The single Edge Server topology is a single server that hosts three server roles, as shown in Figure 7-1. The roles with their associated primary protocols are as follows:

Figure 7-1. Single Edge Server topology

The simplest installation involves minimizing the hardware required to provide access by consolidating the installation of the Access, Web Conferencing, and A/V Edge Servers on the same physical server in the edge network. Firewalls protect the edge network from the external network and protect the enterprise network from irregular access from the edge network. The consolidated Edge Server validates traffic from the edge network and connects to the internal servers in the organization, which could be a pool of servers or a single Office Communications Server Standard Edition Server.

For a single Edge Server topology, remote access Office Communicator clients use Transport Layer Security (TLS) to securely connect to the Access Edge Server from the Internet. This scenario may require multiple Internet Protocol (IP) addresses to be bound to the network interface to handle calls to the collocated roles. Office Communicator discovers the enterprise Access Edge Server through Domain Name System (DNS) Service Record Locators (SRVs). This interaction is similar to how internal clients connect. For more information about internal logon and DNS SRV records, see Chapter 5.

To prevent spoof and "man-in-the-middle" (a widely used security term, also known as the bucket brigade) attacks, Transmission Control Protocol (TCP) is not offered for clients that connect from external networks. The Access Edge Server has a certificate issued by a well-known certification authority (CA) that Microsoft Windows trusts. This enables computers outside the network that are not members of the domain to connect, validate, and trust the Access Edge Server certificate. This trust is necessary to prevent DNS spoofing attacks that could enable the connecting Office Communicator client to negotiate authentication and pass communications through an undesired intermediary. The Access Edge Server then uses another certificate (issued by a public or private CA) to connect securely to the Director server inside the enterprise network. Note that the Access Edge Server helps protect the internal servers against network-level attacks, validates the SIP network protocol messages that it receives, validates the domain that the client uses to log on, and then forwards requests to the internal Director.

The single Edge Server topology can support concurrent IM, Web conference, and A/V traffic. Although this is the simplest topology to administer, there are limits to what a single server can handle. You may find that as the needs and user requirements of your organization grow, one of the other topologies discussed in this chapter will be more applicable. For more information about capacity planning, see Chapter 14.