Using Network Address Translation (NAT) with Lync Server

If a single Edge Server is placed behind a firewall, it is acceptable to enable NAT. NAT effectively takes packets bound for the firewall and forwards them to hosts inside the firewall based on port rules. This enables a company with limited numbers of routable IP addresses to support multiple services with fewer IP addresses. It also provides a layer of security by requiring the firewall to process the packet first before it reaches the eventual destination. In addition, it enables protected systems to hide their IP information because they never appear to be a source of a packet to a system on the Internet; the firewall always appears to be the source.

Tip

If you enable NAT for the external firewall, configure firewall filters that are used for traffic from the Internet to the Edge Server with Destination Network Address Translation (DNAT). Similarly, configure and filter for traffic going from the Edge Server to the Internet with Source Network Address Translation (SNAT). Important to note is that the inbound and outbound filters for this purpose must use the same internal and external addresses. If externally, the Edge is 11.22.33.44 and is mapped to an Edge Server at 10.1.1.44. The mapping for the Edge to talk to the Internet needs traffic from 10.1.1.44 to come from 11.22.33.44. Although this might seem obvious, there are many situations in which all internal hosts appear to come from the same IP address. This is called PAT, or port address translation, or is sometimes called NAT overload.

Caution

If multiple Edge Servers are deployed in a load-balanced fashion, the external firewall cannot be configured for NAT. Regardless of whether load balancers are used, an internal firewall used to protect Edge Servers cannot be NAT enabled for the internal IP address of an Edge Server.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset