The OCS 2007 R2 Edge and NAT

Any Post starting with this disclaimer means that this post was not written by me however I have liked it and added to my blog. I will also include the link to the original or Similar post to provide credit to the original author.

https://blogs.pointbridge.com/Blogs/mcgillen_matt/Pages/Post.aspx?_ID=61

The proof was came last week when I was working with a client on an R2 edge server. This was the perfect test case because we had already tried NAT with R1 and, of course, it failed…

So we were going to try it again with R2 – same firewall and everything. As we went through the R2 Edge config, there was a little check box on the AV interface that said “This address will be NAT’d”. Sweet!

We checked the box…and… it failed .

We were kinda puzzled, but the OCS error logs came to the rescue. The error log showed that the edge server was “unable to resolve ‘av.customer.com’ – using 10.x.x.x instead”.

That’s exactly what I didn’t want: the internal IP being handed out. The helpful hint, though, is that the edge was trying to resolve the name “av.customer.com”. If you ask me, this is a bit odd. It would make more sense to me if OCS just had a parameter that said “external IP address of AV edge”. But apparently not – it just does a lookup on the AV edge FQDN.

The client was using split-brain DNS and didn’t have a record for av.customer.com in the internal DNS zone. So we added an A record. But listen up here: you want to add the PUBLIC IP for av.customer.com in your DNS – even if it’s an internal DNS server.

Apparently, this is the mechanism for the edge to figure out what IP to hand out to external clients for AV sessions.

 In summary:

• Check the “use NAT” box in the AV edge configuration properties
• Make sure your internal and external DNS A records for the AV edge server are configured with external addresses.

Big improvement over R1