DNS Records for Skype for Business Hybrid Installation

-

DNS Configuration for Skype for Business Hybrid Deployments


 DNS settings are important and you need to understand how your organizations Skype for Business communication flow works.

 First important understanding:
If you run a hybrid installation, your Office 365 Tenant with Skype for Business Online is seen from your On-Premise installation as a federated organization.


Therefore the following DNS records must also be resolvable from your internal DNS infrastructure (Edge Server).
Depending on how DNS is configured in your organization, you may need to add these records to the internal hosted DNS zone for the corresponding SIP domain(s) to provide internal DNS resolution to these records. (see illustration below table)


DNS RECORD
RECORD TYPE
WHERE IT SHOULD RESOLVE TO
PORT
sip.YourDom.com
A
Public IP of Access Edge
n/a
_sip._tls.YourDom.com
SRV
External on-premises Access Edge Interface (sip. YourDom.com)
443
_sipfederationtls._tcp.
YourDom.com
SRV
External on-premises Access Edge Interface (sip. YourDom.com)
5061
webcon.YourDom.com
A
Public IP of Access Edge
n/a
av.YourDom.com
A
Public IP of Access Edge
n/a


Illustration for DNS Best Practice:

(Click the illustration to enlarged)

The internal Clients, will not query the _sip._tls or _sipfederationtls._tcp records, but your Edge will do. Therefore the illustration above should provide you with an idea on how setting up DNS.

 Remember, only the Edge is requiring the both DNS SRV record, not any internal system.
In case you decide not having a HOSTS file, this both drawing will also work, since this with or without SPLIT DNS, the internal DNS servers will provide the correct DNS records to the Edge Server.

Errors in SNOOPER:

An indication for DNS misconfiguration is for example a one-way Presence, where the external partner can see your presence, even is able calling your. But from your side no outbound presence or call are possible.

 Possible seen error with a wrong setup:
SIP communication:
ms-diagnostics: 1008;reason="Unable to resolve DNS SRV record";domain=YourDom.com";dns-srv-result="NegativeResult";dns-source="InternalCache";source="YourDom.com"


Conferencing Setup:
<diagHeader>1008;reason="Unable to resolve DNS SRV record";domain="YourDom.com";dns-srv-result="NegativeResult";dns-source="InternalCache";source="sip.YourDom.com"</diagHeader>


Important Best Practice:
Your Edge Servers should be configured with HOSTS file and external DNS resolution. If you fail doing so, you might consider configuring Split DNS with the external DNS Records (see table) on your internal DNS SIP Domain.


Understanding Hybrid Deployments on Technet:
https://technet.microsoft.com/en-us/library/jj205403.aspx

 Troubleshooting Hybrid Deployment on Technet:
https://support.microsoft.com/de-de/help/2566790/troubleshooting-skype-for-business-online-dns-configuration-issues-in-office-365


Author:

Comments

  1. Fernando GualanoSeptember 12, 2017 at 4:45 PM

    Hi Thomas! It's a great post! Thanks! I have a question to you: in my environment, I have SPLIT DNS Domain and the EDGE server has not external DNS resolution. In instead, they has internal DNS servers on the external NIC because there are not DNS servers in DMZ network. i didn't find any document in technet where said that I need to create the DNS records that you indicated in the table. I found only this article: https://technet.microsoft.com/en-us/library/jj205403.aspx: DNS SRV record for _sipfederationtls._tcp. for all supported SIP domains resolving to Access Edge external IP(s) | DNS A record(s) for Edge Web Conferencing Service FQDN, e.g. webcon.contoso.com resolving to Web Conferencing Edge external IP(s). My question is if I need to create the following DNS records: sip._tls.YourDom.com and av.YourDom.com in my internal DNS zone. In other words, what DNS records should the EDGE server resolve? Thank you! Fernando

    ReplyDelete
    Replies
    1. Thomas PoettSeptember 13, 2017 at 12:35 PM

      Hi, yes, you need all DNS records available from your Edge Server. Meaning, your Edge must resolve all of the above DNS record on your internal DNS with IPs from your external Edge Server. Whereby WebConf resolve the WebConf IP and AV mus resolve the external AV IP. everything else resoves the Access IP

      Delete
  2. UnknownApril 12, 2019 at 2:01 AM

    Not really a fan of terms like external IP as this is still misleading to me. Does this refer to external IP as in external public IP address or edge servers external nic IP address. I would presume public IP but as you know there are many externals in an edge reference.

    ReplyDelete

Post a Comment

Popular posts from this blog

How to hide users from GAL if they are AD Connect synchronized

-
Image
How to hide and un-hide users from Global Address List (GAL) in Exchange Online if they are AD Connect synchronized Hiding User from GAL isn't possible if those are synchronized form On-Premises Active Directory. The local AD is the leading system for all important attributes, like SMTP, UPN and hiding from GAL. Especially during a cross-tenant migration, you do not want to see not migrated user in the GAL. Those User aren't actively working until their cut-over day. Since the Exchange Online attribute  msExchHideFromAddressList s is an AD on-premises parameter, we have two possible ways hiding user in BME from GAL.   Modify the AD Connect for your teant with a custom rule, by using a extensionAttribute to set the HidefromGAL. In this rule, for users which have an entry in the extensionAttribute, hiding / un-hiding will be controlled by AD Connect This is the best option for Cross-Tenant Migration, if you run 2 or more AD Connect system We direct modify the AD hide at
Read more

Cannot join external Lync Meeting: Lync Edge Server Single IP Address (Lync Edge Server Single IP Web Conferenceing Problem)

-
Image
Lync Edge Server FQDN and IP PORTS (Version 1.2, Update 26.11.2014) As we all know, we can configure Lync Edge Server in several way. 1) Single Edge Server with a SINGLE IP ADDRESS 2) Single Edge Server with MULTIPLE IP ADDRESSES (3x IPs) 3) Multiple Edge Server in a Pool, with MULTIPLE IP ADDRESSES (Zx 3 IPs) Regardless what we are going to configure, there are common / well-known TCP Port necessary making Lync work, which are: Access: Port: 443 and 5061 Conferencing: Port: 443 and (444) AV: Port: 443 (I have not listed other ports, e.g. STUN or the dynamic port range. This is not required for the topic discussed here) External FQDN with single IP address: What can we see here? If we are going to choose a single IP address, we would have TCP Port overlapping. Therefore the only way avoiding this is assigning other ports. Additionally we will also see and are reminded that Lync highly depends on DNS. If we have single IP, we must have use single, unique FQDN fo
Read more

MFA with Guest Access and different tenants settings

-
Image
There is an update regarding MFA Multi Factor Authentication. If you are guest with a different Tenant, the MFA Settings are now reflecting the settings of all tenants in a different way. Each MFA setting is reflected and you can setup your MFA device as per tenant and the admin settings allow. Login to your Profile in Office 365/ Azure AD: https://account.activedirectory.windowsazure.com/r/#/profile or https://myapps.microsoft.com Go to your PROFILE: Sign in to https://myapps.microsoft.com Select your account name in the top right, then select profile. Select Additional security verification. If might be happen, your admin hast configured MFA, so you wouldn't see this menu. Simply switch the tenant to the guest tenant where you need to configure MFA. Once you go back to your profile and you will find the MFA device and other settings a usual:
Read more