Edge Servers are deployed on a perimeter network (also known as a DMZ, demilitarized zone, or screened subnet). The perimeter network is a small network set up separately from your organization's internal network and the Internet. The perimeter network allows external users access to the Edge Servers while preventing access to the internal corporate network.

You can deploy your perimeter network using two firewalls or one. The two-firewall configuration is recommended. For details about firewall requirements and other guidelines for deploying the perimeter network, see Infrastructure Requirements for External User Access.

We recommend that you deploy a reverse HTTP proxy in the perimeter network. The reverse proxy is required for the following:

• To enable external users to download meeting content for your meetings
  
• To enable external users to expand distribution groups
  
• To enable remote users to download files from the Address Book Server or submit queries to the Address Book Web Query service
  
• To enable clients and devices outside your organization’s intranet to obtain updates
  

If you already have a reverse proxy deployed to support other services, you can use it for Office Communications Server 2007 R2 as well (although it must be deployed in the perimeter network). The reverse proxy can be deployed using Microsoft Internet Security and Acceleration (ISA) Server 2006, or other Internet server software. For details, including steps for configuring a server that is running ISA Server 2006 as a reverse proxy, see Configure a Reverse Proxy in Deploying Edge Servers for External User Access in the Deployment documentation.

If your organization is going to enable external access, we recommend that you deploy a Director.

A Director is a Standard Edition server or Enterprise pool that does not home users; instead, it serves as an internal next-hop server to which an Edge Server routes inbound SIP traffic destined to internal servers. The Director authenticates inbound requests and distributes them among the servers in the Enterprise pool or to the appropriate Standard Edition server.

By authenticating inbound SIP traffic from remote users, the Director relieves Enterprise pool servers from the overhead of performing authentication of remote users. It also helps insulate home servers and Enterprise pools from malicious traffic such as denial-of-service attacks; if the network is flooded with invalid external traffic in such an attack, this traffic ends at the Director, and internal users should not see any effect on performance.

In this topology, a single Edge Server computer is deployed in the data center, as shown in Figure 1.

Figure 1. Single consolidated edge topology

In this topology, two or more Edge Server computers are deployed in the data center, with a load balancer between the perimeter network and the Internet, and another load balancer between the perimeter network and the internal network, as shown in Figure 2.

Note:
The load balancer deployed between the perimeter network and the internal network must be configured to only load-balance the traffic to the Access Edge service and the A/V Edge service; it cannot load-balance the traffic to the Web Conferencing Edge service.

Figure 2. Scaled consolidated edge topology

In this topology, the data center has a scaled consolidated edge topology, and one or more remote sites deploy a single consolidated edge topology or a scaled consolidated edge topology, as shown in Figure 3.

Figure 3. Multiple-site consolidated edge topology