1. Ready Your Network for Skype for Business Online
Microsoft 2016
4/22/2018 6:03 PM
BRK3061
Ready Your Network for Skype for Business Online
Hao Yan
Principle Software Architect
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Session Objectives Connectivity to Skype for Business Online
Network impact on experience
Required vs. optional
Skype for Business traffic flow
Protocols and port
Network Performance Requirements and Measurement
Segments of Network
Network Performance Targets
Assessing Network Performance
Plan the network connectivity to Skype for Business Online
DNS, IP, & Routing
Firewall & Proxy
Bandwidth & QoS
VPN
ExpressRoute

3. Skype for Business Online Network Connectivity
4/22/2018 6:03 PM
Skype for Business Online Network Connectivity
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Why Do We Care About the Network?
4/22/2018 6:03 PM
Why Do We Care About the Network?
Goal: Great Office 365 cloud service experience
There is a large correlation between quality of service experience and connectivity between end users and service
Connectivity to the cloud is a distributed, end to end proposition that spans layers of the stack, different parts of enterprise topologies and often teams/organizations
What impacts Skype for Business (SFB) Call Quality & Reliability?
Environment – noisy environment, shared office space, typing noise…
Skype for Business media stack provide noise reduction, echo cancellation capabilities
Devices – bad quality built-in mic, bad device driver, device hang…
Use higher quality headsets instead of laptop built-in devices
Use Certified devices – Phones and Devices for Skype for Business
Network – broken network path, long delay, high packet loss, jitter
Use Skype for Business Online Call Quality Dashboard to verify device and network impact to call quality
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Connectivity to Office 365
Office 365 including Skype for Business is a SaaS cloud
Multi-tenant, public interfaces, isolation at application level
Required connectivity
Accessing all services from the internet
Accessing all services from customer networks
Accessing common internet resources such as DNS and CRL
Optional connectivity
ExpressRoute connection between customer networks and Office 365
Level of customer controls is driven by the level of trust

6. ExpressRoute ExpressRoute is ExpressRoute is not
4/22/2018 6:03 PM
ExpressRoute
ExpressRoute is
Dedicated network route for connecting to Office 365, with controlled route, predictable bandwidth and more consistent performance
ExpressRoute is not
A security solution
A way to automatically meet SFB network performance requirements
When to consider ExpressRoute
If ER provider can help significantly improve network performance in some or all locations.
If you need a service level agreement (SLA) on availability (99.9%) of the connection between your network and Microsoft network.
If you plan for end-to-end Quality of Service (QoS).
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Skype for Business Online Traffic Flows
P2P calls – internal/external, Conference calls, PSTN calls
Peer-to-Peer calls - internal

8. Signaling and Data Collab Protocols#
What for
Data
Transport
Source Port
Destination
Port
Encryption
What happens if disabled? 1
Signaling – Windows, Mac
SIP
TCP
Windows:
443
Full TLS
Can’t sign in
No IM 2
Signaling – Web, mobile
HTTP 3
Data collab – file attachments, PPT upload, whiteboard, Q&A, poll
PSOM
No content sharing in meeting 4
PowerPoint presentation service
No PPT in meeting 5
Service IP number resolution
DNS
UDP 53
Can’t join

9. Media Protocols # What for Data Transport Source Port Destination Port
Encryption
What happens if disabled? 1
Audio – Windows, Mac, Web, Mobile
RTP
UDP
50,000 – 50,019
UDP 3478
UDP 50,000 – 59,999
Secure RTP
Audio cannot flow over UDP ports (preferred) 2
TCP
TCP 443,
TCP 50,000 – 59,999
Audio cannot fall back to TCP (less reliable) 3
Video – Windows, Mac, Web, Mobile
50,020 – 50,039
Video cannot flow over UDP ports (preferred) 4
Video cannot fall back to TCP (less reliable) 5
Desktop or Application Sharing - Windows, Mac, Web, Mobile
RDP/RTP
50,040 – 50,059
Desktop or Application Sharing does not work

