Enabling Edge Server Features

To enable Edge Servers to process remote access and federation requests, the Access Edge configuration must be updated to enable these features. Figure 6.3 shows a sample policy configuration. Use the following steps to enable Access Edge features to the Lync Server infrastructure:

1. Open the Lync Server Control Panel.

2. Select Federation and External User Access in the navigation pane.

3. Click Access Edge Configuration.

4. Highlight the Global policy, and then click Edit and then Modify.

5. Check the Enable Federation and Public IM Connectivity box.

6. If DNS SRV lookups are allowed to discover federated partners, check the Enable Partner Domain Discovery box.

7. If an archiving disclaimer should be sent to federated contacts when initiating an IM conversation, check the Send Archiving Disclaimer to Federated Partners box.

8. Check the Enable Remote User Access box.

9. If the web conferencing service enables anonymous external participants, check the Enable Anonymous User Access to Conferences box.

10. Click Commit to accept the changes.

Figure 6.3. Access Edge configuration.

Alternatively, the Lync Server Management Shell can be used to configure the following setting:

Set-CSAccessEdgeConfiguration –AllowOutsideusers $true –AllowFederatedUsers $true – EnablePartnerDiscovery $true –EnableArchivingDisclaimer $true AllowAnonymousUsers $true

Some additional options are available for Access Edge Server configuration that are not exposed in the Lync Server Control Panel. The following parameters can also be used as part of the Set-CSAccessEdgeConfiguration cmdlet to configure external access:

• BeClearingHouse—This has a true or false value indicating whether the Access Edge Servers are directly connected to other organizations. A clearinghouse Access Edge Server can be used to support direct federation between multiple organizations. It can also be considered a federation gateway for multiple internal Lync Server deployments. Typically, this value is false.

• CertificatesDeletedPercentage—New to Lync Server 2013, this setting controls the percentage of Trusted Certificate entries that are deleted during certificate maintenance.

• DefaultRouteFQDN—This is used to override a default federation route. If it is required to proxy client connections through a specific server for federation, this parameter can be entered. This parameter must be used in conjunction with the UseDefaultRouting parameter.

• EnableDiscoveredPartnerContactsLimit—This has a true or false value. By default, any federated partners that are discovered automatically have a contact limit imposed. This setting can be used to disable that contact limit by default.

• UseDefaultRouting—This has a true or false value indicating whether the Access Edge Servers will use a manually entered default route FQDN. This value is false by default, which enables Access Edge Servers to use DNS SRV records for routing federation requests.

• KeepCRLsUpToDateForPeers—This has a true or false value indicating whether the Access Edge Servers will periodically check whether a partner’s certificate is still valid based on the CRL. This parameter is true by default.

• MarkSourceVerifiableOnOutgoingMessages—This has a true or false value indicating whether the Access Edge Servers mark outgoing messages from a verified source. This enables partners to assign a higher level of trust to messages they receive from an organization marking messages as verifiable. This parameter is true by default.

• MaxAcceptedCertificatesStored—New to Lync Server 2013, this setting allows administrators to control the maximum number of trusted certificates that are stored on each Edge Server. The default value is 1000.

• MaxContactsPerDiscoveredPartner—By default, any federated partners that are discovered automatically have a contact limit of 1,000 imposed. This setting can be used to decrease or increase that limit.

• OutgoingTLSCountForFederatedPartners—This is a numeric value from 1 to 4 indicating the maximum number of connections that can be used for a federated partner. The default value is 4, but if connections should be more limited, this value can be reduced.

• VerificationLevel—If you are using default routing, the VerificationLevel property is used to monitor and assess the verification level of incoming messages. These are the valid values:

• AlwaysVerifiable—All requests received on the default route are marked as verified. If a verification header is not present, it automatically is added to the message.

• AlwaysUnverifiable—Messages are passed only if the addressee (the user the message is intended for) has configured an Allow ACE (access control entry) for the person who sent the message.

• UseSourceVerification—Message verification is based on the verification level included with the message. If no verification header is present, the message is marked as unverified.