These are the steps involved in configuring BIG-IP LTM to redirect Lync Web Services traffic to different polls based on the client IP address:

• Creating a new TCP Monitor
• Creating a new Lync Front End Pool (port 4443)
• Creating a new client-side TCP profile
• Creating a new iRule
• Creating a new Persistence profile
• Creating a new Virtual Server

1.  Create a new TCP Monitor

1.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Protocol – TCP

1.2  Click Create on the top right

1.3  Type in the name of the profile (e.g., Lync-tcp-monitor-fe)

1.4  Select TCP as the Type and the tcp as the Parent Monitor

       Note: This will import all the values from the tcp baseline(parent) profile.

1.5  Enter 30 seconds for the Interval

1.6  Enter 91 seconds for the Timeout

1.7  Click Finished at the bottom of the screen 

2.  Create a new Pool

2.1  From the main menu, navigate to Local Traffic – Virtual Servers – Pools – Pool List

2.2  Click Create on the top right

2.3  Type in the name of the pool (e.g., LyncFEPool_4443)

2.4  Select the Health Monitor that you created in Step 7 and move it over to Active

2.5  Select Least Connections (member) as the Load Balancing Method

       Note: The Least Connections load balancing method determines the member/node with the least connections to pass the service request. Thus, the service requests are evenly distributed among poor members.  This method is recommended for supporting long-lived connections.

2.6  Select Node List to see the list of available nodes (click New Node and enter the IP address of each Office Web Apps Server if the servers are not in the list)

2.7  Select the IP address of each Office Web Apps Server

2.8  Enter 4443 as the Service Port and click Add

2.9  Click Finished at the bottom of the screen once all the servers have been added 

3.  Create a new client-side TCP profile

3.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Protocol – TCP

3.2  Click Create on the top right

3.3  Type in the name of the profile (e.g., Lync-tcp-fe)

3.4  Select tcp as the Parent Profile

       Note: This will import all the values from the tcp baseline(parent) profile.

3.5  Enter 1800 seconds for the Idle Timeout 

3.6  Click Finished at the bottom of the screen 

4.  Create a new iRule

4.1  From the main menu, navigate to Local Traffic – Virtual Servers – iRule – iRule List

4.2  Click Create on the top right

4.3  Type in the name of the profile (e.g., LyncWebServices)

4.4  Type in the following rule (modify the IP address/subnet to reflect your network environment) in the Definition field:

when CLIENT_ACCEPTED {
 if { [IP::addr [IP::client_addr] equals 172.16.1.0/24] } {
  pool LyncWebServices_443
 } elseif { [IP::addr [IP::client_addr] equals 10.0.0.0/24] } {
  pool LyncWebServices_443
 } else {
  pool LyncWebServices_4443
 }
}

Note: This rule will redirect internal users (source network 172.16.1.0/24 or 10.0.0.0/24) to the Lync Front End servers on port 443 (Internal Web Services). All other traffic coming in from other network will be redirected to the Lync Front End servers on port 4443 (External Web Services).

4.5  Click Finished at the bottom of the screen

5.  Create a new Cookie Persistent profile

5.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Persistence

5.2  Click Create on the top right

5.3  Type in the name of the profile (e.g., Lync-source-fe)

5.4  Select Source Address Affinity as the Persistent Type

5.4  Select source_addr as the Parent Profile

       Note: This will import/keep all the values from the source_addr baseline(parent) profile.

5.6  Enter 1800 seconds for the Timeout

5.7  Click Finished at the bottom of the screen

6.  Create a new Virtual Server

6.1  From the main menu, navigate to Local Traffic – Virtual Servers – Virtual Server List

6.2  Click Create on the top right

6.3  Type in the name of the virtual server (e.g., LyncWebServices_443)

6.4  Select Host as the Destination Type

6.5  Enter the IP address of the external URL

6.6  Enter 443 as the Service Port

6.7  From Configuration, select Advanced

6.8  Select the TCP client profile that you created in Step 3 as the Protocol Profile (Client) (e.g., Lync-tcp-fe)

6.9  Select Auto Map for the Source Address Translation

6.10  From the Resources section, select the iRule that you created in Step 4 (e.g., LyncWebServices)

6.11  Do not select any pools as the Default Pool

6.12  Select the Source Persistent profile that you created in Step 5 as the Default Persistent Profile (e.g., Lync-source-fe)

6.13  Click Finished at the bottom of the screen

You can validate the configuration by examining the IIS logs on the Front End servers.

