Tuesday, November 04, 2008

How to publish your OCS 2007 address book externally without using ISA 2006 reverse proxying for external group expansion.

After much back and forth about Microsoft's requirement for ISA 2006 and reverse proxy for the address book publishing, I decided to try to find an alternate way.

Of course, per the OCS deployment guidelines, reverse proxy with ISA 2006 is the recommended solution, because you are not allowing direct access to the HTTPS server on your internal front end server.

Here's how to do it using a regular NAT translation and opening 443 to your front end server.

  1. Change your group expansion URL using wbemtest (from here and here)
  2. Configure an external DNS name, a NAT translation to your OCS Front End, and allow TCP/443 inbound. I used ocsab.domainname.com as a convention for the name.
  3. Request a new FE certificate using the OCS certificate wizard that includes existing names + ocsab.domainname.com. If you are only supporting Access Edge Remote connectivity from domain based PC's, you can still use your internal Enterprise PKI. If you want to support non domain workstations, you have two choices, have them install your internal SSL chain locally, or send this cert request to a third party trusted Certificate Authority.
  4. Install the certificate and assign it in OCS. After doing this, you will likely need to restart your OCS services.
  5. Finally, in IIS Manager, you will need to select this new certificate as the certificate to be used for the Default Web Site. This is a critical step, as the OCS certificate wizard does NOT seem to change this for you.

Enjoy having External group expansion while sticking to your guns on your choice of firewall vendor.

4 comments:

Anonymous said...

Chris,

why do you change the OCS certificate itself (Step 3 and 4)? Wouldn't it be enough to only change the IIS certificate?

-Bernd

Chris said...

Quite possible, Bernd. However, I did not want to do just IIS and then end up running into and OCS issues, so I went for the gusto!

Andrew said...

Hi, I have tried using IAG as a reverse proxy, add book and group expansion work, however whiteboard does not - using your method does whiteboard work as well ?
I can get from the internet to https://external.com/etc/place/null/SlideFiles/blank.png, its just not adding up for me !

Chris said...

Hmm... If you are federated, email me@chrislehr.com your federated SIP and I will IM you and try to help figure it out if I can....