Firewall Hairpin for Lync Mobile

The final network device consideration centers around the Lync Mobility service. In Lync Server 2013 all Lync Mobile clients will access the mobility service through the external web services FQDN for Front End pools. Even if a mobile device is on an internal Wi-Fi network, the initial discovery request will be handled directly by a Front End server, but any subsequent connections will always be sent to the external interface of the reverse proxy.

This generally isn’t an issue for branch sites or if an organization hosts its Lync deployment in a data center, but it might cause problems for an office that has a Lync Front End pool deployed locally, as in Figure 31.13. In this case the internal Wi-Fi clients must be able to contact the external interface of the reverse proxy. This might require additional static NAT configuration rules at the firewall.

Figure 31.13. Lync Mobility firewall hairpin.