Secured, SIP Secured and Unsecured Voice integration Exchange

-

In Exchange 2007/ 2010/ 2013, you are able to set different security configuration for your SIP Traffic.
Therefore special configuration between Gateway, Lync (via Exchange Dial Plans) and Server-to-Server Communication can be defined.
Let talk about Exchange 2013 and Lync 2013 UM integration, especially for your configuration in your live environment.
 
With Exchange Administration Center (EAC) or the Set-UMDialPlan cmdlet in PowerShell you can define your SIP Security configuration.
When you configure the UM dial plan to use SIP secured* ([-VoIPSecurity <SIPSecured | Unsecured | Secured>])or Secured mode, Client Access and Mailbox servers will encrypt the SIP signaling traffic or the RTP media channels or both. For Lync, you need the special SIP Secured Mode (described below)


VoIP security mode, can be configured as:
-          SIP secured
(SIP Secured setting only protect SIP traffic using TLS while RTP traffic would be transmitted over TCP)

-          Secured
(SIP Signaling and Media traffic via TLS – properly for Exchange and Lync communication)

-          Unsecured (default)
(no encryption)

 

 

*) The VoIPSecurity parameter in Exchange Dial Plan specifies whether the signaling channel is encrypted using mutual Transport Layer Security (TLS). The default setting is Unsecured.

Secure SIP is defined by SIP RFC 3261, a security mechanism defined for sending SIP messages over a Transport Layer Security-encrypted channel. It was originally used for securing HTTP sessions; Transport Layer Security (TLS) can be used to protect SIP session communications from eavesdropping or tampering.

Certificates:
If you configure SIP traffic with in Exchange only, chosen certificates can be self-signed certificates in Exchange, if any other server, like Lync is involved for this Dial Plans, you need to ensure that a trusted root authority is used. This could be managed with an internal Enterprise Certificate Authority.

Comments

Post a Comment

Popular posts from this blog

Cannot join external Lync Meeting: Lync Edge Server Single IP Address (Lync Edge Server Single IP Web Conferenceing Problem)

-
Image
Lync Edge Server FQDN and IP PORTS (Version 1.2, Update 26.11.2014) As we all know, we can configure Lync Edge Server in several way. 1) Single Edge Server with a SINGLE IP ADDRESS 2) Single Edge Server with MULTIPLE IP ADDRESSES (3x IPs) 3) Multiple Edge Server in a Pool, with MULTIPLE IP ADDRESSES (Zx 3 IPs) Regardless what we are going to configure, there are common / well-known TCP Port necessary making Lync work, which are: Access: Port: 443 and 5061 Conferencing: Port: 443 and (444) AV: Port: 443 (I have not listed other ports, e.g. STUN or the dynamic port range. This is not required for the topic discussed here) External FQDN with single IP address: What can we see here? If we are going to choose a single IP address, we would have TCP Port overlapping. Therefore the only way avoiding this is assigning other ports. Additionally we will also see and are reminded that Lync highly depends on DNS. If we have single IP, we must have use single, unique FQDN fo
Read more

MFA with Guest Access and different tenants settings

-
Image
There is an update regarding MFA Multi Factor Authentication. If you are guest with a different Tenant, the MFA Settings are now reflecting the settings of all tenants in a different way. Each MFA setting is reflected and you can setup your MFA device as per tenant and the admin settings allow. Login to your Profile in Office 365/ Azure AD: https://account.activedirectory.windowsazure.com/r/#/profile or https://myapps.microsoft.com Go to your PROFILE: Sign in to https://myapps.microsoft.com Select your account name in the top right, then select profile. Select Additional security verification. If might be happen, your admin hast configured MFA, so you wouldn't see this menu. Simply switch the tenant to the guest tenant where you need to configure MFA. Once you go back to your profile and you will find the MFA device and other settings a usual:
Read more

Skype for Business, Lync and Exchange Web Services (EWS) and different DNS Domains- Exchange crawling e.g. for presence

-
Image
Hi all, (This is an updated version 2.2: 09 .07.201 5 ) This blog entry is valid for Lync 2010, Lync 2013 and Skype for Business Server. Generally, I'll write a new blog article, since the conversion history over multiple device and other service have change with Skype for Business 2015 Server. Once this written, I post the link here. there is always confusion in how Lync is crawling Exchange Web Services (EWS). Generally it is necessary to understand how DNS must be implemented: Just remember, identify if you have DNS Split configuration, different internal and external DNS names and what are your SMTP and SIP Domains. Very often you find in Lync/ Exchange deployments an issue, where the Lync configuration show up with empty: EWS Internal URL EWS External URL and EWS Information = EWS not deployed Therefor Exchange Web Service are not connected deployed and several Lync Integration Features are not working, e.g. Presence Information based on your Outlook Calendar.
Read more