Network-Based Firewalls

Most implementations of Lync Server involve some form of a network-based firewall, usually in the DMZ (Demilitarized Zone). The purpose of this device is to ensure that only the necessary services on the Lync Server systems are made available externally. Although an administrator might want external users to reach an Edge Server on port 443 for a web-based client, it is probably not desirable for users on the Internet to be able to map a drive to the Edge Server on port 445.

To maximize security, it is fairly common to configure the external services of Lync Server so that not only is there a firewall between the Internet and the Lync Server servers, but that there is also a firewall between the internal network and the Lync Server servers. This can be accomplished either with dual firewalls, or by placing the Lync Server servers into a DMZ on a three or more legged firewall. Dual firewalls are technically more secure because if an attacker compromised the firewall that was exposed externally, he or she must still compromise a second firewall before having access to the internal hosts.

The first step in implementing this type of firewall for Lync Server is to understand what services you plan to make available from outside the network and then to determine exactly which ports and protocols need to be opened on the firewall.