Sonus SBC 1000-2000 Updates June 2014

SBC 1000-2000 Service Advisory 2014-06-27
Announcing availability of SBC 1000/2000 system release 3.1.2 build 297

Purpose of the Service Advisory:

1. An enhancement to the Remote Authorization Table has been introduced in software release 3.1.2 build 297. 
2. An enhancement to the Monitor application that ensures interoperability with recent JRE 7 and JRE 8 security changes. 

Applies to:
This Service Advisory applies to all SBC 1000/2000 with or without built-in ASM modules that are running software release prior to 3.1.2 build 297.

Details:

1. After installing 3.1.2 build 296 or higher, some or all calls to a SIP Trunk no longer function due to authentication failure.  The enhancement further restricts unknown and unauthorized users to place calls.
2. The Monitor application gives error "Failed to validate certificate. The application will not be executed." and the Monitor application fails to start. 

For more information, please see the following linked PDFs:

• Calls Fail to SIP Trunk After Installing SBC 1000-2000 version 3.1.2 build 296 or Higher
• Monitor Application Fails to Load With Java Error Upgrade verification

Once upgraded, verify the software version and build number match the following:

Software Version:  3.1.2
Build Number: 297

Lync Call Reports Application

Lync Call Reports processes data from your Lync Monitoring Server database (LcsCDR database) and presents it in an easy to read and searchable format. Additionally you can import vendor rate cards to calculate call costs, which get associated a users Department and Company specified in Active Directory.

• Search and filter results
• CSV export
• Ability to bill based on users Active Directory department or company field
• Import vendor rate cards to perform call rate and cost calculations
• Determines if the destination and callers number is in the same calling region to apply a local call rate
• Import vendor gateways - Determines call direction - inbound, outbound, forwarded, Lync-to-Lync
• Handles billing of forwarded calls using the Referred-By information

For more information and download, see here.

Lync client constantly signs in and out

If SCHANNEL is sending a truncated list of trusted root certificate authorities to the Lync client during the TLS/SSL handshake process, this can explain why your Lync clients are randomly signing in and out.

Here's the chain of events on more detail:

1. The UC server passes its certificate trust list (CTL) of installed certification authority information to the UC client that requests the secure TLS connection.
2. The CTL is truncated as per the design limitations of the Windows Server Schannel component.
3. The UC client that requested the secure TLS connection does not receive certification authority information that matches the entries that are contained in its installed certification authority list.
4. The TLS connection attempt fails with the error that is described in the "Symptoms" section.

To check this look in your Lync FE servers system event log for the following warning:
----
EVENT ID: 36885
When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.
----

The easiest way to fix this is to configure SCHANNEL on the Lync FE's not to send this list:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey - KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type SendTrustedIssuerList, and then press ENTER to name the registry entry.
5. Right-click SendTrustedIssuerList, and then click Modify.
6. In the Value data box, type 0 if that value is not already displayed, and then click OK.
7. Exit Registry Editor.

You shouldn't need to reboot the server for this to take effect.

For more information and other options on how to resolve this see Microsoft article -
http://support.microsoft.com/kb/2464556

Lync Client Updates for June 2014

Lync 2013 Client for Windows

15.0.4623.1000	June 2014 (CU9)	http://support.microsoft.com/kb/2850074
	June 2014 (Security)	http://support.microsoft.com/kb/2881013

Lync 2011 Client for Mac

14.0.9

June, 2014

http://support.microsoft.com/kb/2963369

Historic updates can be found here.

LS:SIP – 01 – Peers -> SIP – 017 – Sends Outstanding

The SIP peers counter on the Edge server collects failed connections attempts to federated partners, and is  reset after reboot.

If the counter is reporting a high value for a particular sip peer and not others, it is likely that federation is not allowed to that domain. If you do not have an open federation policy and have a requirement to communicate with the domain, it should be added to the allowed list in Lync. The other common scenario is that the Edge peer is not allowing communication from your own SIP domain, or it is down.

If the counter is reporting a high value for multiple domains then there could be more cause for concern. Check your federation settings and make sure that the Edge server can communicate on the federation port 5061.

To view the counter open Performance Monitor and add LS:SIP – 01 – Peers -> SIP – 017 – Sends Outstanding:

To allow open federation make sure "Enable partner domain discovery" is ticked:

If you don't have "Enable partner domain discovery" enabled, then you will need to add the domain you wish to communicate with to the allowed list:

Additionally if you are using SCOM you may see the following alert generated:

Alert: The number of messages that are currently present in the outgoing (send) queues.
Source: LS Access Edge Component [server.domain.co.nz]
Path: server.domain.co.nz
Last modified by: System
Last modified time: 10/06/2012 1:28:11 PM Alert description: Perf Object Name: LS:SIP – 01 – Peers Perf Counter Name: SIP – 017 – Sends Outstanding Perf Counter Value: 1001

The Lync Management pack for SCOM 2007 R2 was mentioned in the Lync 2010 release notes as having an issue reporting this data correctly. If you use this version of SCOM the resolution noted is to disable the alert. Here's an excerpt from that document:

Alerts from Monitor "SIP Proxy: Sends Queued" May Be Inaccurate

Issue:

When Microsoft System Center Operations Manager 2007 R2 management pack is deployed to monitor Lync Server 2010, the alert "The average time (in seconds) the messages delayed in outgoing (send) queues" may be incorrect.  The underlying performance counter CS Registrar SIP -01 Peers -SIP  017 -Send Outstanding reports multi-instance values. The instances _Total and Clientsare not filtered out, causing incorrect alerts.

This situation applies only to deployments that deployed System Center Operations Manager management pack to montior Lync Server 2010.

Resolution:

Disable this monitor in the System Center Operations Manager 2007 R2 Operations console, as follows: 

1. Navigate to the Alert details view.

2. Click Alert Monitor.

3. Click the Overrides tab, and then click Disable.

Lync 2010 and Lync for Mac 2011 Dont Play With Exchange Unified Contact Store

When the Microsoft Exchange 2013 Unified Contact Store is deployed for Lync Server 2013, and its is enabled for a user, the Lync 2010 and Lync for Mac 2011 clients do not understand where to update or save changes. As a result, users who are enabled for the Unified Contact Store cannot change their contacts list from Lync 2010 and Lync for Mac 2011.

http://support.microsoft.com/kb/2757458