10. Skype for Business Online Network Performance Requirements
4/22/2018 6:03 PM
Skype for Business Online Network Performance Requirements
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Network Performance Requirements
Microsoft 2016
4/22/2018 6:03 PM
Network Performance Requirements
Customer
Network Edge
Internet/ ER
Microsoft
Network Edge
SfB Online DC
Client
WiFi
LAN
Client-MNE
Microsoft Network
RTT <=100ms
Customer Network
CNE-MNE
RTT <=60ms
Call flow media path
SFB Services
SfB Client
Media Relay
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Network Performance Requirements
Microsoft 2016
4/22/2018 6:03 PM
Network Performance Requirements
For optimal Skype for Business media quality, the following network performance requirements should be met:
Metric
Client to Microsoft Network Edge
Customer Network Edge to Microsoft Network Edge
Latency (one way)
<50ms
<30ms
Latency (RTT or Round-trip Time)
<100ms
<60ms
Burst packet loss
<10% during any 200ms interval
<1% during any 200ms interval
Packet loss
<1% during any 15s interval
<0.1% during any 15s interval
Packet inter-arrival jitter
<30ms during any 15s interval
<15ms during any 15s interval
Packet reorder
<0.05% out-of-order packets
<0.01% out-of-order packets
Media Quality and Network Requirements at:
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Measuring and Monitoring Network Performance
When to measure?
Plan
One time network assessment to determine network readiness
Pinpoint network issues for remediation
Deploy
Validate network performance
Validate network remediation
Operate
Before/After major network change
Before/After network configuration change
Before/After Internet access/ER change
On-going network performance monitoring for performance drift
How to measure?
Use tools recommended by Skype Operations Framework
Target Skype’s world wide Anycast IP –
Assess both your network and connections to Office 365
Assess with enough data to cover all network traffic patterns
Assess for >= 1week
Measurement every ~10 minutes
Use the 90th percentile value
Compare results with Network Performance Requirements

14. Skype for Business Online Network Connectivity Considerations
4/22/2018 6:03 PM
Skype for Business Online Network Connectivity Considerations
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Routing to Skype for Business Online
4/22/2018 6:03 PM
Routing to Skype for Business Online
DNS
Office 365 DNS records are only published over the internet
Skype for Business FQDNs must be externally resolvable to public IP address of the SfB services
IP addresses
Skype for Business Online services offered through public IP addresses
Skype for Business Online traffic are all* initiated from client to the cloud service’s IP addresses
Public IP addresses required from customer: for return traffic routing
Routing
Routes to Skype for Business Online public IP addresses are advertised over internet and over ER
If implementing NAT, source NAT (i.e. cannot affect the destination IP addresses) is recommended
Plan for route symmetry and avoid asymmetrical routing
Internet/ER egress locations
For best reliability and quality regional Internet/ER routing is recommended
Hot potato routing - passing traffic off to Microsoft network as quickly as possible
Office 365 are bringing client access servers and Skype media relays closer to our users
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Regional Internet Routing