Before we can start working with BIG-IP LTM, we need to know the external URL used by the Office Web Apps Server farm. 

Below is the Office Web Apps Server farm settings in my lab:

You must use the FQDN published under "InternalURL" when configuring Office Web Apps Server though the Topology Builder:

Initially, I wasn't sure as to which URL was needed to be published in Lync topology, but I soon found that the external participants are provided with the "ExernalURL" configured in the Office Web Apps Server farm in order to view the PowerPoint presentation.  The "ExernalURL" DOES NOT need to be published in Lync topology.  However, you have to make sure to create a DNS (A) record for the external URL and that it's pointing to the reverse proxy IP address.

In my lab environment, owaext.acme.com is the external URL that needs to be published through the reverse proxy using F5 BIG-IP LTM.

These are the steps involved in configuring BIG-IP LTM as a Lync Reverse Proxy:

• Creating a new server-side (LAN) TCP profile
• Creating a new client-side (WAN) TCP profile
• Importing Office Web Apps Server certificate
• Creating a new SSL Server profile
• Creating a new SSL Client profile
• Creating a new HTTPs Monitor
• Creating a new Lync Front End Pool
• Creating a new Cookie Persistence profile
• Creating a new Source Address Persistence profile
• Creating a new Virtual Server

1. Create a new server-side (LAN) TCP profile

1.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Protocol – TCP

1.2  Click Create on the top right

1.3  Type in the name of the profile (e.g., Lync_WAC_tcp_lan)

1.4  Select tcp-lan-optimized as the Parent Profile

Note: This will import all the values from the tcp-lan-optimized baseline(parent) profile.

1.5  Click Repeat at the bottom of the screen

2. Create a new client-side (WAN) TCP profile

2.1  Type in the name of the profile (e.g., Lync_WAC_tcp_wan)

2.2  Select tcp-wan-optimized as the Parent Profile

Note: This will import all the values from the tcp-wan-optimized baseline(parent) profile.

2.3  Click Finished at the bottom of the screen

3. Create a new HTTP profile

3.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Services – HTTP

3.2  Click Create on the top right

3.3  Type in the name of the profile (e.g., Lync_WAC_http)

3.4  Select http as the Parent Profile

Note: This will import all the values from the http baseline(parent) profile.

3.5  Check the Custom box on the top right

3.6  Change the Redirect Rewrite value from None to Matching

3.7  Click Finished at the bottom of the screen

4. Import Office Web Apps Server certificate

4.1  From the main menu, navigate to System – File Management – SSL Certificate List

4.2  Click Import on the top right

4.3  Select PKCS 12 (IIS) as the Import Type

4.4  Type in the certificate name (e.g., wacext_acme.com)

4.5  Click Browse to locate the certificate/private key (.pfk file) that you exported from the Office Web Apps Server

4.6  Enter the password

4.7  Click Import to complete the importing process

5. Create a new SSL Server profile

5.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – SSL – Server

5.2.  Click Create on the top right

5.3  Type in the name of the profile

5.4  Select serverssl as the Parent Profile

Note: This will import/keep all the values from the serverssl baseline(parent) profile.

5.5  Click Finished at the bottom of the screen

6. Create a new SSL Client profile

6.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – SSL – Client

6.2  Click Create on the top right

6.3  Type in the name of the profile

6.4.  Select clientssl as the Parent Profile

Note: This will import/keep all the values from the clientssl baseline(parent) profile.

