External User Access Components

Microsoft Office Communications Server 2007 and Microsoft Office Communications Server 2007 R2 will reach end of support on January 9, 2018. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

 

Topic Last Modified: 2013-06-26

This section describes what components are required to enable external user access in an Office Communications Server deployment.

Feature Components

The primary component for enabling external user access is the Edge Server, which is a server role in Office Communications Server. To deploy an Edge Server, run the Office Communications Server deployment tool on a server, choosing the role of Edge Server during setup. Depending on your scaling needs, you install one or more Edge Servers in your deployment.

An Edge Server always runs the following three services:

• Access Edge service, which provides the core functionality for collaboration between your internal users and external users. The Access Edge service provides a single, trusted connection point for both outbound and inbound Session Initiation Protocol (SIP) traffic.

• Web Conferencing Edge service, which enables external users to join on-premises meetings. This service enables your users to invite external users to meetings; these external users can include your organization’s remote users, federated users, and any other external users who are sent invitations to specific meetings.

• A/V Edge service, which makes it possible to share audio and video with external users. Your users can add audio and video to meetings that include external participants, and they can share audio and video directly with an external user in point-to-point sessions. The A/V Edge service also enables your users to use the Desktop Sharing feature to collaborate with external users.

The following components are also required or recommended to enable external user access.

Perimeter Network (Required)

Edge Servers are deployed on a perimeter network (also known as a DMZ, demilitarized zone, or screened subnet). The perimeter network is a small network set up separately from your organization's internal network and the Internet. The perimeter network allows external users access to the Edge Servers while preventing access to the internal corporate network.

You can deploy your perimeter network using two firewalls or one. The two-firewall configuration is recommended. For details about firewall requirements and other guidelines for deploying the perimeter network, see Infrastructure Requirements for External User Access.

Reverse HTTP Proxy

We recommend that you deploy a reverse HTTP proxy in the perimeter network. The reverse proxy is required for the following:

• To enable external users to download meeting content for your meetings

• To enable external users to expand distribution groups

• To enable remote users to download files from the Address Book Server or submit queries to the Address Book Web Query service

• To enable clients and devices outside your organization’s intranet to obtain updates

If you already have a reverse proxy deployed to support other services, you can use it for Office Communications Server 2007 R2 as well (although it must be deployed in the perimeter network). The reverse proxy can be deployed using Microsoft Internet Security and Acceleration (ISA) Server 2006, or other Internet server software. For details, including steps for configuring a server that is running ISA Server 2006 as a reverse proxy, see Configure a Reverse Proxy in Deploying Edge Servers for External User Access in the Deployment documentation.

Director

If your organization is going to enable external access, we recommend that you deploy a Director.

A Director is a Standard Edition server or Enterprise pool that does not home users; instead, it serves as an internal next-hop server to which an Edge Server routes inbound SIP traffic destined to internal servers. The Director authenticates inbound requests and distributes them among the servers in the Enterprise pool or to the appropriate Standard Edition server.

By authenticating inbound SIP traffic from remote users, the Director relieves Enterprise pool servers from the overhead of performing authentication of remote users. It also helps insulate home servers and Enterprise pools from malicious traffic such as denial-of-service attacks; if the network is flooded with invalid external traffic in such an attack, this traffic ends at the Director, and internal users should not see any effect on performance.

Supported Topologies

Each Edge Server always runs all three Edge Server services: Access Edge service to validate external users and enable instant messaging (IM), Web Conferencing Edge service to enable external users to join on-premises meetings, and A/V Edge service to enable the sharing of audio and video with external users, and enable Desktop Sharing with external users.

You can configure one or more Edge Servers on your network, according to your performance needs. Three Edge Server topologies are supported: single consolidated edge topology, scaled consolidated edge topology, and multiple-site consolidated edge topology.

Single Consolidated Edge

In this topology, a single Edge Server computer is deployed in the data center, as shown in Figure 1.

Figure 1. Single consolidated edge topology

Scaled Consolidated Edge

In this topology, two or more Edge Server computers are deployed in the data center, with a load balancer between the perimeter network and the Internet, and another load balancer between the perimeter network and the internal network, as shown in Figure 2.

Note

The load balancer deployed between the perimeter network and the internal network must be configured to only load-balance the traffic to the Access Edge service and the A/V Edge service; it cannot load-balance the traffic to the Web Conferencing Edge service.

Figure 2. Scaled consolidated edge topology

Multiple Site Consolidated Edge

In this topology, the data center has a scaled consolidated edge topology, and one or more remote sites deploy a single consolidated edge topology or a scaled consolidated edge topology, as shown in Figure 3.

Figure 3. Multiple-site consolidated edge topology

Firewall Topologies

The recommended topology includes setting up your perimeter network between two firewalls: an external firewall and an internal firewall (as shown in Figure 1). Using two firewalls ensures strict routing from one network edge to the other, and it protects your internal network behind two levels of firewall.

A deployment using only one firewall (as shown in Figure 4) is also supported.

Figure 4. Single-firewall edge topology

Collocation

Edge Server cannot be collocated with any other Office Communications Server role.

Hardware and Software Requirements

For a list of hardware and software requirements for Edge Servers and Directors, see Internal Office Communications Server Component Requirements.

Scaling

To scale your Edge Server capabilities, simply deploy more Edge Servers in your perimeter network, and use a load balancer to spread the workload among them.

If you use a multiple-site topology, you can deploy multiple Edge Servers both in your data center and in any remote sites that require such scaling.