17. Regional ExpressRoute Routing

18. Firewall Configuration
4/22/2018 6:03 PM
Firewall Configuration
IP & URL whitelist
Allow outbound UDP/TCP traffic to Office 365 URLs and IP address ranges
URLs and IP address ranges updated monthly. Subscribe via RSS feed to get change notification
Blocking Office URLs and IP addresses may result in broken user experience
Ports
Minimum: Allow outbound TCP traffic to destination port 443
Better: In addition, allow outbound UDP/TCP traffic to destination port 3478
Best: In addition, allow outbound UDP/TCP traffic to destination port range 50,000 – 59,999
NAT
Source NAT is recommended
Network address/port mapping must not change during any Skype audio/video/screen sharing session
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Http Proxy Http Proxy Support Configuration Http Proxy
4/22/2018 6:03 PM
Http Proxy
Http Proxy Support
Skype for Business clients do work with http proxies
But for best reliability and quality SFB recommends IP routing between clients and the Service
Since all SFB/O365 traffic is encrypted, proxies can’t see the traffic
SFB/O365 place a large load on the proxies causing delays and reliability issues
There is usually not enough proxy locations to implement regional routing to SFB
Bypass HTTP proxy for SFB real-time media traffic
Also bypass inline WAN acceleration devices
Configuration Http Proxy
Turn off deep pack inspection for SFB media traffic
Update PAC (proxy auto-config) file to allow Office 365 URLs and IP address ranges
For direct IP routing and/or ER, update PAC file to exclude ExpressRoute enabled IP address ranges
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Http Proxy - Sample PAC file
//EXPRESS ROUTE DIRECT
else if ((isPlainHostName(host))
|| (shExpMatch(host, "*.microsoftonline.com"))
|| (shExpMatch(host, "*.outlook.office.com"))
|| (shExpMatch(host, "*.protection.outlook.com"))
|| (shExpMatch(host, "*.lync.com"))
|| (shExpMatch(host, "*.sharepoint.com"))
|| (shExpMatch(host, "*.officeapps.live.com"))
|| (shExpMatch(host, "home.office.com")) ……
|| (shExpMatch(host, "login.windows.net"))
|| (shExpMatch(host, "smtp.office365.com"))
|| (shExpMatch(host, "delve.office.com"))
|| (shExpMatch(host, "domains.live.com"))
|| (shExpMatch(host, "a.config.skype.com"))
|| (shExpMatch(host, "b.config.skype.com"))
|| (shExpMatch(host, "config.edge.skype.com"))) {
return "DIRECT"; }
//Catchall for all other traffic to proxy
else
return proxyserver;
function FindProxyForURL(url, host) {
// Define proxy server
var proxyserver = "PROXY :8080";
// Make host lowercase
var lhost = host.toLowerCase();
host = lhost;
//SUB-FQDNs of ExpressRoutable wildcards which need to be explicitly sent to the proxy at the top of the PAC
if ((shExpMatch(host, "*.click. .microsoftonline.com"))
|| (shExpMatch(host, "*.portal.microsoftonline.com"))
|| (shExpMatch(host, "*.nexusRules.officeapps.live.com"))
|| (shExpMatch(host, "nexus.officeapps.live.com"))
|| (shExpMatch(host, "odc.officeapps.live.com"))
|| (shExpMatch(host, "cdn.odc.officeapps.live.com"))
|| (shExpMatch(host, "ols.officeapps.live.com"))
|| (shExpMatch(host, "ocsredir.officeapps.live.com"))
|| (shExpMatch(host, "ocws.officeapps.live.com"))
|| (shExpMatch(host, "ocsa.officeapps.live.com")))
return proxyserver; }

