VCS Lync integration over TCP

[Mike Assel]

Hello.  I have followed this guide to enable integration between Lync  and Cisco VCS:

http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/config_guide/Cisco_VCS_Microsoft_Lync_2010_Deployment_Guide_X6-1.pdf. 

I am trying to enable Lync to VCS integration over TCP, not TLS.  Currently whenever a call is placed from Lync to VCS or the other  way, I get several errors in the SIP stack log of Lync and this error  in VCS: 400 Missing Correct Via Header.  The issue seems to have to due  with the Lync server not trusting the VCS.  I have done A LOT of  googling on this and have found several helpful posts, but my problem  still remains.

Any help would be greatly appreciated. 

[awinter2]

Hi Mike,

when configuring Lync trust for the VCS using the 'New-CsTrustedApplicationPool' and 'New-CsTrustedApplication' shell commands, did you make sure to specify the IP address of the VCS rather than the FQDN?

If not, I recommend you try to do so, as this was the way you had to configure it in OCS 2007 R2 when using TCP rather than TLS.

Can you also confirm that there isn't any NAT and/or load balancer in between the VCS and the Lync server which the VCS is configured to speak with?

Hope this helps,

Andreas

[Mike Assel]

No, for both of them I set them with the FQDN per the guide. I will try again with the IP address instead.

No NAT or load balancer.

Thanks

[Mike Assel]

So, I changed the FQDN's to IP addresses in the Lync server.  My colleague then called me from his Tandberg endpoint.  I was able to see and hear him but he was only able to hear me.  I tried calling him and got the same error (

400 Missing Correct Via Header).  I wasn't sure if your tip on using the IP rather than FQDN applied just to the lync server or to the VCS as well, so in the neighbor zone we tried using the IP address.  That change caused my coworker to not be able to call me.  We set the VCS back to use the FQDN's, and now we are back to square one of it not working either way.  Here is the where we are currently:

MXP 1500 calls Lync - Temporary network failure message on MXP and Lync client never rings.

Lync calls MXP 1500 - MXP 1500 rings.  When the call is answered the MXP thinks that the call is connected, but it is not receiving audio or video from lync.  Lync client just rings until it times out.

Both of these scenarios results in the "400 Missing Correct Via Header" for the call status in vcs.  Something else very odd:  when the mxp calls link and gets the network error message, the call show as connected for 0 seconds in vcs call history, as expected.  But, when calling from Lync to VCS, even the MXP and the Lync client hang up, VCS shows the call as active.  I'm guessing a timer kicks in somewhere because all those calls disconnect right around 15 min give a sec or two.  They also show a status of "400 Missing Correct Via Header". 

Sigh.....

[awinter2]

Hi Mike,

from your description it sounds as you might have a problem with your network, and in that case you probably would be best off by raising a ticket with TAC to get this troubleshooted further.

I recommend you start an xconf, xstat, netlog 2 logging session on the OCS Gateway VCS (From an 'admin' SSH shell), and then first set up a call from the MXP towards Lync. When this fails, set up a call from Lync to the MXP and answer the call on the MXP. When this call eventually disconnects, stop the netlog and provide this log file to TAC.

I would also recommend that you verify that your Lync server is able to successfully look up the VCS's FQDN, and that the VCS is able to resolve the Lync server's FQDN (You can verify the latter by using 'nslookup' from a root SSH shell on the VCS), as this is important for being able to deliver the SIP ACK message which fully establishes the call.

Hope this helps,

Andreas

[Evgeniy.Glazkov · Accepted solution]

Hello! I struggled with this too at one time.

