I am attempting to have "open federation" set up. By "open federation" I mean that the check box that says "Enable partner domain discovery" under Access Edge Configuration in the Federation and External Access tab of
the Lync admin console is checked.
Every attempt to contact another organization that also has open federation gives me the ambiguous error of "When contacting your support team, reference error ID 504 (source ID 239)". It also
does not update anyone's presence.
External access is working well for our users. The Windows 7 clients can get in through the edge when disconnected from the network. Everyone can get in through their phone clients whether they are connected internally or not, which is great.
The cert on the external interface of the Edge is publicly trusted and it is not a wildcard. The SANs are correct.
The remote connectivity analyzer at
https://testconnectivity.microsoft.com/ gives all green check marks for every test, though it appears that this test has nothing to do with federation.
I went to http://www.lyncdirectory.com/ and tried to make contact with a few usernames listed there and the exact same behavior happens.
I've been to
https://greiginsydney.com/decoding-lyncs-client-side-error-messages/ and gone through this list of possible problems:
1) If you’re trying to contact a Federated party, your Edge server is down. (Try a different Federated partner to check this).
My edge server is not down.
2) If you’re trying to contact a Federated party, then their Edge server is down. (Try a different Federated partner to check this).
Their edge server is not down.
3) If you’re trying to contact a Federated party, this might be because you’ve added a new SBA or Front-End server to your Lync deployment but you’re still using an OCS Edge, and you haven’t added the new server to the Edge’s “trusted servers” list. (All
the instances of Error 14502 in the Event Log on the new Lync server are a giveaway too!)
I haven't added anything...this is a new deployment so it's never been working yet.
4) Asynchronous routing / bad config. If you can receive IM’s from someone and get this error when you reply, check their system’s external DNS or Edge config. Look for wrong or mis-configured DNS or NAT in the Topology.
I don't know if someone can IM me. I don't think so. I doubt it's a problem on their end.
5) Check ALL the certificates in the chain between you and the other end. In a recent example, one of the intermediate certificates in the initiating party’s cert chain had been renewed, and this new cert wasn’t trusted by the remote end. Error 14428 on
the recipient’s Edge server confirms this issue – “The certificate chain was issued by an authority that is not trusted”. (This is an ongoing drama at the time of writing, as it seems very few Lync Edge servers trust this new intermediate cert).
I can't check other people's certificates. I can't check other people's event logs.
6) The Edge at the far end doesn’t have a Hosts file entry for that user’s front-End or SBA. (This scenario will manifest itself as “1-way IMs” – you can start an IM conversation with the remote party all OK, but if THEY initiate a conversation to you, YOUR
IMs will always receive a 504/239 – but you’ll still receive their messages. This occurs because if you initiate, your establishing IM goes to the remote Edge’s Next-hop server, which IS known to the remote end’s Edge, and from there it’s on forwarded to their
registrar).
I suppose it is possible that everyone in the world is set up wrong and I'm the only one that is set up right, but it just seems ridiculously unlikely.
When I run a trace on OCSLogger on the Edge, choosing SIPStack, all info, all flags, and then replicate the error, it logs nothing but a blank text file.
I did the Skype provisioning process a while ago. I don't know anything about Skype so that doesn't help, but when I log into Skype on my Windows phone and try to message myself on Lync, I don't get anything, not even presence. Same when I go
the other way.
I don't know what ports to check. I have an SRV record in the external DNS that is _sipfederationtls._tcp.mydomain.com .
My client log says something about the server timing out when I try to message an openly federated partner. I've even added his domain explicitly to the trusted federated partners list in the admin console, and it has no effect.
I don't know what else to check or what else to try. Can anyone help?
Thanks,
Brandon