6.5  Check the Custom box on the top right

6.6  Select the certificate and key that you imported in Step 4

6.7  Click Finished at the bottom of the screen

7. Create a new HTTPS monitor

7.1  From the main menu, navigate to Local Traffic – Monitors

7.2.  Click Create on the top right

7.3  Type in the name of the profile

6.4  Select HTTPS as the Type and https as the Parent Monitor

Note: This will import/keep all the values from the https baseline(parent) monitor.

7.5  Enter 30 seconds for the Interval

7.6  Enter 91 seconds for the Interval

7.7  Enter GET /hosting/discovery HTTP/1.1\r\nHost: owaext.acme.com\r\nConnection: Close\r\n\r\n for the Send String

7.8  Enter wopi-discovery for the Receive String

7.9  Click Finished at the bottom of the screen

8. Create a new Pool

8.1  From the main menu, navigate to Local Traffic – Virtual Servers – Pools – Pool List

8.2  Click Create on the top right

8.3  Type in the name of the pool (e.g., Lync_WAC_pool)

8.4  Select the Health Monitor that you created in Step 7 and move it over to Active

8.5  Select Least Connections (member) as the Load Balancing Method

Note: The Least Connections load balancing method determines the member/node with the least connections to pass the service request. Thus, the service requests are evenly distributed among poor members.  This method is recommended for supporting long-lived connections.

8.6  Select Node List to see the list of available nodes (click New Node and enter the IP address of each Office Web Apps Server if the servers are not in the list)

8.7  Select the IP address of each Office Web Apps Server

8.8  Enter 443 as the Service Port and click Add

8.9  Click Finished at the bottom of the screen once all the servers have been added

9. Create a new Cookie Persistent profile

9.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Persistence

9.2.  Click Create on the top right

9.3  Type in the name of the profile

9.4  Select Cookie as the Persistent Type

9.4  Select cookie as the Parent Profile

Note: This will import/keep all the values from the cookie baseline(parent) profile.

9.5  Click Finished at the bottom of the screen

10. Create a new Source Address Persistent profile

10.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Persistence

10.2  Click Create on the top right

10.3  Type in the name of the profile

10.4  Select Source Address Affinity as the Persistent Type

10.4  Select source_addr as the Parent Profile

Note: This will import/keep all the values from the source_addr baseline(parent) profile.

10.5  Click Finished at the bottom of the screen

11. Create a new Virtual Server

11.1  From the main menu, navigate to Local Traffic – Virtual Servers – Virtual Server List

11.2  Click Create on the top right

11.3  Type in the name of the virtual server (e.g., Lync_WAC_vs)

11.4  Select Host as the Destination Type

11.5  Enter the IP address of the external URL

11.6  Enter 443 as the Service Port

11.7  From Configuration, select Advanced

11.8  Select the TCP client profile that you created in Step 2 as the Protocol Profile (Client)

11.9  Select the TCP server profile that you created in Step 1 as the Protocol Profile (Client)

11.10 Select the SSL client profile that you created in Step 6 as the SSL Profile (Client)

11.11 Select the SSL server profile that you created in Step 5 as the SSL Profile (Server)

11.12 Select the HTTP profile that you created in Step 3 as the HTTP Profile

11.13 Select Auto Map for the Source Address Translation

11.14 From the Resources section, select the pool you previously created in Step 8 as the Default Pool

11.15 Select the Cookie Persistent profile that you created in Step 9 as the Default Persistent Profile

11.16 Select the Source Address profile that you created in Step 10 as the Fallback Persistence Profile

11.17 Click Finished at the bottom of the screen

Once all above steps have been completed, you can validate the configuration by navigating to the WOP URL:

https://owaext.acme.com/hosting/discovery

When the users are participating in a Lync meeting hosted by external contacts, they are unable to view shared desktop.  All other features including AV, PowerPoint presentation, IM and white boarding appear to be working.

In the testing scenario, I tried to join a Lync meeting hosted by Microsoft from the customer location. The following is a screenshot from the network capture performed on one of the client machines having the desktop sharing issue:

From the network capture, we saw the client successfully completing the TCP handshake with the AV Edge server. Once the TCP connection was made, the client tried to initiate a SSL/TLS handshake and the server responded with two separate packets.   