21. VPN VPN impact Bypass VPN for SFB traffic
Microsoft 2016
4/22/2018 6:03 PM
VPN
VPN impact
Double encryption introduces delay, loss, jitter
Non-optimal media path for real-time traffic
Calls over VPN are ~2x more likely to drop than calls not over VPN
Calls over VPN have lower MOS (Mean Opinion Score)
Bypass VPN for SFB traffic
Implement split-tunnel (exclude SfB IP ranges from VPN tunnel)
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Bandwidth Planning E2E Network Bandwidth planning is critical
4/22/2018 6:03 PM
Bandwidth Planning
E2E Network Bandwidth planning is critical
Congestion on any part of the Skype for Business media path introduces delay, loss, and jitter
Use Skype for Business Bandwidth Calculator for network bandwidth calculation
Purchase correct amount of bandwidth at the right locations for internet/ER egress and for internal WAN. Provision for peak time traffic.
Estimated bandwidth utilization for media codecs (all numbers in kbps):
Audio codec
Scenario
Audio payload
PLUS - IP header
PLUS - UDP, RTP & SRTP
PLUS - FEC
RTAudio Wideband
Peer-to-peer
29.0
45.0
57.0
86.0
RTAudio Narrowband
Peer-to-peer PSTN
11.8
27.8
39.8
51.6
G.722
Conferencing
64.0
80.0
95.6
159.6
G.722 Stereo
LRS P2P & Conf
128.0
144.0
223.6
G.711
PSTN
92.0
156.0
Siren
16.0
32.0
47.6
63.6
SILK Wideband
36.0
52.0
100.0
26.0
42.0
54.0
20.0
48.0
68.0
SILK WB/NB
13.0
41.0
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. QoS (Quality of Service)
4/22/2018 6:03 PM
QoS (Quality of Service)
Prioritize real-time media in congested situation
However QoS cannot replace a properly provisioned network with enough bandwidth
Implementing QoS
Must: Enable QoS in your internal network (Wifi, LAN, WAN)
Optional: Enable E2E QoS by implementing ExpressRotue
Source Port based DSCP marking, e.g. from source port , add audio DSCP tag
Configure DSCP using Windows group policy or at the network switches and routers
Traffic Class
Treatment (DSCP Marking)
Skype for Business workloads
Voice
EF (46)
Skype for Business and Lync voice
Interactive
AF41 (34)
Video
AF21 (18)
Application sharing
CS3 (24)
SIP signaling
Default
AF11 (10)
File transfer
CS0 (0)
Anything else
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Session Takeaways Network performance is key to SFB media experience
4/22/2018 6:03 PM
Session Takeaways
Network performance is key to SFB media experience
Network assessment before, during, and after SFB Online implementation
Regional IP based routing works better than HTTP proxy only access to SFB
ExpressRoute is optional routing mechanism to Office 365
Allow outbound UDP/TCP traffic to Office 365 URLs, IP ranges and ports
Bandwidth and QoS Planning go hand-in-hand
Bypass VPN for remote users
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Related Sessions Tuesday Wednesday Thursday Friday
4/22/2018 6:03 PM
Related Sessions
Tuesday
2:15pm BRK2077 Get to Know the Skype Operations Framework, by Ali Rohani
4:00pm BRK3058 Dig into the Skype Operations Framework, by Bryan Nyce
Wednesday
10:45am BRK3050 Troubleshoot operations with Skype Call Quality Management, by William Looney
12:30pm BRK2080 Understanding devices certified for Skypt for Business: what’s in it for you? By Albert Kooiman & Angela Donohue
Thursday
12:30pm BRK3054 Plan for Skype for Business Cloud Connectivity with Microsoft Office 365, by Nikolay Muravlyannikov
Friday
10:45am BRK4011 Deploy ExpressRoute for Skype in Microsoft Office 365, by Korneel Bullens
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. #MeetingAccomplished
Microsoft Ignite 2015
4/22/2018 6:03 PM
#MeetingAccomplished
Want to win a new Skype Room Systems meeting room bundle from Microsoft and Logitech?
Check out Skype Room Systems in the Expo Hall at
Microsoft Showcase MS 111 or Logitech Booth 1818.
Snap a photo of the device in action and share your photo on Twitter or Instagram with the hashtag #MeetingAccomplished, or upload it to
to enter to win your own Skype Room Systems bundle!*
*No purchase necessary. Open only to legal United States residents. Sweepstakes ends 9/30/2016. See for Official Rules.
Microsoft Ignite #MeetingAccomplished
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Join the Skype for Business Community
Microsoft Ignite 2016
4/22/2018 6:03 PM
Join the Skype for Business Community
Discover rich discussions and
information sharing across
customers, partners, and users
IT Pro Forums
User Forums
Broadcast Updates
Tips and Tricks
Product Updates
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. Deploy, ramp-up on new services and onboard new users with Microsoft FastTrack:

29. Join the Microsoft Tech Community to collaborate, share, and learn from the experts:

30. Please evaluate this session
4/22/2018 6:03 PM
Please evaluate this session
Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.