Lync 2013 - Internal Call with net traffic send to AV Public IP

Question

Hello
Firstly brief description of topology:
- Each user is in respective Site, both networks are internal to our Lync topology
- When User A calls (audio only) User B, call is working with no problems, however i can see in network logs that User B at the beginning of the call is sending below traffic to Edge server Public IP.
Client IP
Dest. IP
Dest Port
192.168.34.98
av.domain.com Public IP
TCP
58797
192.168.34.98
av.domain.com Public IP
UDP
53112
192.168.34.98
av.domain.com Public IP
UDP
53112
192.168.34.98
av.domain.com Public IP
UDP
53112
192.168.34.98
av.domain.com Public IP
UDP
53112
192.168.34.98
av.domain.com Public IP
UDP
53112
192.168.34.98
av.domain.com Public IP
TCP
58797
Can you Please tell me if that is correct and if not how to track why its like that ?
- call is working peer-to-peer
- Similar traffic to Public AV IP appears also if User A calls Peer in the same network.
Looking at Candidates sent by User A:
a=candidate:1 1 UDP 2130706431 192.168.136.120 3564 typ host
a=candidate:1 2 UDP 2130705918 192.168.136.120 3565 typ host
a=candidate:2 1 TCP-PASS 174456319 "AV Public IP" 58797 typ relay raddr 192.168.136.120 rport 13338
a=candidate:2 2 TCP-PASS 174455806 "AV Public IP" 58797 typ relay raddr 192.168.136.120 rport 13338
a=candidate:3 1 UDP 184548351 "AV Public IP" 53112 typ relay raddr 192.168.136.120 rport 11668
a=candidate:3 2 UDP 184547838 "AV Public IP" 53776 typ relay raddr 192.168.136.120 rport 11669
a=candidate:4 1 TCP-ACT 174848511 "AV Public IP" 58797 typ relay raddr 192.168.136.120 rport 13338
a=candidate:4 2 TCP-ACT 174847998 "AV Public IP" 58797 typ relay raddr 192.168.136.120 rport 13338
a=candidate:5 1 TCP-ACT 1684797439 192.168.136.120 13338 typ srflx raddr 192.168.136.120 rport 13338
a=candidate:5 2 TCP-ACT 1684796926 192.168.136.120 13338 typ srflx raddr 192.168.136.120 rport 1333
Ports between Users subnets are open as well as to Edge Internal Interface.
Any tips to isolate it a bit more ? I'll provide more info as required.
Thank You

Answer 1

I appreciate your response.
The first one i already know and in fact it creates my doubt:
i can find there:  "Within these traces will often be connection attempts to every single IP address provided in the candidate list, including the relay and reflexive candidates"
 According to this sentence my behavior is correct as AV Public IP is in candidates list. Thing is if it should be there in candidates. Based on article i understand that ICE is done on Edge server. Based on  great presentations of Thomas Binder
here  "clients for ICE part are always connecting to Edge", ( as at the moment of call peer is not aware of remote peer location )
In my case on Edge there is nothing about my call in contrast to FE where i have all ICE work in SIP logs.
Simply:
For internal p2p calls - ICE is done on FrondEnd or Edge ?
For internal p2p calls - should AV Public IP be included in candidates ?
Second link doesn't help to answer that question either :( as focuses on ext - int call scenario )
I believe i am missing some basics here. Thank You & Regards