External to internal Internal to internal The internal perimeter network it significantly more restrictive than the external perimeter as it is the last line of defense against attack. Revert to your Design: The following information provided is for illustration only. Please consult your Low Level Design for correct values that are applicable The following table displays the firewall rules required for each Skype for Business Edge Server Internal Firewall Rules (Reverse Proxy) Service Source IP Source Port Protocol Destination IP Destination Port Destination Protocol Logging Front End Server IP Any TCP Edge Internal IP TCP XMPP Front End Server IP Any TCP Edge Internal IP 23456 TCP SIP Front End Server IP Any TCP Edge Internal IP 5061 TCP SIP Edge Internal IP Any TCP Front End Server IP 5061 TCP SIP Front End Server IP Any TCP Edge Internal IP 5062 TCP Media Any Internal IP Any UDP Edge Internal IP 3478 UDP Media Any Internal IP Any TCP Edge Internal IP 443 TCP Replication Front End Server IP Any TCP Edge Internal IP 4443 TCP RDP Network IP Any TCP & UDP Edge Internal IP 3389 TCP&UDP CRL Edge Internal IP Any TCP CRL Web Distribution Point 80 TCP CA Edge Internal IP Any TCP Certificate Web Enrollment Service IP 443 TCP 50003
Mediation All Front End Servers Any TCP All Front End Servers 5070 TCP PSTN SBC IPs Any TCP All Front End Servers 5067 - 5068 TCP PSTN All Front End Servers Any TCP All SBC IPs 5081 – 5082 TCP App Share All Internal IPs Any TCP All Front End Servers 5065 TCP App Share All Internal IPs Any TCP All Front End Servers 49152 - 65535 TCP Announce All Internal IPs Any TCP All Front End Servers 5073 TCP Call Park All Internal IPs Any TCP All Front End Servers 5075 TCP Audio Test All Internal IPs Any TCP All Front End Servers 5076 TCP E911 All Front End Servers Any TCP E911 Gateway 5066 TCP RGS All Internal IPs Any TCP All Front End Servers 5071 TCP RGS All Internal IPs Any TCP All Front End Servers 8404 TCP Bandwidth All Internal IPs Any TCP All Front End Servers 5080 TCP Bandwidth All Internal IPs Any TCP All Front End Servers 448 TCP Replicate All Front End Servers Any TCP All Front End Servers 445 TCP
WAC All Front End Servers Any TCP All WAC servers 443 TCP Director Servers All Skype for Business Director Servers Internal Rules Service Source IP Source Port Protocol Destination IP Destination Port Destination Protocol SIP Front End Servers Any TCP Mediation Server IP 5060 TCP Internal All Director Servers Any TCP All Directors and Front End Servers 444 TCP Web All Director Servers Any TCP All Front End Servers 80 TCP Web All Director Servers Any TCP All Front End Servers 443 TCP SIP All internal client networks Any TCP Director server IP 5061 TCP Mediation Servers All Skype for Business Mediation Servers Internal Rules Service Source IP Source Port Protocol Destination IP Destination Port Destination Protocol SIP Front End Server IP Any TCP Mediation Server IP 5070 TCP SIP PSTN Gateway Any TCP Mediation Server IP 5067 – 5068 TCP SIP Mediation Server IP Any TCP PSTN Gateway 5067 – 5068 TCP SIP Mediation Server IP Any TCP Front End Server IP 5070 TCP Persistent Chat Servers
Installation & Admin Accounts To install Skype for Business Server, it is recommended to create a dedicated installation account with the required permissions to servers, resources and supporting applications. Whilst the installation rights can be delegated into a least privileged model, experience shows that this can be problematic. For the purpose of this book, I am using least administrative effort. The following table contains a list of user accounts that need to be provisioned ahead of the installation. User Accounts Username Security Group Membership Role Domain\skypeinstall Enterprise Admins Schema Admins Domain Admins Local Administrators SysAdmin on SQL Instances RTCUniversalServerAdmins CsAdministrator Installation Account Domain\SkypeAdmin Domain Users CsAdministrator Administrative Account Domain\SkypeUser1 Domain Users End User Test Account Domain\SkypeUser2 Domain Users End User Test Account Domain\SkypeUser3 Domain Users End User Test Account Group membership to CsAdministrator can only be granted once forest and domain preparation has been performed. Please do not create this group manually. Domain Names Domain names are an important consideration when deploying Skype for Business. Skype for Business depends on what is referred to as a SIP domain. The SIP domain is like any other namespace and is often the same name as the businesses E-mail domain. In order to communicate to the outside world using federation or hybrid features, this SIP domain must be publically routable. By publically routable, I mean this domain must be resolved across the internet and therefore contain a supported Top Level Domain (TLD) i.e. .com or .co.uk etc. Employing a namespace with internal TLDs such as .local and .internal, although will work for internal communications, will not be supported for external access, mobile connectivity, federation and hybrid scenarios. Within Skype for Business you can add your SIP domains (e.g. hostedhouse.co.uk) into the configuration even though your internal Active Directory Domain name may be hostedhouse.local or instance.
