Johan Delimon 26/04/2016 BE-COM E-COMMUNICATIONS EVENT THE INNER WORKINGS OF SKYPE FOR BUSINESS: NETWORKING

Johan Delimon idelimon BVBA / / Skype for Business MVP / MCSM Communications / Skype4B Architect

(SIP) Session Initiation Protocol & (SDP) Session Description Protocol Microsoft Ignite 2015 (Chicago, US)

SIP Primer Configuration & Settings SDP Primer Internal Only Calls External Calls / Cloud Connector Agenda

INVITE (+SDP) 180 Ringing 200 (+SDP) OK ACK INVITE (+SDP) 180 Ringing 200 (+SDP) OK ACK

Session Initiation Protocol SIP has no secrets (Everything is visible) Client or Server Logging (Office 365) Snooper is your friend

PrecedenceLocation or Method of Setting 1Skype for Business in-band provisioning 2HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\15.0\Lync 3HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\15.0\Lync 4Skype for Business - Options dialog box in Skype for Business Client Configuration Settings, Skype for Business

SUBSCRIBE SIP/2.0 Content-Type: application/vnd-microsoft-roaming-provisioning-v2+xml Provisioning SFB Client Policies & Settings In-Band Provisio ning

Provisioning SFB Client In-Band Provisio ning

Office 365 Port Configuration for SFB Clients Service Default Port Range Default Ports Customized Port Range Custom Ports Minimum Custom Ports Type Audio K Custom Video K Custom Application Sharing K Custom File Transfer K Custom

SERVICE KrFykWklySMEr01LKV9wAA SIP/2.0 Content-Type: application/msrtc-media-relay-auth+xml Provisioning SFB Client MRAS = Media Relay Authentication Service MRAS

(MRAS) Media Relay Authentication Service MRAS

Client does not connect to EDGE FE connects to EDGE TCP Port 5062 If FE no TCP 5062 to EDGE then Client shows Limited External Calling (MRAS) Media Relay Authentication Service

INVITE ( +SDP ) 180 Ringing 200 ( +SDP ) OK ACK INVITE ( +SDP ) 180 Ringing 200 ( +SDP ) OK ACK

SDP Offer (INVITE) SIP Message Body = SDP SIP Message Body = SDP Content Type Application/sdp

SDP Offer (INVITE) SIP Message Body = SDP SIP Message Body = SDP Content Type Application/sdp

SDP Response (200) SDP

SDP Details (filtered) Audio Call, Encryption & Codec Priority Candidates

IP Address & Port combination to send Media Stream 3 Candidate Types Host = End Point IP STUN/Reflexive = Public IP of Firewall TURN/Relay = Edge Server IP Candidates DMZ Router Edge ICE Client ICE Server ❶ Host Candidate – Likely to fail ❷ STUN / Reflexive Candidate ❸ TURN / Relay Candidate – Edge Relay ❶ ❷ ❸

Candidates Host Candidates TURN / Relay EDGE Server Candidates STUN / Reflexive Candidates

RE-INVITE & Final Information

RE-INVITE & Final Information (Continued)

Inside Only

Default Media Port Ranges Skype for Business Client Enterprise Pool Port : Port : 0 Port : 1024 Default Audio Port Range Default Video Port Range Default App Sharing Port Range Default File Sharing Port Range Default Audio Port Range Default Video Port Range Default App Sharing Port Range Port : Port : Port : Port : 0

Custom Media Port Ranges Port : Port : 0 Port : 1024 Default Audio Port Range Default Video Port Range Default App Sharing Port Range Port : 0 Port : Port : Port : Port : Custom Audio Port Range Custom Video Port Range Custom App Sharing Port Range Custom File Sharing Port Range Skype for Business Client Enterprise Pool

Custom Configuration on the SFB Servers Service Default Port Range Default Ports Customized Port Range Customized Ports Type Application Sharing Custom Audio Default Video Default

Custom Media Port Ranges Port : Port : 0 Port : 1024 Custom Audio Port Range Custom Video Port Range Custom App Sharing Port Range Custom File Sharing Port Range Default Audio Port Range Default Video Port Range Custom App Sharing Port Range Port : Port : Port : Port : Port : 0 Skype for Business Client Enterprise Pool

Custom Configuration of the SFB Clients Service Default Port Range Default Ports Customized Port Range Custom Ports Minimum Custom Ports Type Audio K Custom Video K Custom Application Sharing K Custom File Transfer K Custom

Office 365 Media Port Ranges Port : Port : 0 Port : 1024 Custom Audio Port Range Custom Video Port Range Custom App Sharing Port Range Custom File Sharing Port Range Default Audio Port Range Default Video Port Range Custom App Sharing Port Range Port : Port : Port : Port : Port : 0 Skype for Business Client Enterprise Pool

Office 365 Configuration of the SFB Clients Service Default Port Range Default Ports Customized Port Range Custom Ports Minimum Custom Ports Type Audio K Custom Video K Custom Application Sharing K Custom File Transfer K Custom

Client does not connect to EDGE for MRAS FE connects to EDGE to get MRAS Credentials and passes to Client TCP Port 5062 (FE to EDGE) STUN/TURN/ICE EDGE = TURN (Relay Packets only No Termination of Media) EDGE Candidates and Routing/Tunneling MRAS Credentials used to Authenticate to EDGE in SRTP packets MRAS / EDGE

MRAS Credentials (Sign-In) Candidate Discovery (STUN/TURN) Candidate Exchange (SDP) Candidate Connectivity Checks (ICE) Candidate Promotion (RE-INVITE) Direct over Relay UDP over TCP STUN/TURN/ICE Process

Inside Only with Edge Configured

Inside Only with Servers

Full Cone NAT Source IP Source Port Public IP Public Port Destination IP Destination Port User A IPUser A PortFW IPFW Port User A User B User C

Address Restricted NAT Source IP Source Port Public IP Public Port Destination IP Destination Port User A IPUser A PortFW IPFW PortUser B IP User A User B User C

Address & Port Restricted NAT Source IP Source Port Public IP Public Port Destination IP Destination Port User A IPUser A PortFW IPFW PortUser B IPUser B Port User A User B User C

NAT Types

External User on Public Internet

External User behind Firewall

All External behind Firewall

External VPN User

SFB through VPN Tunnel

VPN Split Tunnel & Block Ports

Internal Clients (One Way Blocked by FW) Internal External Clients (FW allows to Internet) Tunneling Mode Optimized Federated Call Path DNS Load Balanced EDGE Pool Special Media Flow Scenario’s

EDGE High Port Range TCP 443 UDP

Special Scenario’s

Edge High Port Ranges in Federated Scenario

Cloud Connector x Office 365 Cloud Connector

ICE - Edge Media Connectivity in Lync

Microsoft Office Protocol Documents Microsoft Lync Server 2010 Resource Kit Microsoft Lync Server 2013 Resource Kit Tools Microsoft Lync Server 2013 Debugging Tools Microsoft Network Monitor Microsoft Message Analyzer Network Planning, Monitoring, and Troubleshooting with Lync ServerNetwork Planning, Monitoring, and Troubleshooting with Lync Server TechED US Recording : Meetings and Media: The Detailed ViewTechED US Recording : Meetings and Media: The Detailed View Download RTP.opn to display correct codecs in Message AnalyzerDownload RTP.opn to display correct codecs in Message Analyzer Learn more & Tools

Q&A THANKS TO OUR SPONSERS