Location Information - Lync 2010

While LIS (Location Information Service) is designed mainly to support E911 (Enhanced 911 services), and I don’t have one, I will try to make the best of it in lab environment.

I will test by logging in from a PC on subnet 10.8.0.0 and from my laptop, connected via Wireless Access Point on the same subnet.I will follow the directions form Technet found here: http://technet.microsoft.com/en-us/library/gg415678.aspx

First, I will set my Wired Subnet and populate the variables by executing:

Set-CsLisSubnet -Subnet 10.8.0.0 -City “Southern City” -CompanyName “My Company” -Country US -Description “Wired LAN” -HouseNumber 100 -HouseNumberSuffix “” -Location “My Wired LAN” -PostalCode 99999 -PostDirectional “” -PreDirectional “” -State GA -StreetName “My Street” -StreetSuffix Str. -WhatIf


***Note the “WhatIf” parameter. With so much typing, errors are quite possible and I want to check if the cmdlet will be executed.

Looks good and I will run it without “WhatIf” switch.

Next, I will set my Wireless Access Point:

Set-CsLisWirelessAccessPoint -BSSID 00-23-04-6e-80-e0 -City “Southern City” -CompanyName “My Company” -Country US -Description “Wireless AP” -HouseNumber 100 -HouseNumberSuffix “” -Location “My Wireless AP” -PostalCode 99999 -PostDirectional “” -PreDirectional “” -State GA -StreetName “My Street” -StreetSuffix Str.

Because this is “just for fun” configuration, I will publish the LIS Configuration (publish-CsLisConfiguration)

After replication, I logged from both PC and laptop and... the test was successful.

Of course, this is quick touch on the subject. LIS has tons of features and reading and understanding how it works and possible implications is highly advisable.

Publishing Simple URL – Lync 2010

I decided to spend some time today and publish my Lync lab deployment’s simple URL’s. Before proceed with the actual TMG configuration, there are some things I will take care first.

My simple URL’s and Web service are specified in the topology as shown:

Because the task is related to external access, I need to make sure internet users resolve those to my TMG’s Public IP address, assigned to the External Interface. I have already created A Records for “meet”, “dialin” and “webext”…

Next, I need to request and receive a SSL certificate for my TMG server. I personally use http://www.startssl.com. As with everything else, this has ups and downs. The good part – for $50 per year I get unlimited certificates, unlimited domains, unlimited SAN certificates – the whole nine yards. StartSSL is trusted by almost any web browser (I am yet to find one that does not work)… The bad – while included in the Trusted Root store of Windows Vista and Windows 7, it is not by default in Windows Server OS.

If you install any Update for Root Certificates dated 2010 and later, (http://www.microsoft.com/downloads/en/details.aspx?familyid=19C4AE49-1127-4537-9E91-35F81D20BCE6&displaylang=en) for example, StartCom will be included.

Another down side – the Root CA is not included in the Trusted Root of the mobile devices and so, unless you manually import it to your smart phone, Exchange Sync will fail.

When we create a certificate request via IIS or Lync, the mechanism is as follow – the utility generates private key (kept on the local computer) and CSR (Certificate Signing Request), which we then ask a Certificate Authority to sign with the their key. Once done, we “Process Pending Request” which actualy joins the Private Key and signed certificate in single entity. Because if this, if you use Lync server to generate CSR, later you MUST process the request on this same server and import it in the Personal Certificate Store. Then, export it with the private key (.pfx file), and import it in TMG’s Private store.

One thing I like with StartCom is that their wizard could process a CSR or we could generate private key there, get a certificate and finally create .pfx file all in one place. I will not explain the actual steps here because you might decide to approach the Certificate step different way…

Finally, my certificate is imported and good to go.

I used SAN certificate where my URL’s are in the SAN list. Just curious if will work…

My TMG is already installed and ready to go. First, I will create a listener to be used for my publishing rules.

 

Next, the publishing rules.

 

 Even thou the rule has been created, I will go over the settings one more time to make sure it is exactly as required for Lync 2010.

***Note here that we brigge the request that originaly will come on port 443 to port 4443. This is because we want requests from public internet to be served by webext web site.

…and lastly, test the rule.

 As described above, I created and tested two more rules - one for "meet" and one for "webext" (both bridged to port 4443 as well)

What left now is to test the functionality from a computer on public internet.

Dialin worked. No number is shown yet because I have not provisioned one as of this time.

For the next test, I started a meeting from home

...and fired up the meeting URL from a "public" computer i.e. my school PC and joined just fine.

What left now is to check tomorrow morning in my office if the Aastra phone updated the firmware and Lync client can download the Address Book.

So far - another good day for my lab Lync deployment.