External clients desktop sharing fails

Question

After reading through various articles and forum posts I am desperate enough to contribute my first post...
The Problem:
We have successfully implemented a Lync 2010 infrastructure.
Internal to Internal works perfect 
Internal to external (or vice versa) works perfect except for desktop sharing (Audio /Video works perfect)
(with external being an internal user in an external network)
I tried to narrow down the problem and found the following issues:
23; reason="Call failed to establish due to a media connectivity failure when one endpoint is internal and the other is remote";CallerMediaDebug="application-sharing:ICEWarn=0x800029,LocalSite=192.168.18.105:5388,LocalMR=xxx.xxx.xxx.xxx:3478(public
IP Adress from AV.xxx.de) ,RemoteSite=192.168.10.73:5378,RemoteMR=xxx.xxx.xxx.xxx:56119
(public IP Adress from AV.xxx.de)
,PortRange=5350:5389,RemoteMRTCPPort=56119,LocalLocation=1,RemoteLocation=2,FederationType=0"
So basically a client connects from behind a NAT device to the external IP of the edge av interface and the internal client tries to connect to the same external ip?
Is that meant to be that way?
Second issue (or same issue but different perspective) same scenario(but network Sniffer on the firewall):
request reaches FW:
50.436292 port2 in Guest IP:35962 -> external AV Edge IP:59676: syn 2844552579
request routed through FW to the internal DMZ IP:
50.436857 Lync-extern out Guest IP:35962 -> 172.16.13.204:59676: syn 2844552579
session gets resetted:
50.437046 Lync-extern in 172.16.13.204:59676 -> Guest IP:35962: rst 0 ack 2844552580
This repeats very often till both clients get a notice about "Network issuses.
On the Edge Server I did an netstat -oa and found Port 59676 to be listening (TCP)
I read so much in the last days that I am totally confused by now and I think the documentation on tech net is faulty somehow.
(at least regarding port 50.000 ->59.999)
Maybe the issue is DNS related (we got split DNS in place)?
Any thoughts helping me out would be appreciated!
Thanks Gunni
Who needs a signature?

Answer 1

Hello Gunni,
please can you tell what is the vendor, model and firmware of your firewall? Are there any kind of "deep inspection" features enabled in the configuration of the firewall.
I am asking, as we have seen similar issues with an RST that seemed to come from the Lync Edge Server, but in fact the connection reset was done by the firewall. In the mentioned case the firewall is a Juniper, model SSG-5.
Two flow related settings activated in the configuration caused the issue, leading exactly to the ms-client-diagnostic: reason="Call failed to establish due to a media connectivity failure when one endpoint is internal and the other is remote"
“flow tcp-seq-check” -                  (TCP Sequence Check)
“flow tcp-syn-check” -                  (TCP SYNCRO Check)
Please check if your firewall has some similar or identical settings activated!
A lot of time, we investigated the Edge Server for any issues, - we even replaced it with a new one built from the scratch. Nothing helped, till we start looking closer at the firewall and disabled the settings mentioned above. I remember that we thought
the RST comes from the Lync Edge on the first look in NetworkMonitor and Wireshark. But when we started watching the Juniper reports, and comparing the time-stamps we realized that the connection was closed first by the firewall, not the Lync Server.
If your firewall offers a reporting feature (via webinterface, or SNMP, etc.) I recommend you to take a close look to check if the connection is closed here first.
Thanks and greetings from Berlin,
Jan
Jan Boguslawski | Technical Product Manager - snom OCS / UC Edition | MCITP: EA, MCTS OCS, MCTS EXCHANGE | snom technology AG, Berlin | www.snom.com | http://ocsphoneguy.blogspot.com