Looking closely at the server's response, it was missing the server certificate (public key) and the server hello done message.  Oddly there was a separate response from the server containing the certificate and the server hello done message. As referenced in this TechNet article, the response from the server should have included Server Hello, Server Certificate and Server Hello Done in the same packet.

 The following network capture demonstrates what the server response should contain: Server Hello, Certificate and Server Hello Done.

When I examined the certificate that was included in the server's second response, it was not the certificate of Microsoft AV Edge server.  Instead, the certificate passed to the client was issued by the Web Security/Proxy server. This proved that the TLS connection between the client and the AV Edge server was being examined and proxied by the Web Security/Proxy service.  The Web Security/Proxy service (in this case, it was Websense) was intercepting the SSL/TLS connection from the client. For web browsing, this will not be a problem, but relaying Lync media traffic through the proxied connection caused the issue with viewing shared desktop.

Another way to test this theory is to enter the IP address of the AV Edge  on a browser.  Instead of getting page not found error, I got an error message from Websense indicating that the SSL/TLS connection could not be completed.

Once we added the IP addresses of the AV Edge servers in the Websense's SSL bypass list, the desktop sharing feature started to work immediately.  When my customer contacted Websense support, they were well-aware of the issue and advised the customer to upgrade to Websense version 7.8.

Note: Most Web Security/Proxy products allow you to add the domain name (instead of IP address) to the bypass list.

The lesson learned from working on this issue was that even if you have all the necessary ports opened at the firewall, some of the Lync features may be affected by Web Security/Proxy products.

Based on the Lync Server 2013 User Models and the recommended Server Hardware Platfoms, below are some of the guidelines regarding the Lync conferencing supportability:

• 250 is the maximum supported conference size hosted by a regular Lync Server 2013 Front End pool.  (Note: 250 is not a hard limit, but a recommendation based on the scalability tests using the recommended hardware and software specifications. The tests were based on the Lync Server 2013 User Models.  Thus, the actual usage may be different from the usage scenarios in the user model.  The actual usage determines the actual server performance and conference experience.)
• 5% of users in a pool may be in a conference at any one time (e.g., a pool of 10,000 users could have about 500 users in conferences at one time).
• There shouldn't be any users homed on the large-meeting pool.
• A dedicated large-meeting pool can host only one meeting at the same time.  In order to support more than one large meetings at the same time, Microsoft recommends setting up multiple dedicated large-meeting pools.

References:

• Lync Server 2013 User Models: http://technet.microsoft.com/en-us/library/gg398811.aspx
• Capacity Planning Using the User Models: http://technet.microsoft.com/en-us/library/gg615015.aspx
• The Conferencing User Model: http://technet.microsoft.com/en-us/library/jj205199.aspx
• Scalability Testing: http://technet.microsoft.com/en-us/library/jj205226.aspx
• Conferencing Load Distribution:http://technet.microsoft.com/en-us/library/jj204922.aspx
• Supporting Large Meetings Using Lync Server 2013: http://technet.microsoft.com/en-us/library/jj204894.aspx

These are the steps involved in supporting large meetings using Lync Server 2013 Standard Edition:

1. Configuring the Topology
2. Installing the Lync Server 2013 Standard Edition Server
3. Creating and Configuring a New Conferencing Policy
4. Enabling a Designated Meeting Account
5. Scheduling a Test Meeting

Important: Implementing the large-meeting pool using Lync Server 2013 Standard Edition does NOT support the high availability features included with Enterprise Edition. To provide high availability, Microsoft recommends a two Front End Server pool (2 = minimum, 3 = recommended) with mirrored Back End Servers.

1. Configure the topology

1.1 From the Lync Server Topology Builder, right-click on Standard Edition Front End Servers and then select New Front End Pool

 Note: Make sure to update the current topology by selecting "Download Topology from existing deployment."

1.2 Click Next to continue

1.3 Type in the FQDN of the large meeting pool and click Next

 Note: Create an internal A record that resolves the FQDN of the large meeting pool to the IP address of the Standard Edition server.

