quite simple and all devices benifited from a faster boot time. Within DHCP there is a standard option, 042 NTP Servers, which I configured with my domain controllers as the defined values. As soon as I added this option, the phones received their time nearly instantly and PIN authentication worked as expected.

Apr 23 2011

Dedicated Voice VLAN for Lync Devices

There are multiple reasons to deploy a dedicated VLAN for your Lync devices - IP constraint, data partitioning, QoS, just because (my personal case). I decided it was a brilliant idea to move my phones to their own VLAN but wanted to make sure my PCs behind the various devices (Polycom CX600/CX700 and Aastra 6725ip) remained on the current VLAN.

In OCS, this was accomplished exclusively via DHCP options. The process was poorly documented for whatever reason by Microsoft (and nearly non-existent in OCS 2007 R2) although multiple bloggers came to the rescue and had (for the most part) the answers. In Lync Server 2010 in addition to the DHCP OPTION 43 'option' LLDP-MEP was introduced as a method to define the multiple VLANs. Unfortunately my older networking equipment did not support LLDP-MEP so I was pushed back into the DHCP realm (thank you Microsoft for retaining the option!).

Luckily the configuration of the second VLAN is exactly the same as it was in OCS although the process is manual. Why Microsoft didn't create a script like they did to create the 'other' PIN required DHCP options is beyond me. Below I have written a batch file to create the required functionality to make sure typos are eliminated. Like the Microsoft DHCP PIN script, the options are added at the Server Options level; if this is not what you want/need, go ahead and add the Option (010 VoiceVLAN) directly to the desired scopes and remove it from the Server Options.

Note: if the DHCP MMC is running when you execute this script, you will not see the changes made. To refresh, exit the MMC and re-launch.

Now to break down what we are doing in the script. When executed from an elevated prompt (ex. VoiceVLAN.bat 30) the script uses netsch to create a Vendor Class named CPEOCPhone with a value of CPE-OCPHONE. It then creates an option 10 definition called VoiceVLAN and assigns it (in this case) a value of 30. Simply replace 30 with the desired Voice VLAN number (displayed in HEX in the MMC). Manually this would be accomplished using the following steps.

Right-click on IPv4 and select Define Vendor Classes...

Select Add to define a New Class. The Display name is whatever you want it to be; the script sets it to CPEOCPhone with a Description of VLAN tagging for the Microsoft Phone Devices. The only part that MUST be entered exactly is the ID value. This is set most easily in ASCII by simply placing the cursor under the word ASCII and clicking. Enter CPE-OCPHONE (yes, case sensitive) and watch the Binary equivalent automatically appear.

Click OK to save the new Vendor Class and Close to complete the creation process.

Next the Predefined Options must be created (in this case, Option 10). Once again, right-click IPv4 in the DHCP MMC but this time select Set Predefined Options...

Change the Option class... to the newly created class (CPEOCPhone) where you will find no Options created. Click Add... to create the new option. In the Name, enter VoiceVLAN. Change the Data type to Word. In the Code, enter the number 10. Enter Phone VLAN in the Description and click OK.

The Predefined Options and Values will now display option 010 VoiceVLAN with no default Value. Click OK to close the configuration dialog. You must now add the option to one or more scopes. Select a scope and select Configure Options...

Select the Advanced tab and from the Vendor class drop-down select CPEOCPhone. A single option should be listed, 010 VoiceVLAN. Select the option and under Data entry enter your VLAN (ex. 30).

Click OK to add the Option to the selected DHCP scope and repeat as necessary.

IMPORTANT: After changing the VLAN options for the phones, a hard reset is required as the devices cache their VLAN information to avoid the query process each time. For the CX700 (Tanjay) this is accomplished by using a small object to push the reset button on the back of the phone. For the newer Lync phones (Polycom CX600/CX500 and Aastra 6725ip/6721ip) you must hold down the * and # keys while powering on the phone until prompted to reset the device (this takes a few minutes). After the phone reboots, the new DHCP options will be passed to the phone. The switch port the phone is attached to must already have both VLANs associated to it with the PVID (primary VLAN) set to the computer VLAN, not to the voice VLAN. Of course, normal routing and switching configuration must be completed as well (as defined by the switch/router vendor).

VoiceVLAN.bat

netsh dhcp server add class CPEOCPhone "VLAN tagging for the Microsoft Phone Devices" "CPE-OCPHONE" 1

netsh dhcp server add optiondef 10 VoiceVLAN Word 0 Vendor=CPEOCPhone comment="Phone VLAN"
netsh dhcp server set optionvalue 10 Word vendor=CPEOCPhone "%1"

Apr 21 2011

SQL Server 2008 R2 now supported with Lync 2010

Microsoft has completed their testing of SQL Server 2008 R2 and Lync Server 2010 and has found the database to be compatible. This is great news for companies that have an existing SQl 2008 R2 environment and have had to in the past setup a new SQL server/cluster just for Lync Server. The official blog from Microsoft may be found here.

0 comments - Posted by Brian Ricks at 8:03 AM - Categories: 2010 | Microsoft | Lync Server | SQL 2008 R2

Apr 7 2011

Microsoft Re-Re-Releases Rollup 3 for Exchange 2010 SP1

Today Microsoft released version 3 of the Exchange 2010 SP1 Rollup 3. Previously the rollup had been pulled due to compatibility issues with Blackberry. Now, the Exchange team has RU3 for Exchange 2010 back in circulation and can be found here.

The full Microsoft product team announcement may be found here for those interested. :)

0 comments - Posted by Brian Ricks at 12:39 PM - Categories: 2010 | Microsoft | Exchange | RU3

Mar 9 2011

Lync 2010 Tools Released

New Tools and Whitepapers for Lync Server 2010

As with any product, Lync Server is continually evolving and tools to help design, size, and test are constantly being released. Microsoft has recently released the following for Lync Server 2010:

Additionally, a new Lync Server virtualization whitepaper was released a few weeks ago updating Microsoft's support for virtualization throughout the product. It should be noted that the Capacity Calculator shows both physical and virtual requirements helping to bridge the gap between a SWAG and an educated guess.

0 comments - Posted by Brian Ricks at 3:45 AM - Categories: 2010 | Documentation | Microsoft | Lync Server | Tools

< Previous Entries

BCUC - BriComp Unified Communications Your Technology Consultant