SNAT and Tranpanrency on Load Balancer (general) - also valid for Skype for Business

-
The KEMP LoadMaster combines versatility with ease-of-use to speed deployment of the complete portfolio of advanced messaging applications and protocols used by Microsoft Lync Server 2010/ 2013. Layer 7 health checking at the LoadMaster ensures that should one of the servers become inaccessible, the load balancer will take that server off-line, while automatically re-routing and reconnecting users to other functioning servers.

The entire KEMP LoadMaster product family, including the Virtual LoadMaster (VLM) supports Microsoft Lync 2010/ 2013, and includes a comprehensive first year warranty and technical support agreement.

Microsoft Lync Server 2010/ 2013 supports two load balancing solutions: DNS load balancing and hardware load balancing. You can choose different load balancing solutions for each pool in your deployment. Hardware load balancers are also required to provide load balancing for the internal and external web services when DNS load balancing is used.

Overview of High Availability options per Lync Server Role





Load balancers can be configured to support Network Address Translation (NAT) using one of the following modes:

Full-NAT (SNAT) mode (also known as proxy, secure NAT, source NAT, or SNAT mode). In full-NAT mode, both the source and IP destinations are changed as packets pass through the load balancer.

Half-NAT (DNAT) mode (also known as transparency, destination NAT, DNAT mode or Load Balancers Default Gateway LBDG). In half-NAT mode, the destination IP address is changed as packets pass through the load balancer, but the source IP address remains intact.

Load balancing using Direct Server Return configuration is not supported.

The following table describes the supported configurations for full-NAT and half-NAT modes in Microsoft Terms:



Kemp Terminology:
Full-NAT (SNAT) mode is the equivalent of KEMP Non-transparency mode.

Half-NAT (DNAT or LBDG) mode is the equivalent of KEMP Transparency mode.

How to configuring NAT options:

In an later blog post, I will explain more in detail how to setup KEMP Load Balancer.
I will show you the Hyper-V general setup, as well as the main configuration.

Comments

  1. AnonymousApril 9, 2013 at 8:05 AM

    Mr Thomas, Just want to ask one question here.. for scale consolidated edge with HLB.. does it support SNAT or need to do the IP forwarding from the HLB?

    ReplyDelete
  2. Thomas PoettApril 16, 2013 at 5:29 PM

    Hi,
    there is a bit more you have to know about Edge Server.
    Generally, you have a good explanation here:
    http://technet.microsoft.com/en-us/library/jj656815.aspx

    This also depends on how you setup a HLB, one/ two armed.

    ReplyDelete

Post a Comment

Popular posts from this blog

How to hide users from GAL if they are AD Connect synchronized

-
Image
How to hide and un-hide users from Global Address List (GAL) in Exchange Online if they are AD Connect synchronized Hiding User from GAL isn't possible if those are synchronized form On-Premises Active Directory. The local AD is the leading system for all important attributes, like SMTP, UPN and hiding from GAL. Especially during a cross-tenant migration, you do not want to see not migrated user in the GAL. Those User aren't actively working until their cut-over day. Since the Exchange Online attribute  msExchHideFromAddressList s is an AD on-premises parameter, we have two possible ways hiding user in BME from GAL.   Modify the AD Connect for your teant with a custom rule, by using a extensionAttribute to set the HidefromGAL. In this rule, for users which have an entry in the extensionAttribute, hiding / un-hiding will be controlled by AD Connect This is the best option for Cross-Tenant Migration, if you run 2 or more AD Connect system We direct modify the AD hide at
Read more

Cannot join external Lync Meeting: Lync Edge Server Single IP Address (Lync Edge Server Single IP Web Conferenceing Problem)

-
Image
Lync Edge Server FQDN and IP PORTS (Version 1.2, Update 26.11.2014) As we all know, we can configure Lync Edge Server in several way. 1) Single Edge Server with a SINGLE IP ADDRESS 2) Single Edge Server with MULTIPLE IP ADDRESSES (3x IPs) 3) Multiple Edge Server in a Pool, with MULTIPLE IP ADDRESSES (Zx 3 IPs) Regardless what we are going to configure, there are common / well-known TCP Port necessary making Lync work, which are: Access: Port: 443 and 5061 Conferencing: Port: 443 and (444) AV: Port: 443 (I have not listed other ports, e.g. STUN or the dynamic port range. This is not required for the topic discussed here) External FQDN with single IP address: What can we see here? If we are going to choose a single IP address, we would have TCP Port overlapping. Therefore the only way avoiding this is assigning other ports. Additionally we will also see and are reminded that Lync highly depends on DNS. If we have single IP, we must have use single, unique FQDN fo
Read more

MFA with Guest Access and different tenants settings

-
Image
There is an update regarding MFA Multi Factor Authentication. If you are guest with a different Tenant, the MFA Settings are now reflecting the settings of all tenants in a different way. Each MFA setting is reflected and you can setup your MFA device as per tenant and the admin settings allow. Login to your Profile in Office 365/ Azure AD: https://account.activedirectory.windowsazure.com/r/#/profile or https://myapps.microsoft.com Go to your PROFILE: Sign in to https://myapps.microsoft.com Select your account name in the top right, then select profile. Select Additional security verification. If might be happen, your admin hast configured MFA, so you wouldn't see this menu. Simply switch the tenant to the guest tenant where you need to configure MFA. Once you go back to your profile and you will find the MFA device and other settings a usual:
Read more