Hi team,

I'm a bit confused about the term 'hairpinning' when it comes to Lync Mobility, let's take the following scenario;

Here's the configuration:

Internal DNS:

• lyncdiscoverinternal.contoso.com -> 192.168.10.190
• lsweb.contoso.net ->192.168.10.190 (Internal Web Services FQDN)
• lswebext.contoso.com -> 131.107.155.40 (Public IP for Rev Proxy)

External DNS:

• lyncdiscover.contoso.com -> 131.107.155.40 (Public IP for Rev Proxy)
• lswebext.contoso.com -> 131.107.155.40 (Public IP for Rev Proxy)

In this scenario, when a user access the client from internally,

• The mobile client first resolves lyncdiscoverinternal.contoso.com and gets replied with the IP 192.168.10.190
• The client then connects to the FE server using above reply, and gets replied with all MCx web service URL's from the Internal Autodiscover Virtual directory.
• Then the client queries for lswebext.contoso.com and the DNS server provides the external IP of 131.107.155.40
• Client then goes out to the internet, takes the internet journey and then hits back in the external firewall IP of 131.107.155.40, get's NAT'ed and connects to the FE via Reverse Proxy(TMG)
• Client is connected and happy.

Can anyone please clarify if what i'v mentioned above is the way that mobility works? What I'm worried and concerned are the one's that are in BOLD and Underlined and would like to know if they are the case.

Here's what I'm trying to figure out,

A. Are the DNS records correct in the Internal DNS records, specially the last one?

B. The IP returned should be the Public IP right? (or is it the IP of the external interface of Reverse Proxy 10.45.16.40 as per above image?

C. Can someone explain me how the client goes out?

• Is it through the TMG to the Internet and back to the TMG or

• through some other routing which is defined by routers etc. to the internet and and back to TMG?

D. Where does 'hairpinning' comes to play and what is it all about?

Thank You.Cheers,
Jude!

The DNS records are correct.

The IP address returned should be the Public IP.

The traffic can go through the TMG to the internet and back to the TMG. In this scenario, the hair-pinning happens.

Hair-pinning occurs when communication traffic exits and enters the same interface on a network device.

One way to resolve this issue is to use a reverse proxy that is separate from the firewall (the spoofing prevention rule should always be enforced at the firewall, for security purposes). The hairpin can occur at the external interface of the reverse proxy instead of the firewall external interface. You detect the spoofing at the firewall, and relax the rule at the reverse proxy, thereby allowing the hairpin that mobility requires.

Check the solution for hair-pinning.

http://blogs.technet.com/b/nexthop/archive/2012/11/19/configuring-reverse-proxy-for-lync-server-2010-mobility.aspx