1.4 Select the additional features that you want to enable for the large meeting pool

 Note: I'm not adding the Dial-in (PSTN) conferencing feature as this requires the voice-enabled infrastructure in place. However, you can add it if you have already deployed either Enterprise Voice or a Mediation Server and a public switched telephone network (PSTN) gateway. You can collocate the Monitoring and Archiving databases on the exiting SQL server.

1.5 Leave the box unchecked and click Next to continue

 Note: The Mediation Server role is not needed if you are not planning on enabling the Dial-in conferencing feature.

1.6 Check the box if you are going to associate the large meeting pool with the existing Edge pool (if already exist)

 Note: The association with Edge pool is required only if you are planning on allowing external contacts to participate in the large meetings. 

 1.7 Click Next to continue

 Note: With the Standard Edition sever, you will not be able to dedicate a backend SQL server.

1.8 Select Define a new file store and click Next to continue

 Note: Make sure to create the file share before publishing the topology. You can also use the previously defined file store.

1.9 Type in the External Base URL for the large meeting pool

 Note: The External Base URL is used for external meeting participants and the corporate users joining the meeting from outside the corporate network. This URL should be pointing to the IP address of the external reverse proxy.

1.10 Associate the large meeting pool with existing Office Web Apps server (if already exist) and click Next to continue

1.11 Select or define the SQL store that will host the Monitoring databases (LcsCDR and QoEMetrics)

 Note: In the example below, I chose to leverage the existing SQL store from the main user pool. This makes it easier for the administrators to review the reports.

1.12 Select the Edge pool (if already exist) you want to associate with the large meeting pool and click Finish to complete the configuration

 Note: The association with Edge pool is required if you want to allow external contacts or remote users to participate in the large meeting.

1.13 Verify that the new Standard Edition Front End server has been successfully added and publish the new topology

2. Install Lync Server 2013 Standard Edition server

2.1 Make sure the software and hardware requirements have been met:

• Server Hardware Platforms: http://technet.microsoft.com/en-us/library/gg398835.aspx
• System Requirements for Servers Running Lync Server 2013: http://technet.microsoft.com/en-us/library/gg398588.aspx
• IIS Requirements for Front End Pools and Standard Edition Servers: http://technet.microsoft.com/en-us/library/gg399038.aspx

2.2 Run Setup.exe and click Yes to install Visual C++ Runtime

2.3 Click Install (if okay with the default installation location)

2.4 Accept the License Agreement and click OK to continue

2.5 Start the Lync Server Deployment Wizard and click on Install or Update Lync Server System

2.6 Click Run under Step 1: Install Local Configuration Store

2.7 Select "Retrieve directly from the Central Management store" and click Next to continue

 Note: This process copies the Central Management Store configuration to the local server.

2.8 Click Finish to complete Step 1

2.9 Click Run under Step 2: Setup or Remove Lync Server Components

2.10 Click Next to continue

 Note: This process installs Lync Server components based on the retrieved Central Management Store configuration on the local server.

2.11 Click Finish to complete Step 2

2.12 Click Run under Step 3: Request, Install or Assign Certificates

2.13 Select the Default certificate and click Assign

 Note: This step assumes that you already have the valid certificate installed on the local certificate store.

2.14 Click Next to continue

2.15 Select the certificate for the Standard Edition server and click Next to continue

2.16 Verify that you have the correct certificate and click Next to continue

2.17 Click Finish to complete Step 3

2.18 Verify the certificate assignments by expanding the Default certificate and click Close

2.19 Click Run under Step 4: Start Services

2.20 Click Next to start the services

2.21 Click Finish to complete Step 4

2.22 Make sure Step 1-3 have been completed successfully

3. Create and configure a new conferencing policy to be used for the large meetings

3.1 Create a new conferencing policy from the Lync Management Shell

3.2 Configure the newly created policy with the following settings:

• Set the MaxMeetingSize option to 1000. (The default is 250.)
• Set the AllowLargeMeetings option to True.
• Set the EnableAppDesktopSharing option to None.
• Set the AllowUserToScheduleMeetingsWithAppSharing option to False.
• Set the AllowSharedNotes option to False.
• Set the AllowAnnotations option to False.
• Set the DisablePowerPointAnnotations option to True.
• Set the AllowMultiview option to False.
• Set the EnableMultiviewJoin option to False.