Open the data-files directory and create two more folders called “User-Data” and “System-Data” Open the Log-Files directory and create a folder called User-Logs Open the TempDB directory and create another folder called “Temp-DATA” Repeat Steps 1 to 9 on the second SQL server node In Active Directory Users and Computers, create a Cluster Name Object. This CNO will be detailed in your Low Level Design e.g SkypeSQLAO-01 Add both SQL node computer accounts to the CNO security permissions and assign full control privileges Installing Failover Cluster for AlwaysOn Windows Failover Cluster (FCI) is required to cluster the operating systems of each SQL node to participate in AlwaysOn. SQL is installed on both nodes as local applications rather than inside the FCI as in traditional clustering. This means as well as all local drive letters and folder hierarchies used must be identical across both nodes, the instance installed must also match. In a two node FCI, a witness is required to maintain cluster quorum. This can be either a file share on a server outside the cluster, or by shared hard disk using iSCSI or Fiber connections to both servers. Please revert to your Low Level Design for the quorum witness method for your deployment. For the purpose of this guide, a shared disk witness will be used. Install the Windows Clustering feature on both SQL nodes Open failover clustering console on one node, and click Create Cluster Press next to begin, add in both SQL nodes that will participate in the cluster and press next Enter the cluster name object created in the pre-requisites section, and enter an available IP address for the cluster, press next Deselect add all available storage to the cluster, and press next Press finish when the cluster creation has finished. There will be warnings regarding no quorum disk found, however, this will be resolved in the following steps. Select the cluster you created in failover cluster console and click validate cluster Press next, through the wizard until the checks are performed It is normal at this stage for the validation to produce warnings, but no failures should be present. Expand storage in the cluster and select Pools and click New Storage Pool Provide a Name for the storage pool e.g Pool01, and press next Add all your available primordial storage to the pool and press next Press Create to create the pool Verify the pool is online and healthy by viewing failover cluster manager
UM Call Router All Servers Any TCP Exchange CAS IP 5061 TCP UM Service All Servers Any TCP Exchange MBX Servers 5063 TCP UM Service All Servers Any TCP Exchange MBX Servers 5065-5068 TCP UM Service All Servers Any UDP Exchange MBX Servers UDP Please note that the UDP port range 1024-65535 can be reduced by editing the Exchange UM configuration file msexchangeum.config located in the bin directory of the Exchange application folder. UM Firewall Rules (Exchange 2010) Service Source IP Source Port Protocol Destination IP Destination Port Destination Protocol UM Service All Servers Any TCP Exchange UM Server IP 5061 TCP UM Service All Servers Any TCP Exchange UM Server IP 5063 TCP UM Service All Servers Any TCP Exchange UM Server IP 5065-5068 TCP UM Service All Servers Any UDP Exchange UM Server IP UDP HTTPS Any Any TCP Exchange UM Server IP 443 TCP Integration Dependencies Integration describes the following functionality: