Monitoring and Controlling Federated Partner Access

Topic Last Modified: 2009-03-04

If you have configured support for federated partners, which can be specific external organizations or an audio conferencing provider (ACP) that provides telephony integration, you need to actively manage the external domains that can communicate with the servers in your organization. Office Communications Server 2007 R2 provides mechanisms to facilitate tracking and control of federated domain connections, including the following:

• Domains. You can view a list of the federated domains that have most recently made at least one connection to your Access Edge service.
• Usage. DNS-based discovery of Access Edge services is the recommended configuration for the Access Edge service. This configuration can be used in conjunction with the Allow tab, on which you can configure allowed domains. For increased security, explicitly specify the FQDN of a federated partner's Access Edge service. When a domain is configured in the Allow list, communications with this domain are assumed to be legitimate. The Access Edge service does not throttle connections for these domains. In case of DNS-based discovery of federated domains that are not on the Allow tab, connections are not assumed to be legitimate, so the Access Edge service actively monitors these connections and limits the allowed throughput. The Access Edge service marks a connection for monitoring in one of two situations:
  • If suspicious traffic is detected on the connection. To detect suspicious activity, the service monitors the percentage of specific error messages on the connection. A high percentage can indicate attempted requests to invalid users. In this situation, the connection is placed on a watch list, and the administrator can choose to block this connection.
  • If a federated party has sent requests to more than 1,000 user URIs (valid or invalid) in the local domain, the connection is placed on the watch list. Any additional requests are then blocked by the Access Edge service. A federated domain could exceed 1,000 requests either because the federated party is attempting a directory attack on the local domains (in which case the administrator would want to block the connection), or because valid traffic between the local and federated domains exceeds the limit (in which case the administrator would probably not want the connection to be throttled and would probably want to add the domains associated with that connection to the Allow list).

An administrator can review lists and take appropriate action, which can be any of the following:

• Leave the list as is.
• Add the specific domain to the Allow list, if the domain is a federated partner that requires more than 1,000 legitimate, active requests on a consistent basis.
• Block the federated domain from connecting to your organization. To do this, add the name to the Block list and revoke the certification (that is, move it to the revoked list) so that the TLS connection is automatically dropped upon initiation. The Block list takes precedence over the Allow list; if a domain exists in both lists, the domain is blocked. In this case, the configuration validation mechanism on the Edge Server also reports a warning-level event (14518), in case the overlap is unintentional.

Use the procedures in this section to monitor domains and the watch list and, if necessary, to manage individual domain connections.