 Reference: http://technet.microsoft.com/en-us/library/jj205074.aspx

4. Enable the designated meeting account on the large-meeting pool

4.1 Create a user account (mailbox enabled) to be used as the designated meeting account

 Note: This account is used for scheduling large meetings and should be the only account homed on the large-meeting pool.

4.2 Enable the designated meeting account on the large-meeting pool

4.3 Assigned the new conferencing policy to the designated meeting account

4.3 Confirm that the new conferencing policy has been successfully assigned to the designated meeting account

5. Scheduling a test meeting

According to the following TechNet article, the best practice for scheduling large meetings is to use the dedicated meeting account homed on the large-meeting pool:

http://technet.microsoft.com/en-us/library/jj205074.aspx

However, you can also have one of the Lync administrators schedule large meetings by using the Delegate Access feature in Outlook and enabling the Exchange delegate synchronization in Lync.

5.1 Configure the Global client policy to allow Exchange delegate synchronization

 Note: You can also create a separate client policy and assign it to a specific group of users.

Set-CsClientPolicy -Identity Global -EnableExchangeDelegateSync $True

5.2 Log on as the designated meeting account and add the Lync administrators (responsible for scheduling large meetings) as delegates from Outlook

 Note: This gives the Lync administrators access to the designated meeting account's calendar and allows them to schedule large meetings on his behalf.

 5.2 Confirm that the person responsible for scheduling large meetings has the delegate access in Lync as well

5.3 Open the designated meeting account's calendar from Outlook and schedule a meeting

 Note: As shown below, the meeting URL reflects the designated meeting account (largemeetingadmin).

 5.4 Assign presenters to the scheduled meeting

 Note: This option allows you to pre-assign presenters who will be sharing/presenting during the meeting.

The invited users will receive a meeting invite as shown below:

Refer to the following TechNet article for the best practice guidelines in running large meetings:

http://technet.microsoft.com/en-us/library/jj205323.aspx

These are the steps involved in configuring BIG-IP F5 LTM as a Lync Reverse Proxy:

• Creating a new TCP profile
• Exporting/Importing Lync Pool certificate
• Creating a new SSL Client profile
• Creating a new SSL Server profile
• Creating a new HTTPs Monitor
• Creating a new Lync Front End Pool
• Creating a new Virtual Server

Note: These instructions are based on:

• BIG-IP v11.x
• Single BIG-IP LTM deployment for all internal and external Lync Server services
• Lync Server 2013 only deployment
• No Lync Server 2013 Director roles deployed

1. Create a new TCP profile

1.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – Protocol – TCP

1.2  Click Create on the top right

1.3  Type in the name of the profile

1.4  Select tcp as the Parent Profile

Note: This will import all the values from the tcp baseline(parent) profile.

1.5  Check the Custom box on the top right

1.6  Change the Idle Timeout value from 300 to 1800 seconds

Note: BIG-IP LTM will reset the connection if the connection is idle for the configured Idle Timeout.  This value can be modified as needed.  In some cases, the firewall will terminate the idle connection before 1800 seconds.

