For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Zdenda's avatar
Zdenda
Icon for Cirrus rankCirrus
Mar 16, 2014

Lync sign-in failing

Hi, have anyone of you experience with this scenario? We have sometimes problem with SIP signing and here is when it happens

 

  1. User connects to Lync VIP lyncpool01.customer.com for registrering. Signaling port is TLS/TCP 5061.
  2. In successful case user gets SIP redirect to home server, but in problematic case the registering process continues through Lync VIP. This happens because VIP already connected user to his home server host, so there is no reason to redirect.
  3. So client is connected to its home server via VIP, not directly as in case he was redirected there. Lync client sends 3 differend SUBSCRIBE messages to LyncVIP and we can see on the home server logs that packets are received
  4. Also Lync server responses back to client for all SUBSCRIBE messages with SIP/2.0 200 OK. These now includes the needed service information so the client is able to sign-in.
  5. However on client log we don’t receive all the SIP/2.0 200 OK messages with Lync service payload. We can see that we receive one or two, but never all. -> as client is not receiving responses it fails back to initial REGISTER process and the same happens again

So registration process fails ONLY when client has luck and VIP sends his request to its own home server, then connection is not direct after redirect, but continues through VIP -> fail.

 

Do you have some ideas? We are using SNAT automap, but disabling that did not help.

 

Thanks, Zdenek

 

1 Reply

  • Zdenda's avatar
    Zdenda
    Icon for Cirrus rankCirrus
    Mar 17, 2014

    Hi again, after some tests I found that this issue is not appearing when ssl persistence (set by default in iApp template) is not used and source IP persistence is used instead.

     

    I all the time though that SSL persistence just read SSL session ID and store it localy on LB memory, but now it seems that it has some impact to the traffic flowing through LB VIP. Have anybody seen something like that?

     

    Thanks, Zdenek