Comments on: Office Communications Server 2007 R2 Enterprise Deployment – Part 5 http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/ Just another IT guy! Fri, 12 Mar 2010 09:57:15 -0700 http://wordpress.org/?v=2.9.2 hourly 1 By: Mike http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9581 Mike Mon, 25 Jan 2010 22:12:16 +0000 http://www.shudnow.net/?p=815#comment-9581 Hello Elan, Scenario: External authenticated users can IM to internal, pic, and federated partners. I can communicate with full AV from internal to federated partners but AV between internal and external OC R2 users always fails with "Remote end ending the audio session" thus terminating the attempted AV call. It seems that possibly a port problem. This leads me to the question about the internal interface open port requirements. When opening the ports on the internal interface on the edge server the guidelines say to open 443, 5062, and 3478 to ANY IP address. Is this to any internal Pool or FE, or literally to ANY internal client address as well as server on the corp intranet. Many thanks in advance.........Mike Hello Elan, Scenario: External authenticated users can IM to internal, pic, and federated partners. I can communicate with full AV from internal to federated partners but AV between internal and external OC R2 users always fails with “Remote end ending the audio session” thus terminating the attempted AV call. It seems that possibly a port problem. This leads me to the question about the internal interface open port requirements.

When opening the ports on the internal interface on the edge server the guidelines say to open 443, 5062, and 3478 to ANY IP address.

Is this to any internal Pool or FE, or literally to ANY internal client address as well as server on the corp intranet.

Many thanks in advance………Mike

]]> By: golfer kuno http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9352 golfer kuno Tue, 22 Dec 2009 16:01:06 +0000 http://www.shudnow.net/?p=815#comment-9352 I believe this next info could help to resolve this issue... I created a new host/alias for the OCS server under the new zone newdomain.com and pointed the _sipinternaltls for this newdomain to the new host/alias. I can see see (using WireShark) that the client is getting the SRV record from the DNS server, so that is at least good to know. Now it seems (only my guess) that the issue is now pointing to the certificate. The message below came for the Event Log. Communicator could not connect securely to server ocs.newdomain.com because the certificate presented by the server did not match the expected hostname (ocs.newdomain.com). Resolution: If you are using manual configuration with an IP address or a NetBIOS shortened server name, a fully-qualified server name will be required. If you are using automatic configuration, the network administrator will need to make sure that the published server name in DNS is supported by the server certificate. Your thoughts please. Thank you. I believe this next info could help to resolve this issue…

I created a new host/alias for the OCS server under the new zone newdomain.com and pointed the _sipinternaltls for this newdomain to the new host/alias. I can see see (using WireShark) that the client is getting the SRV record from the DNS server, so that is at least good to know. Now it seems (only my guess) that the issue is now pointing to the certificate. The message below came for the Event Log.

Communicator could not connect securely to server ocs.newdomain.com because the certificate presented by the server did not match the expected hostname (ocs.newdomain.com).

Resolution:
If you are using manual configuration with an IP address or a NetBIOS shortened server name, a fully-qualified server name will be required. If you are using automatic configuration, the network administrator will need to make sure that the published server name in DNS is supported by the server certificate.

Your thoughts please. Thank you.

]]> By: golfer kuno http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9351 golfer kuno Tue, 22 Dec 2009 15:35:38 +0000 http://www.shudnow.net/?p=815#comment-9351 This is the event log from test PC... Communicator was unable to locate the login server. The DNS SRV record that exist for domain newdomain.com point to an invalid server ocs.olddomain.com which is not trusted to provide support for the domain because the server's domain is not an exact match. Resolution: The network administrator will need to double-check the DNS SRV record configuration to make sure that the SRV record for the domain points to a server name that conforms to the DNS naming convention in the server deployment guide. Does it mean that I cannot point the new SIP address newdomain.com to ocs.olddomain.com because the SIP address are different? I thought we can have multiple SIP addresses using a single OCS server? Can I just create an alias for the OCS server and use the newdomain.com as its domain name? Your thoughts? Thank you. This is the event log from test PC…

Communicator was unable to locate the login server. The DNS SRV record that exist for domain newdomain.com point to an invalid server ocs.olddomain.com which is not trusted to provide support for the domain because the server's domain is not an exact match.

Resolution:
The network administrator will need to double-check the DNS SRV record configuration to make sure that the SRV record for the domain points to a server name that conforms to the DNS naming convention in the server deployment guide.

Does it mean that I cannot point the new SIP address newdomain.com to ocs.olddomain.com because the SIP address are different? I thought we can have multiple SIP addresses using a single OCS server?

Can I just create an alias for the OCS server and use the newdomain.com as its domain name? Your thoughts? Thank you.

]]> By: Elan Shudnow http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9335 Elan Shudnow Tue, 22 Dec 2009 01:06:09 +0000 http://www.shudnow.net/?p=815#comment-9335 That does seem odd. Have you tried to load up netmon or wireshark to see where the breakdown in the communication lies? And the guidance I wrote above is for the Edge. For the FE you'll still have to add something sip.newdomain.com as a SAN name. That does seem odd. Have you tried to load up netmon or wireshark to see where the breakdown in the communication lies? And the guidance I wrote above is for the Edge. For the FE you'll still have to add something sip.newdomain.com as a SAN name.