1.7  Click Finished at the bottom of the screen

2. Export Lync Front End Pool certificate

2.1  From one of the Lync Front End servers, start the Certificates (Local Computer) console

2.2  Navigate to Personal – Certificates

2.3  Right-click on the Lync Front End Pool certificate and select All Tasks – Export

2.4  Click Next to continue

2.5  Select “Yes, export the private key” and click Next

2.6  Select “Include all certificates in the certification path if possible” and “Export all extended properties” and click Next

2.7  Select Password and enter the password for the private key and click Next

2.8  Select folder path and type in the file name and click Next

2.9  Click Finish to complete the exporting process

3. Import Lync Front End Pool certificate

3.1  From the main menu, navigate to System – File Management – SSL Certificate List

3.2  Click Import on the top right

3.3  Select PKCS 12 (IIS) as the Import Type

3.4  Type in the certificate name

3.5  Click Browse to locate the certificate (.pfk file) that you exported from the Lync Front End server

3.6  Enter the password

3.7  Click Import to complete the importing process

4. Create a new SSL Client profile

4.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – SSL – Client

4.2  Click Create on the top right

4.3  Type in the name of the profile

4.4.  Select clientssl as the Parent Profile

Note: This will import/keep all the values from the clientssl baseline(parent) profile.

4.5  Check the Custom box on the top right

4.6  Select the certificate and key that you imported in the previous step

4.7  Click Finished at the bottom of the screen

5. Create a new SSL Server profile

5.1  From the main menu, navigate to Local Traffic – Virtual Servers – Profiles – SSL – Server

5.2.  Click Create on the top right

5.3  Type in the name of the profile

5.4  Select serverssl as the Parent Profile

Note: This will import/keep all thevalues from the serverssl baseline(parent) profile.

5.5  Click Finished at the bottom of the screen

Note: You do not need to assign the certificate and the key.

6. Create a new HTTPS monitor

6.1  From the main menu, navigate to Local Traffic – Monitors

6.2.  Click Create on the top right

6.3  Type in the name of the profile

6.4  Select HTTPS as the Type and https as the Parent Monitor

Note: This will import/keep all the values from the https baseline(parent) monitor.

6.5  Enter 4443 for the Alias Service Port

6.6  Click Finished at the bottom of the screen

Note: Jump to Step 8 if you already have a pool that load-balances Lync Front End servers on port 4443.

7. Create a new Pool

7.1  From the main menu, navigate to Local Traffic – Virtual Servers – Pools – Pool List

7.2  Click Create on the top right

7.3  Type in the name of the pool

7.4  Select the Health Monitor that you created in the previous step and move it over to Active

7.5  Select Least Connections (member) as the Load Balancing Method

Note: The Least Connections load balancing method determines the member/node with the least connections to pass the service request. Thus, the service requests are evenly distributed among poor members.  This method is recommended for supporting long-lived connections.

7.6  Select Node List to see the list of available nodes (click New Node and enter the IP address of each Lync Front End server if you don’t see the from the list)

7.7  Select the IP address of each Lync Front End server

7.8  Enter 4443 as the Service Port and click Add

7.9  Click Finished at the bottom of the screen

8. Create a new Virtual Server

8.1  From the main menu, navigate to Local Traffic – Virtual Servers – Virtual Server List

8.2  Click Create on the top right

8.3  Type in the name of the virtual server

8.4  Select Host as the Destination Type

8.5  Enter the IP address of the Reverse Proxy (i.e. meet.domain.com and Lync External Web Services URL)

8.6  Enter 443 as the Service Port

8.7  From Configuration, select Advanced

8.8  Select the TCP client profile you created in Step 1 as the Protocol Profile (Client)

8.9 Select the SSL client profile you created in Step 4 as the SSL Profile (Client)

8.10 Select the SSL server profile you created in Step 5 as the SSL Profile (Server)

8.11 Select Auto Map for the Source Address Translation

Note: Auto Map is recommended if there are fewer than 64,000 simultaneous users. According to F5's documentation, one IP address is used for 64,000 users.

8.12 From the Resources section, select the pool you previously created as the Default Pool

Note: You can leave the Default Persistence Profile as Cookie persistent profile is not required with Lync Server 2013 only deployment.  The Cookie persistent profile is required when Lync Server 2010 and Lync Server 2013 are both deployed.

8.13 Click Finished at the bottom of the screen

You are now all set to start testing your Lync External Web Services. Try to access https://meet.domain.com and see if you get this error:

This error was generated by a Lync Front End server.  This tells me that the F5 Reverse Proxy is correctly passing the service request to the Lync External Web Services.