Lync 2013/ Skype For Business: Office Web Apps high availability
Topology
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe1.png?w=614
Prerequisites
- ADDS – Active Directory Domain Services.
- Lync Server 2013 or Skype For Business deployed in the environment
- ADCS – Active Directory Certificate service for certificates request based on predefined templates
Do the same below to all servers that will run WAC (OWA – office web apps)
- Open a PowerShell as Administrator and then copy and paste
- Add-WindowsFeature NET-HTTP-Activation,NET-Non-HTTP-Activ,NET-WCF-HTTP-Activation45,Web-Includes,Web-Static-Content,Web-Windows-Auth,Web-Mgmt-Console,InkAndHandwritingServices -source r:\sources\sxs -restart
- Download Office Web Apps from http://www.microsoft.com/en-us/download/details.aspx?id=35489
- Download Office Web Apps updates from http://support.microsoft.com/kb/2760445
- Install also NLB feature on all servers that will run WAC (OWA – Office web apps)
Configuration
Requesting needed certificates for WAC (Office Web Apps)
In the first node of this FARM generate the certificate request using mmc.exe , Certificates, Personal and then go to all tasks, advanced operations and select “Create Custom Request”
Windows + R \ mmc.exe <enter>
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe2.png?w=614
Follow the instructions below.
Select Custom Request and click Next
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe3.png?w=614
At Custom Request select the “web server” template, and at “request format” check PKCS #10 and click Next
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe5.png?w=614
Select properties once you have “web server” at Active Directory Enrollment Policy and click Properties
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe6.png?w=614
Select Custom Request and click next
At general TAB name the certificate “officeweb” and click Apply
At the subject, TAB select “common name” at type and give the CN name to this certificate
Hm11.home.intranet and click ADD
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe7.png?w=614
At “Alternative name” select DNS as type
Fill with the following names:
Officeweb.home.com.br (your external URL that is going to be used to answer the request for WAC)
Officeweb.home.intranet (your internal URL that is used to answer for internal request inside your ADDS network/netbios domain)
And also add the hostnames of the servers where WAC FARM is running.
Hm11.home.intranet
Hm12.home.intranet
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe9.png?w=614
At the “Private Key” TAB select the key size as 2048.
Check “Make private key exportable” and click OK or Apply.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe10.png?w=614
After this, click Next and select the folder to save the request file yourcertreqname.req and click Save.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe11.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe12.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe13.png?w=614
Be sure that your folder path is correct and the file has its own name and file extension .REQ and click FINISH
Now you can request your certificate at your internal CA (certificate authority) in AD forest.
Access your internal CA URL to request the certificate.
Select “Request a certificate”.
Select “Advanced certificate request”.
Select the option “Submit a certificate request by using a base-64 encoded CMC or PKCS #10, or submit a renewal request by using a base-64 encoded PKCS #7 file”.
Open the certificate request file in Notepad, copy the entire data and paste it into the “saved request” \ Base-64-encoded certificate request.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe14.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe15.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe16.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe17.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe18.png?w=614
Wait until processed and then select DER encoded or Base 64 encoded and click “download certificate”. If you prefer you can click “download certificate chain” and this file contains the CA root certificates of your CA tree.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe19.png?w=614
Import the certificate in the 1st server of the FARM
After that, you can export this certificate with its private key to use it (import it) at the 2nd FARM server.
ATTENTION: for each server joined at this FARM you need to name it at the DNS type at the requested certificate done in the first steps of this article.
Deploying the WAC FARM
At the first server of the FARM run the following command in the PowerShell as administrator
New-OfficeWebAppsFarm -InternalUrl https://officeweb.contoso.net –ExternalUrlhttps://officeweb.contoso.com -CertificateName "office" –AllowHttp
where “office” in red is the “subject name” used during the certificate request.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe20.png?w=614
For each new server joined at this FARM execute the following command
New-OfficeWebAppsMachine –MachineToJoin "hm11.home.intranet"
If everything is ok at this moment you can run the “get-officewebappsfarm” command to verify the servers that are joined at this FARM.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe21.png?w=614
*sometimes you won’t resolve the server’s name of all servers joined at the FARM and a good Solution is to import again the certificate at IIS or direct using MMC.exe \ certificates \ personal.
** **
Validation tasks
At the first server joined at the FARM, open a browser and hit the following addresses:
https://hm11.home.intranet/hosting/discovery/ - local server name
https://officeweb.home.com.br/hosting/discovery/ - external url
From a remote server (not a FARM server)
https://<server_XXX>.home.intranet/hosting/discovery/ (server name/hosting/discovery/)
https://officeweb.home.com.br/hosting/discovery/ (external url name/hosting/discovery/) -> this is the name used at the Lync and Skype 4 Business topology publishing.
Validate the NLB function
Shutdown one of the servers joined at this FARM (or only disconnect the NIC or virtual NIC)
Hit the external URL from internet of a remote host https://officeweb.home.com.br/hosting/discovery/
The answer should be of the following.
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe22.png?w=614
Configuring (Office Web Apps) at Lync 2013/Skype 4 Business
At the Lync/Skype For Business front-end server
Use the topology builder at shared components (office web apps servers)
Set it to officeweb.home.com.br, your external URL (visible internally and externally)
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe23.png?w=614
https://thiagobeier.files.wordpress.com/2013/08/080513_1921_owaofficewe24.png?w=614
Publish the topology and follow the instructions
*for LAB please create a DNS zone named home.com.br for internal resolution, at this lab we have two DNS zones in ADDS home.intranet (ADDS integrated zone) and home.com.br (your external valid DNS zone).
** **