Edge Server is a server role that is deployed in a perimeter network to support access by external users. External users include remote, federated, and anonymous users. Office Communications Server supports connectivity with one or more of the following public IM service providers: AOL, MSN, and Yahoo!.

Note:
In this discussion, external users who access the network by using a VPN connection are considered to be internal users.

An Edge Server runs three services: Access Edge service, A/V Edge service, and Web Conferencing Edge service. All three services are automatically installed with an Edge Server.

In addition to one or more Edge Servers, HTTP reverse proxies are also required in the perimeter network. Collocation of an Edge Server with a reverse proxy or with an internal or external firewall is not supported. The Access Edge service cannot be collocated with any other network perimeter service, such as Microsoft Internet Security and Acceleration (ISA) Server or the Microsoft Exchange 2007 Server Edge role.

The components support external access as follows:

The following edge topologies, each with a single HTTP reverse proxy in each physical location, are supported in the perimeter network:

For deployments with multiple locations, only a single Edge Server or a single load-balanced array of Edge Servers is supported for federation and for public IM connectivity. Multiple Access Edge Servers in multiple locations are supported for remote user access.

For a scaled consolidated edge topology with multiple Edge Servers, the next-hop server on the Director must target the virtual IP address of the Access Edge service array on the internal load balancer.

An Edge Server is supported by both the Standard Edition server product key and the Enterprise Edition server product key.

Joining the Edge Server to a domain located entirely in the perimeter network is supported but not recommended. An Edge Server should never be part of a domain in the internal network.

Certificates

Each Edge Server must have an internal certificate. All three Edge services on that server share this certificate. The subject name of the certificate must match the internal fully qualified domain name (FQDN) of the Access Edge service of that Edge Server.

Each Edge Server requires two external certificates—one for the Access Edge service, and one for the Web Conferencing Edge service. Each of these certificates must have a subject name that matches the external FQDN of that Edge service on that server.

An additional certificate is required for A/V authentication. The private key of the A/V authentication certificate is used to generate authentication credentials. This can be an internal certificate, but as a security precaution, you should not use the same certificate for A/V authentication that you use for any of the Edge Server services.

For details about certificate requirements, see Certificate Requirements for External User Accessin the Planning and Architecture documentation.

Internal and External Interfaces

Each of the three services running on an Edge Server has a separate external and internal interface. Each of the services requires a separate external IP address/port combination. The recommended configuration is for each of the three services to have different IP addresses, so that each service can use its default port settings.

Using different DNS names for each of the two interfaces is required. A unique IP address and a unique FQDN are required for the internal and external interface. A multihomed network adapter that uses the same DNS name, and therefore the same IP address, for both internal and external interfaces is not supported.

In a site with only a single Edge Server deployed, it is recommended that the IP address of the external interface of the A/V Edge service be publicly routable. However, the external firewall can function as a network address translation (NAT) for this IP address in this scenario.

In any location with multiple Edge Servers deployed behind a load balancer, the IP address of the external interface of the A/V Edge service must be publicly routable. The external firewall cannot function as a NAT for this IP address. This requirement does not apply to other Edge Server services.

The internal firewall must not function as a NAT for the internal IP address of the A/V Edge service. The internal IP address of the A/V Edge service must be fully routable from the internal network to the internal IP address of the A/V Edge service.

See Also