QuickStart: Kemp Load Balancer for Lync 2013 External Web Services

With the discontinuation of Forefront TMG, Microsoft now offers either IIS ARR or Win2012 WAP as a software based solution for Lync 2013 Reverse Proxy. There is much guidance available on how to configure either of these, and while the future direction from Microsoft is WAP, each method has it's own merits as well as limitations. A good alternative is to use Virtual Load Balancers such as the VLM200 from KempTechnologies. This is a virtualized load balancer that runs on both Hyper-V and VMware so it's still a software based approach vs hardware appliance. This article walks through the steps taken to setup the latest version 7.1 VLM200 on Hyper-V as a Reverse Proxy in the Perimeter DMZ Network for a Lync Server 2013 Front End pool. Below is a generic architecture of a FE Pool with Load Balancer from Microsoft Technet:

Below is the overview of the steps involved:
1. Configure Networking
2. Load SSL Certificates
3. Add Virtual Service

1. Configure Networking
The VLM200 comes with 2 Ethernet interfaces eth0 and eth1. As a best practice, for the internet or client facing side we should use eth0 and for the internal server network facing we should use eth1. Below is the configuration of eth0 in the internet facing subnet of the Perimeter DMZ network:

Next we configure eth1 in the internal facing subnet of the Perimeter DMZ network

If not already done so, we need to set the default gateway for the internet facing eth0 interface under System Configuration->Route Management->Default Gateway:

Similar to setting up a Lync Edge server, the internal facing interface of the VLM eth1 cannot have a default gateway, so manual static routes must be created for the VLM to reach the internal servers. Usually I will add gateways for the private IP address range. We can do this under System Configuration->Route Management->Additional Routes:

Next important step is to enable the VLM to allow Real Servers on different subnet from eth1. As shown in the diagram above, the perimeter network should be and typically is in a different subnet from the internal network where the Lync servers are located. Hence the checkbox below needs to be enabled:

2. Load SSL Certificates
As this load balancer is for the external Lync web services, we need to load a public SSL certificate into the VLM. Simply purchase a SSL certificate from a well-known public CA such as GoDaddy. The certificate SN must be the external Lync web services FQDN. For this lab Windows Server was used to generate the CSR which as then submitted to the public CA provider. Detailed steps for generating the CSR can be found in TechNet. After receiving the certificate from the CA provider, we import the SSL cert back to the same Windows Server and then export it along with the private key to a .pfx file. We then load this .pfx file into VLM under Certificates->SSL Certificates:

As advised by GoDaddy we also import the intermediate certs into VLM under Certificates->Intermediate Certs:

3. Add Virtual Service
Now we are ready to add the virtual service for the external Lync web services. Before doing this, it's useful to first install the templates provided by Kemp to simplify configuration and reduce errors. These templates can be downloaded from the Kemp website and installed into the VLM as shown below:

Next, under we navigate to Virtual Services->Add New and specify the virtual IP address that the VLM will listen on for external Lync web services traffic. If you have a NAT then this IP address much map to the public NAT'ed IP address. We can also specify the Lync Reverse Proxy 2013 template for this: 

Next we specify the public SSL certificate that was just imported to be used for this service:

Next, we add the IP addresses of all the servers in the Lync FE Pool as Real Servers. Note that the Allow Remote Addresses should be checked since the FE Pool is on an internal subnet which is different from the Perimeter DMZ subnet:

Once we add the Real Servers the VLM will contact the Lync FE servers to check for status. The Status of the service will be shown as "Up" in green as long as one FE server is reachable by the VLM. A red IP address under the "Real Servers" column indicates that the VLM is unable to reach that server:

Conclusion
As can be seen, configuring the Kemp as a load balancer for Lync external web services is very straightforward and made even simpler by the templates that Kemp provides. Compared with setting up TMG Forefront or IIS ARR, Kemp offers a much easier configuration experience. Keep up the good work Kemp!