Configure External Access Policy

The next tab is External User Access. The first section, External Access Policy, defines the access edge policy for communication with external users. The access edge configuration section controls settings for federation and remote user access. Next is the Federated Domains section. Administrators can explicitly allow or deny federated partners. If open federation is not enabled, all partners need to be defined in the allow list. The last section is for public IM providers. An administrator can enable each of the public IM providers separately. Note that a special client access license is required for some public IM federation.

The Monitoring and Archiving tab contains policy-based settings for CDR (Call Detail Recording) and QoE (Quality of Experience) information. It also contains global and policy-based archiving settings. These are explained in great detail in Chapters 7, “Microsoft Lync Server 2010 Monitoring,” and 8, “Microsoft Lync Server 2010 Archiving.”

The second-to-last tab in the Lync Server Control Panel is Security. The registrar section has options for Kerberos, NTLM, or certificate authentication. By default, all three are enabled. The web service section covers web service authentication methods. The options are PIN authentication, certificate authentication, and enabling certificate chain download. All are enabled by default.

The final tab is Network Configuration. This section includes various policy settings for voice configuration as related to the network. Specifically, this is the area where an administrator can configure Call Admission Control (CAC) and Media Bypass policies. Additionally, administrators can configure E911 and location-specific settings for users in the location policy.

Lync Server supports DNS load balancing for multiple server pools. This is a huge benefit because hardware load-balancing configuration for SIP traffic can be difficult and requires significant troubleshooting. Many load-balancer administrators don’t understand the concept beyond balancing web traffic. Although DNS load balancing is used for SIP traffic in Lync Server, a hardware load balancer is still required for web services traffic, such as the address book service. DNS load balancing isn’t exactly round robin DNS. A proper configuration using the Company ABC environment and assuming mcsfe1 and mcsfe2 are both Enterprise Edition servers in the same pool would be configured in DNS as shown in Table 5.1.

Table 5.1 Configuration of DNS Load Balancing

When the client does an SRV record lookup as part of the automatic configuration process, the cspool.companyabc.com record is returned. From that, the DNS server returns the list of IPs assigned to cspool.companyabc.com (192.168.1.172 & 192.168.1.173). The client is programmed to choose an IP at random and register to that front end server. If the connection fails, the client tries the next random IP address in the list until it successfully registers or exhausts all the IP addresses returned by the DNS server.