{"id":517,"date":"2013-09-12T12:31:03","date_gmt":"2013-09-12T10:31:03","guid":{"rendered":"http:\/\/blog.lync2013.org\/?p=517"},"modified":"2014-05-07T13:26:58","modified_gmt":"2014-05-07T13:26:58","slug":"configuring-windows-2012-r2-web-application-proxy-publish-lync-2013","status":"publish","type":"post","link":"https:\/\/modern-workplace.uk\/?p=517","title":{"rendered":"Configuring Windows 2012 R2 Web Application Proxy to publish Lync 2013"},"content":{"rendered":"

https:\/\/www.youtube.com\/watch?v=iKpi8UomRDo<\/a><\/span><\/p>\n

\n

 <\/p>\n

Web Application Proxy is a new feature in Windows Server 2012 R2<\/span><\/h5>\n

It is part of the Remote Access role service in and provides reverse proxy functionality to publish web applications inside the corporate network and make them available to users outside our internal deployment. Lync 2013 requires a reverse proxy to publish resources that are deployed on the Front End including the dialin and meet pages (for more details please read my post Understanding Simple URLs In Lync<\/a>\u00a0)<\/span>
\n Web Application Proxy (from now on, WAPX) can replace existing solutions for reverse proxying Lync like UAG and TMG. An important limit of WAPX is that it requires a working Active Directory Federation Services (AD FS) server inside our network.<\/span><\/p>\n

It is a pre-requirement and the configuration of WAPX will not accomplish if the connection with AD FS is not running in the right manner. During this webcast I will show how to configure AD FS server, the WAPX server and how to set publishing rules for Lync 2013.<\/span><\/p>\n

\n

 <\/p>\n

A short Explanation of the outline of the test lab<\/strong><\/span><\/h5>\n

The test deployment is made up by a Domain Controller (Aphrodite) a Certification Authority (Artemis) and a Lync 2013 S.E. Front End (Apollo). The internal domain name is Lync2013.Dom<\/span><\/p>\n

We will configure the AD FS server (Eleos) and the WAPX server (Hephaestus) during this webcast<\/span><\/p>\n

\n

 <\/p>\n

Configuring AD FS server<\/strong><\/span><\/h5>\n

The configuration of AD FS and WAPX requires a digital certificate (for SSL). The certificate can be the same, created on AD FS and then exported to the server WAPX, or you can create a certificate on the AD FS (containing the FQDN of the server as Common Name) and a second certificate (type wildcard or *) for the Web Application Proxy.<\/span><\/p>\n

We will use the second solution (the type of certificate that I used on AD FS, \u201ccomputer\u201d does not have and exportable private key).<\/span><\/p>\n

I have used the certificates Snap-in on the Eleos server to require a certificate of the \u201cComputer\u201d type and the utility from DigiCert to require the * certificate.<\/span><\/p>\n

We have to create a domain user (in our scenario Lync2013ServicesADFS) that will be used as a service user for AD FS and for the WAPX. This user is a local administrator in both the servers.<\/span><\/p>\n

During the configuration we have installed the Web Server (IIS) role and then the Federation Server role on Eleos. The installation does not require special attention. At the end of this phase, we will be prompted to configure the role. The error associated with the SPN always occurs, but does not affect our configuration.<\/span><\/p>\n

\n

 <\/p>\n

Configuring WAPX server<\/strong><\/span><\/h5>\n

Installing the Web Application Proxy feature requires the Remote Access role (selecting the Web Application Proxy feature). The configuration wizard will require the name of the federation service (in our scenario, the FQDN of the AD FS server) and the service account to use (as in the previous step, we will use Lync2013ServicesADFS)<\/span><\/p>\n

Note<\/em>: The procedure is often subject to errors, whose diagnosis requires also to read the log of both servers. In case of problems, I suggest to use the PowerShell cmdlets that provide a first diagnostic screen.<\/span><\/p>\n

\n

 <\/p>\n

Configuring Publishing Rules for Lync 2013<\/strong><\/span><\/h5>\n

Once the configuration is complete, we can use the Publish option (task pane). For Lync the rules require that the public name is redirected to the Front End server on port 4443 (in a standard configuration).<\/span><\/p>\n

Marc Terblanche has published a good blog post that includes a sample publishing script ( http:\/\/blog.kloud.com.au\/2013\/07\/15\/publish-lync-2013-with-2012-r2-preview-web-application-proxy\/\u00a0)<\/span><\/p>\n

\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/www.youtube.com\/watch?v=iKpi8UomRDo   Web Application Proxy is a new feature in Windows Server 2012 R2 It is part of the Remote Access role service in and provides reverse proxy functionality to publish web applications inside the corporate network and make them available to users outside our internal deployment. Lync 2013 requires a reverse proxy to publish […]<\/p>\n","protected":false},"author":1,"featured_media":1224,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[18,19,14],"tags":[165,166,702,100,32,33,35,36,167,168,37,26,169,44,170,171,46,172,173,174,175,176,177,178],"class_list":["post-517","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-english","category-lync","category-microsoft","tag-2012-r2","tag-dialin","tag-lync","tag-lync-2013-2","tag-lync-2013-client","tag-lync-2013-server","tag-lync-client","tag-lync-microsoft","tag-lync-proxy","tag-lync-publishing","tag-lync-reverse-proxy","tag-lync-server","tag-meet","tag-microsoft-lync-2013","tag-publish-lync-2013","tag-reverse-proxy","tag-simple-urls","tag-tmg","tag-uag","tag-wap","tag-wapx","tag-web-application-firewall","tag-web-application-proxy","tag-windows-2012-r2"],"_links":{"self":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=517"}],"version-history":[{"count":2,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/517\/revisions"}],"predecessor-version":[{"id":1225,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/517\/revisions\/1225"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/media\/1224"}],"wp:attachment":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}