Try to do this:

1) Are you enable TCP connections on Lync? If not, do this first:

Set-CsRegistrar "registrar:pool.your-domain.com" –SipServerTcpPort 5060

set-CsMediaConfiguration -EncryptionLevel supportencryption

2) Make sure that IP of VCS (not FQDN) is used in trusted application and route to VCS in Lync, and TCP mode is used:

New-CsTrustedApplication -ApplicationID CiscoVCS -TrustedApplicationPoolFqdn -Port 5060 -EnableTCP

$route = New-CsStaticRoute -TCPRoute -destination "" -port 5060 -matchuri "vcs.sip.domain.com"

3) Open Topology Builder, go to Trusted Application Servers - , then change the radio button from "Use all configured IP addresses" to "Limit service usage to selected IP addresses" and type you VCS IP.

4) Publish topology and check for "Missing Correct Via Header" error again.

[Mike Assel]

Thankyou Evgeniy!!!   Your step #3 was what I was missing.  There seem to be a couple of important steps missing in the official Cisco VCS/Lync integration guide when setting up a SIP trunk over TCP rather than TLS.  Also, the other thing I had to doing step #3 was reboot the server. 

[Evgeniy.Glazkov]

Yes, Mike, you right - there are some bugs and missing steps in this guide.

Glad I could help you!

[Mustapha Arakji]

Hi,

I'm using Lync 2010, and it doesn't allow the use of IP of VCS i have to use the FQDN in trusted application.

I'm trying to integrate VCS X6.1 with Lync 2010, i was able to make a call from C20 unit registered with VCS to Lync 2010 user, but only Voice is working!!

Lync Logs: unsupported Media Video.

Any ideas?

[awinter2]

Mustapha,

could you clarify how Lync doesn't allow you to use the IP address of the VCS when executing new-CSTrustedApplication? Do you get an error message of some sort?

Also, why aren't you configuring this with TLS instead of TCP?

Regards

Andreas

[Mustapha Arakji]

I don't have a certificate to use the TLS.

This is the error i'm getting:

PS C:\Users\lbadmin> New-CsTrustedApplicationPool  -Identity 10.4.1.220 -Registrar lbfcneptune.bmb.com.lb -site 1  -RequiresReplication $false -ThrottleAsServer $

true -TreatAsAuthenticated $true

New-CsTrustedApplicationPool : Cannot add a computer to a pool  that contains service roles other than the trusted application server  role. To add a computer,

use Topology Builder.

At line:1 char:29

+  New-CsTrustedApplicationPool <<<<  -Identity 10.4.1.220  -Registrar lbfcneptune.bmb.com.lb -site 1 -RequiresReplication $false  -ThrottleAsServer $true -Treat

AsAuthenticated $true

    + CategoryInfo          : NotSpecified: (:) [New-CsTrustedApplicationPool]   , ManagementException

     + FullyQualifiedErrorId :  System.Management.ManagementException,Microsoft.    Rtc.Management.Xds.NewTrustedApplicationPoolCmdlet

Thanks,

[awinter2]

Mustapha,

I haven't seen that specific error before. Have you made sure that the '10.4.1.220' application pool does not already exists?

Have you tried creating this application pool from the Topology builder rather than the Lync shell?

- Andreas

[Mustapha Arakji]

no. "10.4.1.220" application pool doesn't exist. I tried to create it using the Lync Shell and the Topology builder, but i can't enter the IP address, only the FQDN. But after publishing the Topology, I got to Trusted Application Servers and changed the radio button from "Use all configured IP  addresses" to "Limit service usage to selected IP addresses" and I typed  the VCS IP as "Evgeniy Glazkov" said in his previous post.

Now i can call the Lync Users, but the call is only audio. when i try to enable video i got "video was not accepted" error on the Lync!!!

[Mustapha Arakji]

Hi,

The problem is that i have added the IP of my VCS to Lync as Mediation server. When i removed it, i was able to added the VCS to to the trusted application servers.

Using the steps that Evgeniy Glazkov posted, now i can see that the call from my C20 registered to VCS is ringing at the Lync user, and showing as video enabled. But still i can't see video. I received an error.

[awinter2]

Mustapha,

I have sent you a private message, so please check your inbox and get back to me.

Regards

Andreas