UCPrimer
  • Tech Blog
  • About UCPrimer.com

QuickStart: Kemp Load Balancer for Lync 2013 External Web Services

9/12/2014

0 Comments

 
Picture
With the discontinuation of Forefront TMG, Microsoft now offers either IIS ARR or Win2012 WAP as a software based solution for Lync 2013 Reverse Proxy. There is much guidance available on how to configure either of these, and while the future direction from Microsoft is WAP, each method has it's own merits as well as limitations. A good alternative is to use Virtual Load Balancers such as the VLM200 from KempTechnologies. This is a virtualized load balancer that runs on both Hyper-V and VMware so it's still a software based approach vs hardware appliance. This article walks through the steps taken to setup the latest version 7.1 VLM200 on Hyper-V as a Reverse Proxy in the Perimeter DMZ Network for a Lync Server 2013 Front End pool. Below is a generic architecture of a FE Pool with Load Balancer from Microsoft Technet:
Picture
Below is the overview of the steps involved:
1. Configure Networking
2. Load SSL Certificates
3. Add Virtual Service
1. Configure Networking
The VLM200 comes with 2 Ethernet interfaces eth0 and eth1. As a best practice, for the internet or client facing side we should use eth0 and for the internal server network facing we should use eth1. Below is the configuration of eth0 in the internet facing subnet of the Perimeter DMZ network:
Picture
Next we configure eth1 in the internal facing subnet of the Perimeter DMZ network
Picture
If not already done so, we need to set the default gateway for the internet facing eth0 interface under System Configuration->Route Management->Default Gateway:
Picture
Similar to setting up a Lync Edge server, the internal facing interface of the VLM eth1 cannot have a default gateway, so manual static routes must be created for the VLM to reach the internal servers. Usually I will add gateways for the private IP address range. We can do this under System Configuration->Route Management->Additional Routes:
Picture
Next important step is to enable the VLM to allow Real Servers on different subnet from eth1. As shown in the diagram above, the perimeter network should be and typically is in a different subnet from the internal network where the Lync servers are located. Hence the checkbox below needs to be enabled:
Picture
2. Load SSL Certificates
As this load balancer is for the external Lync web services, we need to load a public SSL certificate into the VLM. Simply purchase a SSL certificate from a well-known public CA such as GoDaddy. The certificate SN must be the external Lync web services FQDN. For this lab Windows Server was used to generate the CSR which as then submitted to the public CA provider. Detailed steps for generating the CSR can be found in TechNet. After receiving the certificate from the CA provider, we import the SSL cert back to the same Windows Server and then export it along with the private key to a .pfx file. We then load this .pfx file into VLM under Certificates->SSL Certificates:
Picture
As advised by GoDaddy we also import the intermediate certs into VLM under Certificates->Intermediate Certs:
Picture
3. Add Virtual Service
Now we are ready to add the virtual service for the external Lync web services. Before doing this, it's useful to first install the templates provided by Kemp to simplify configuration and reduce errors. These templates can be downloaded from the Kemp website and installed into the VLM as shown below:
Picture
Next, under we navigate to Virtual Services->Add New and specify the virtual IP address that the VLM will listen on for external Lync web services traffic. If you have a NAT then this IP address much map to the public NAT'ed IP address. We can also specify the Lync Reverse Proxy 2013 template for this: 
Picture
Next we specify the public SSL certificate that was just imported to be used for this service:
Picture
Next, we add the IP addresses of all the servers in the Lync FE Pool as Real Servers. Note that the Allow Remote Addresses should be checked since the FE Pool is on an internal subnet which is different from the Perimeter DMZ subnet:
Picture
Once we add the Real Servers the VLM will contact the Lync FE servers to check for status. The Status of the service will be shown as "Up" in green as long as one FE server is reachable by the VLM. A red IP address under the "Real Servers" column indicates that the VLM is unable to reach that server:
Picture
Conclusion
As can be seen, configuring the Kemp as a load balancer for Lync external web services is very straightforward and made even simpler by the templates that Kemp provides. Compared with setting up TMG Forefront or IIS ARR, Kemp offers a much easier configuration experience. Keep up the good work Kemp!
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Picture
    Picture

    Important Links

    Microsoft Teams Docs
    Microsoft Learn

    ​Microsoft MVP Blogs

    Michael Tressler’s Blog
    Michael’s MTR Quick Tip Videos
    Jimmy Vaughan’s Blog
    Jeff Schertz
    Adam Jacobs
    James Cussen
    ​Damien Margaritis

    Archives

    September 2022
    August 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    June 2021
    April 2021
    March 2021
    December 2020
    October 2020
    September 2020
    August 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    March 2019
    November 2018
    October 2018
    September 2018
    August 2018
    June 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    August 2017
    July 2017
    April 2017
    March 2017
    February 2017
    January 2017
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    January 2016
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    July 2014
    June 2014
    May 2014
    April 2014
    March 2014
    February 2014
    January 2014
    December 2013
    November 2013
    October 2013
    September 2013
    August 2013
    July 2013
    June 2013
    May 2013
    April 2013
    March 2013
    February 2013
    January 2013
    December 2012
    November 2012
    September 2012
    August 2012

    Categories

    All
    Edge
    Exchange 2013
    Hybrid
    Lpe
    Lync 2010
    Lync 2013
    Mobility
    Oauth
    Office365
    Polycom
    Ucs

    RSS Feed

    This website uses marketing and tracking technologies. Opting out of this will opt you out of all cookies, except for those needed to run the website. Note that some products may not work as well without tracking cookies.

    Opt Out of Cookies