]]> By: golfer kuno http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9330 golfer kuno Mon, 21 Dec 2009 21:31:51 +0000 http://www.shudnow.net/?p=815#comment-9330 Thank you for your comment, I will work on getting our certificate re-config. On the same note, we started to create the new domain setting within the LAN. In the forest Global Properties, we have added the new SIP domains (newdomain.com). On our DNS server we have created a new Forward Lookup Zone for newdomain.com and within this zone created the SRV record _sipinternaltls (pretty much copied what we did with our olddomain.com DNS records). Now if you go to one of the client PCs and do an nslookup for set type=SRV for _sipnternaltls._tcp.newdomain.com it will return the OCS server's address. We picked one of our test accounts and change the SIP address to use the newdomain.com. If the OC client is set to use manual there is no problem to sign-in using the newdomain.com SIP address. However, we get the error "Cannot sign in because the server is temporarily unavailable. Please try again later." if its set to use Automatic configuration. Why would it work if set manually and not work when set to automatic? FYI - we have not changed our certificate yet on our OCS R2 Server. Thanks again, Dario Thank you for your comment, I will work on getting our certificate re-config.

On the same note, we started to create the new domain setting within the LAN. In the forest Global Properties, we have added the new SIP domains (newdomain.com). On our DNS server we have created a new Forward Lookup Zone for newdomain.com and within this zone created the SRV record _sipinternaltls (pretty much copied what we did with our olddomain.com DNS records). Now if you go to one of the client PCs and do an nslookup for set type=SRV for _sipnternaltls._tcp.newdomain.com it will return the OCS server's address.

We picked one of our test accounts and change the SIP address to use the newdomain.com. If the OC client is set to use manual there is no problem to sign-in using the newdomain.com SIP address. However, we get the error "Cannot sign in because the server is temporarily unavailable. Please try again later." if its set to use Automatic configuration.

Why would it work if set manually and not work when set to automatic? FYI – we have not changed our certificate yet on our OCS R2 Server.

Thanks again,
Dario

]]> By: Elan Shudnow http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9202 Elan Shudnow Tue, 15 Dec 2009 20:42:31 +0000 http://www.shudnow.net/?p=815#comment-9202 Not sure if it's supported and I haven't tried it. I always just create the accounts on the Edge Server itself. Not sure if it's supported and I haven't tried it. I always just create the accounts on the Edge Server itself.

]]> By: Andrea http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9195 Andrea Tue, 15 Dec 2009 08:19:12 +0000 http://www.shudnow.net/?p=815#comment-9195 Hi Elan, is it possible to use a domain service account when I configure the RTCProxyService? I need it because my Edge Server is in a DMZ domain, not the same of the FE. Do you now if is it supported by MS? Thanks! Hi Elan,

is it possible to use a domain service account when I configure the RTCProxyService?
I need it because my Edge Server is in a DMZ domain, not the same of the FE.

Do you now if is it supported by MS?

Thanks!

]]> By: MMJP » OCS 2007 R2 Edge Server Installation http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9118 MMJP » OCS 2007 R2 Edge Server Installation Thu, 10 Dec 2009 16:26:40 +0000 http://www.shudnow.net/?p=815#comment-9118 [...] http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/ Categories: OCS 2007 R2 Tags: Comments (0) Trackbacks (0) Leave a comment Trackback [...] [...] http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/ Categories: OCS 2007 R2 Tags: Comments (0) Trackbacks (0) Leave a comment Trackback [...]

]]> By: Elan Shudnow http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9089 Elan Shudnow Wed, 09 Dec 2009 17:34:00 +0000 http://www.shudnow.net/?p=815#comment-9089 Keep in mind that PIC vendors require them to communicate with the Common Name of the certificate. It's the same for LCS to OCS federation. OCS to OCS can use a SAN name. So if you still end up owning the old DNS namespace you can just request a new certificate and keep the Common Name the same, just add the necessary new domain information as a SAN. That way you won't lose access to PIC for several weeks until PIC re-federates with your new FQDN/Common Name. Keep in mind that PIC vendors require them to communicate with the Common Name of the certificate. It's the same for LCS to OCS federation. OCS to OCS can use a SAN name. So if you still end up owning the old DNS namespace you can just request a new certificate and keep the Common Name the same, just add the necessary new domain information as a SAN. That way you won't lose access to PIC for several weeks until PIC re-federates with your new FQDN/Common Name.

]]> By: golfer kuno http://www.shudnow.net/2009/01/20/office-communications-server-2007-r2-enterprise-deployment-part-5/comment-page-3/#comment-9084 golfer kuno Wed, 09 Dec 2009 15:58:38 +0000 http://www.shudnow.net/?p=815#comment-9084 Hello, we have successfully deployed OCS R2 Server and being used in and outside our LAN. We are also IM'ng with aol, yahoo and hotmail users. Now we have a BIG concern this coming January 2010. To everyone out there, kindly let us know what should we do once our company switches its domain address from (example only) domain1.com to domain2.com? We appreciate all inputs. Thank you kindly. Hello, we have successfully deployed OCS R2 Server and being used in and outside our LAN. We are also IM'ng with aol, yahoo and hotmail users. Now we have a BIG concern this coming January 2010.

To everyone out there, kindly let us know what should we do once our company switches its domain address from (example only) domain1.com to domain2.com?

We appreciate all inputs. Thank you kindly.

]]>