Media Bypass with Cloud Connector Editon

-

Media bypass with Cloud Connector Edition

Update with CCE Verion 2.0
Media bypass allow the Skype for Business client leveraging on G.711 ulaw and a direct connection to the associated Session Boarder Controller with CCE.

 Where is the advantage not letting the client connect to the Mediation Server component in the CCE?
This is clearly not an advantage yet for leveraging the a distributed SBC deployment, where the client will be redirected via SIP Re-Invite to a possible close PSTN connection. Saying you have a central CCE with one SBC in Munich and one in Malaysia, but in Malaysia you didn't deploy a second CCE site.
Here the client can't not reconnect to the far SBC.

 But the media bypass advantage lays clearly in increasing a CCE concurrent call volume. Meaning the CCE can connect the call to the called CORE SBC and the CORE SBC handles call routing to other locations. This allows you to operate beyond the concurrent call limit of 500. If the SBC can handle more than 500 call simultaneously, the client has a direct connection to this SBC and this SBC routes the call to other SBC, which might be distributed across different locations. This will clearly save money.

In cascarded deployments, the client media stream will be with the outer SBC. The SBC needs to support this media redirect.

 Media Bypass is only available, if your SfB client is internal. External clients run through the Edge and Mediation Server, hitting the SBC. Routing on the SBC will still apply.

 Example:

 The advantage is clearly on the higher load a CCE an take, while the CORE SBC handles the Client Connections and reroute to the Sub-SBCs.
Important is, you must consider the network delay within your calculation.
Configuring Media Bypass on a CCE Site:
Set-CsTenantHybridConfiguration -HybridConfigServiceInternalUrl http://newname.domain/hybridconfig/hybridconfigservice.svc
$mediabypass = New-CsNetworkMediaBypassConfiguration -AlwaysBypass $true -Enabled $true
Set-CsNetworkConfiguration -MediaBypassSettings $mediabypass

Newname.domain must point to the CCE Mediation Server!
Port 80 must be open from internal Network to the CCE Mediation Server IP Address!
The URL is only queried once during LOGIN of the SfB client!
Note:
The replication can take up to 1hrs!
First within your Office 365 tenant might take 15 min and another 15+min down to your CCE.

 Client Requirements:
latest versions !


Check the replication within your Office 365 tenant 
Get-CsTenantHybridConfiguration -LocalStore

Check the replication on you Mediation Server VM (on the CCE)
Get-CsNetworkConfiguration -LocalStore



Technet reference:
https://technet.microsoft.com/en-us/library/mt808734.aspx
https://technet.microsoft.com/en-us/library/mt605227.aspx
https://technet.microsoft.com/en-us/library/mt808733.aspx

Note:
Clients will receive the web address of Media bypass web service from an internal DNS server. The name of the web service will be the same across all instances and Cloud Connector PSTN sites. In complex multisite environment, we recommend using Windows 2016 DNS Policy for Geo-Location Based Traffic Management, so clients can be redirected to web service which is local for their network.
More about Windows 2016 DNS Policy for Geo-Location Based Traffic Management can be found on the following link https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/primary-geo-location

 I will update this blog post and will write a new Configuration Guide (E-Book) with multi-site CCE Deployment and internal GEO-DNS. Geo DNS internally is required, since the Office 365 Tenant can only host a single HybridConfigServiceInternalURL entry.

 Optionally, you can host local site DNS Zone as per this hostname. Or you can use the host file on the client and configure it differently per network site.

Warning:
If the client DNS resolution fails, it will make CALLS, but it fallback not using Media Bypass, as the client therefore assumes it is external!

Troubleshooting Media Bypass:

The URL is not visible in the SfB Configuration Information. Us can only see this in the UCC-APILog file.



Author:

Comments

Post a Comment

Popular posts from this blog

Cannot join external Lync Meeting: Lync Edge Server Single IP Address (Lync Edge Server Single IP Web Conferenceing Problem)

-
Image
Lync Edge Server FQDN and IP PORTS (Version 1.2, Update 26.11.2014) As we all know, we can configure Lync Edge Server in several way. 1) Single Edge Server with a SINGLE IP ADDRESS 2) Single Edge Server with MULTIPLE IP ADDRESSES (3x IPs) 3) Multiple Edge Server in a Pool, with MULTIPLE IP ADDRESSES (Zx 3 IPs) Regardless what we are going to configure, there are common / well-known TCP Port necessary making Lync work, which are: Access: Port: 443 and 5061 Conferencing: Port: 443 and (444) AV: Port: 443 (I have not listed other ports, e.g. STUN or the dynamic port range. This is not required for the topic discussed here) External FQDN with single IP address: What can we see here? If we are going to choose a single IP address, we would have TCP Port overlapping. Therefore the only way avoiding this is assigning other ports. Additionally we will also see and are reminded that Lync highly depends on DNS. If we have single IP, we must have use single, unique FQDN fo
Read more

MFA with Guest Access and different tenants settings

-
Image
There is an update regarding MFA Multi Factor Authentication. If you are guest with a different Tenant, the MFA Settings are now reflecting the settings of all tenants in a different way. Each MFA setting is reflected and you can setup your MFA device as per tenant and the admin settings allow. Login to your Profile in Office 365/ Azure AD: https://account.activedirectory.windowsazure.com/r/#/profile or https://myapps.microsoft.com Go to your PROFILE: Sign in to https://myapps.microsoft.com Select your account name in the top right, then select profile. Select Additional security verification. If might be happen, your admin hast configured MFA, so you wouldn't see this menu. Simply switch the tenant to the guest tenant where you need to configure MFA. Once you go back to your profile and you will find the MFA device and other settings a usual:
Read more

How to hide users from GAL if they are AD Connect synchronized

-
Image
How to hide and un-hide users from Global Address List (GAL) in Exchange Online if they are AD Connect synchronized Hiding User from GAL isn't possible if those are synchronized form On-Premises Active Directory. The local AD is the leading system for all important attributes, like SMTP, UPN and hiding from GAL. Especially during a cross-tenant migration, you do not want to see not migrated user in the GAL. Those User aren't actively working until their cut-over day. Since the Exchange Online attribute  msExchHideFromAddressList s is an AD on-premises parameter, we have two possible ways hiding user in BME from GAL.   Modify the AD Connect for your teant with a custom rule, by using a extensionAttribute to set the HidefromGAL. In this rule, for users which have an entry in the extensionAttribute, hiding / un-hiding will be controlled by AD Connect This is the best option for Cross-Tenant Migration, if you run 2 or more AD Connect system We direct modify the AD hide at
Read more