Publicly Routable IP Addresses

One consideration when planning for Edge services is that each Lync Edge Server should use three separate publicly routable IP addresses: one for the Access Edge service, one for the Web Conferencing Edge service, and one for the A/V Edge service. All three of these services run on TCP 443, so Lync requires a separate IP address for each unique service. It is possible to run all three services on a single IP address and use non-default ports for some services, but this approach is not recommended.

A decision point for organizations is to determine whether they will assign publicly routable IP addresses directly to the Edge Server adapters, or whether Network Address Translation (NAT) will be used. The deciding factor in that discussion will usually be whether an organization already has a perimeter network segment that uses publicly accessible IP addresses for servers or devices.

Using publicly routable IP addresses on the Edge Server adapter is a perfectly valid design choice, but this suggestion is typically met with a negative reaction from network security teams that are accustomed to using NAT to allow external access to any service. It is important to note that NAT is not a method of security. Instead, it is designed to accommodate a shortage of IPv4 addresses, and although it might mask a server’s internal IP address, as long as the external ports are available NAT does not provide any extra security.

This is not to suggest that an Edge Server external interface should be exposed to the public Internet. Even though publicly routable IP addresses can be bound to the network adapter, the servers are still logically behind a firewall device that limits the ports and protocols allowed to reach the Edge Server. The only difference is that the IP addressing used is part of the public address space instead of a privately addressable space.

The reason for the publicly routable network requirement is because of how the A/V Edge role uses Interactive Connectivity Establishment (ICE), Session Traversal Utilities for NAT (STUN), and Traversal Using Relay NAT (TURN) to facilitate media traffic between endpoints that might be masked by NAT, such as two users at home behind their own routers. Without delving into too many of the technical details, this requirement comes from the fact that in order for two remote users to communicate, they must be able to send media directly to each other, or both relay their traffic through some common ground such as a Lync Edge Server.