Understanding Cloud Connector Edition (CCE) Network Design

Understanding Cloud Connector Edition (CCE) Network

CCE virtual machines

First I like to introduce the internal VM structure to CCE again. We will from here understand better the requirement for virtual networks.

We require network connection to the internet, the SBC and the virtual machines themselves.

PICTURE: CCE Network 00.png

 

The Cloud Connector Edition is built with 4 virtual machines, a subset from a typical on-premise deployment.

Domain Controller:
supporting the internal CCE PKI and the authentication for “CCE domain joint” machines.
Single NIC (internal VM only)

CMS:
contains the subset for the Skype for Business relevant minimalistic Topology
Single NIC (internal VM only)

Mediation Server:
Codec transcoding unit for the Session Boarder Controller, between the RTP data stream from Office 365 and Skype for Business Clients to the SBC.
Single NIC (internal VM and SBC on same subnet only)

NOTE:
The Mediation likewise the on-premise setup doesn’t allow a dual NIC setup. More over the SBC can be with on the same vNET or routed into the LAN.

Edge Server:

The Edge connects the rest of the CCE VMs with Office 365 tenant over the internet.
Dual NIC (internal VM and Internet)
 

CCE Network Switches in Hyper-V

Core to the CCE image installation is the ISO -> VHDX conversion. This process is generating the VM including their owned disks. The Windows Server ISO image is taken from a local storage (HDD) . Additionally, it requires a Windows Update process before the generalization occurs. This is done via temporary IP address assigned to the SfB CCE Corpnet Switch and uses a temporary IP from the BaseVMIP parameter, it must reach out to the Internet for Windows Updates.

In total we need to provide three (3) virtual switches in Hyper-V:

 

§  SfB CCE Corpnet Switch
The Corpnet enabled the VMs accessing each other (all VMs on this HOST), allows RDP into the VM, allows Skype for Business Clients to connect to the Mediation Server and connects the Mediation Server to the PSTN Gateway. It is also used for Windows and SfB Updates and required an Internet connection.

§  SfB CCE Management Switch

The management switch to provides temporary network connectivity of host and VMs during the VM deployment and will be disconnected after provisioning. ManagementIPPrefix in MUST be configured as different subnet from other internal IPs.

§  SfB CCE Internet Switch
Only used for Edge external access to the DMZ1 which is internet facing.

The parameter in the CCE CloudConnector.ini file represent the virtual switch names (vSwitch). They are not subject to chance and should be kept.

Those parameters are used during the setup scripting for VM installation.

PARAMETER	VALUE
ManagementSwitchName	SfB CCE Management Switch
InternetSwitchName	SfB CCE Internet Switch
CorpnetSwitchName	SfB CCE Corpnet Switch

 

PICTURE: CCE Network 01.png

CCE typical Network setup in Hyper-V

The CCE usability is defined with two possible access point, where the Skype for Business is either in the internal LAN or it outside the corporate network (Internet or any other LAN, e.g. Home Office).

Next we are discussing the position where the CCE and it SBC should be located. Since the CCE has it Edge Server, we shouldn’t place the CCE into the internal LAN. Best approach is the dedicated DMZ segment.

It plays a minor role if the SBC (ox IP-PBX) is within the sale DMZ or located on the internal LAN. This Media stream can be handled through a firewall without NAT. Same applies to the internal Skype for Business client.

As general security advice, the illustration below is the best approach and will isolate the CCE within its own DMZ.

 

PICTURE: CCE Network 03.png

 

If we have a look into the more detailed setup approach, where we wish the SBC is placed inside the CCE own DMZ, the firewalls are located on the external, Internet facing and the internal LAN facing connectivity paint.

 

NOTE:
The internal firewall must NOT have NAT enabled. A straight routing is required.

This illustration doesn’t reflect the entire routing, with either gateways nor static routes. But in general the Internet facing vNET required a default route in the direction of the Internet (0.0.0.0 -> GW INET). While the internal, LAN directed vNET, require a static route in the form of e.g. 10.0.0.0/8 -> GW-LAN

 

PICTURE: CCE Network 02.png

 

The last I wish highlighting again is:

You shouldn’t change the generic CCE vSwitch structure manually. The CCE deployment will fail if you do so. Same applies to the vSwitch naming. The setup is case sensitive, so please keep an eye on your typing’s.

If you deploy the CCE on a dedicated physical host (server) or you are choosing an Appliance, the network design is identical.

Author: Thomas Poett MVP, Business Unit Lead Microsoft Unified Communication