Lync 2013 to CUPS RCC - Record-Route signature is invalid

Question

Hi all,
             I have a Lync 2013 environment and I'm trying to implement RCC with a CUPS 10 environment.
On the Lync side, I have run the following commands:
$tcpRoute = New-CsStaticRoute -TCPRoute -Destination 10.10.120.54 -Port 5060 -MatchUri cups.domain.com -ReplaceHostInRequestUri $true
Set-CsStaticRoutingConfiguration -Route @{Add=$tcpRoute}
CsTrustedApplicationpool -Identity 10.10.120.54 -Registrar LyncFE.domain.com–Site 1 –TreatAsAuthenticated $True –ThrottleAsServer $True –RequiresReplication $False
New-CsTrustedApplication -ApplicationID RCCGateway-1 –TrustedApplicationPoolFqdn 10.10.120.54 -Port 5060 -EnableTcp
Set-CsRegistrar registrar:LyncFE.domain.com -SipServerTcpPort 5060
on the test user I have set
Set “Telephony” to:                      
Remote call control
Set Line uri to:                             
tel:<ext>;phone-context=dialstring
Set Line server uri to:                  
sip:<username>@cups.domain.com
In the SIP logs I get the following (I have bolded the bits I think are important)
TL_INFO(TF_PROTOCOL) [0]1FDC.1670::02/19/2015-05:35:53.687.001b274e (SIPStack,SIPAdminLog::ProtocolRecord::Flush:ProtocolRecord.cpp(265))[1932678887] $$begin_record
Trace-Correlation-Id: 1932678887
Instance-Id: 45F
Direction: incoming
Peer: 10.10.120.54:5060
Message-Type: response
Start-Line: SIP/2.0 200 OK
From: "Test ADL"<sip:[email protected]>;tag=224a04a9f9;epid=fa015fbbdb
To: <sip:[email protected]>;tag=29e9c078-ce4a5e7
Call-ID:  669e8717f0a0487fb09aed392d84f589
CSeq: 1 INVITE
Contact:  <sip:[email protected]:5060;transport=TCP>
Via:  SIP/2.0/TCP 10.70.11.70:52575;received=10.70.11.70;branch=z9hG4bKE005ADB2.742BA66DD49B1869;branched=FALSE;ms-internal-info="aaweLh0WVLdGLzdpabeIHETcyFKD5xJlVJz_tnBJ0l-7ptpit0RW23IQAA", SIP/2.0/TLS 10.70.20.36:52402;ms-received-port=52402;ms-received-cid=1A00
Record-Route:  <sip:[email protected]:5060;maddr=10.10.120.54;transport=tcp;lr>,<sip:LyncFE.domain.com;transport=tcp;opaque=state:T;lr;ms-route-sig=aaF2AA9BciRLZcYZPN0XasMmn8g4LiFd4j7Fdcxg6R6uRtpit0mCXPOAAA>;tag=7E7648A7380D372597F42EAEAECC07A2
Content-Length:  190
Content-Type:  application/csta+xml
Message-Body: <?xml version="1.0"?>?<RequestSystemStatusResponse xmlns="??<systemStatus>normal</systemStatus>?</RequestSystemStatusResponse">http://www.ecma-international.org/standards/ecma-323/csta/ed3">??<systemStatus>normal</systemStatus>?</RequestSystemStatusResponse>?
$$end_record
TL_ERROR(TF_SECURITY) [0]1FDC.1670::02/19/2015-05:35:53.687.001b2b66 (SIPStack,SIPAdminLog::WriteSecurityEvent:SIPAdminLog.cpp(319))[1932678887] $$begin_record
Text: Record-Route signature is invalid
Result-Code: 0xc3e93f1e SIPPROXY_E_INVALID_RECORD_ROUTE
Connection-ID: 0x1300
Peer-IP: 10.10.120.54:5060
Peer: 10.10.120.54:5060
SIP-Start-Line: SIP/2.0 200 OK
SIP-Call-ID: 669e8717f0a0487fb09aed392d84f589
SIP-CSeq: 1 INVITE
$$end_record
TL_WARN(TF_DIAG) [0]1FDC.1670::02/19/2015-05:35:53.687.001b2b74 (SIPStack,SIPAdminLog::WriteDiagnosticEvent:SIPAdminLog.cpp(805))[1932678887] $$begin_record
Severity: warning
Text: Routing error occurred; check Result-Code field for more information
Result-Code: 0xc3e93f1e SIPPROXY_E_INVALID_RECORD_ROUTE
SIP-Start-Line: SIP/2.0 200 OK
SIP-Call-ID: 669e8717f0a0487fb09aed392d84f589
SIP-CSeq: 1 INVITE
Peer: 10.10.120.54:5060
$$end_record
I have not had any luck finding the solution to this as yet - and any suggestions as to what I have done wrong would be appreciated.
Edit - apparently bold doesn't work.... sorry - it works in the editor, but not when I save the post! Please look at the ":record-route" line in the first log and the result code in the next two entries.

Answer 1

Hi Ben, thank you for your update.
To clarify, the
device=SEP0123456789F is an example, you have to change it with the correct Cisco IP-Phone serial number used by your user.
I've checked every step of your procedure and I've not found any issue, I've used the same procedure with a Cisco CUPS 10 and everything works fine.
Please be sure to check this on Cisco:
- the MatchURI need to be equal to the Cisco Unified Presence Domain
- on the CUCM the CTI Account (default is CtiGw) nned to have CTI controll of every phone (Standard CTI Allow Control of Phone supporting Connected Xfer and conf) and Supporting Rollover Mode
- it's important that the "Standard CTI Secure Connection" group is NOT associated to the CtiGw account (if it's associated it force the connection to TLS).
Let me know.
Regards
Luca
Luca Vitali | MCITP Lync/Exchange | snom Certified Engineer | Sonus SBC1000 Engineer