Many security events have been identified - federation disabled error

We are getting lots of warnings in our event log for Event ID 14425:
Many security events have been identified by the proxy stack.
In the past 20 seconds, 30 security events have been identified by the proxy stack. A large number of security events could indicate that the server is under attack. The last event was:
$$begin_record
LogType: security
Text: All federation is disabled
Result-Code: 0xc3e93d74 SIPPROXY_E_EPROUTING_MSG_FEDERATION_DISABLED
SIP-Start-Line: SUBSCRIBE sip:[email protected] SIP/2.0
SIP-Call-ID: 819af7ce193e4deb8db8fd2f14a9df41
SIP-CSeq: 1 SUBSCRIBE
$$end_record
Cause: The server may be under attack, or there might be a configuration problem that is causing errors.
Resolution:
Launch the Lync Server 2010 Logging Tool. Select the "SIPStack" component, the "Errors" level and the TF_SECURITY flag. Review the events reported to the trace log using the "Analyze Log Files" feature of the logging tool.
So we did as the resolution states, and logged the traffic, and we are getting thousands of these types of messages:
TL_ERROR(TF_SECURITY) [0]05E8.00CC::01/05/2011-15:12:11.015.00000013 (SIPStack,SIPAdminLog::WriteSecurityEvent:SIPAdminLog.cpp(424))$$begin_record
LogType: security
Text: All federation is disabled
Result-Code: 0xc3e93d74 SIPPROXY_E_EPROUTING_MSG_FEDERATION_DISABLED
SIP-Start-Line: SUBSCRIBE sip:[email protected] SIP/2.0
SIP-Call-ID: 2249db6d65ac4a11ba9aea022e8fe17c
SIP-CSeq: 1 SUBSCRIBE
$$end_record
If we have Federation disabled, how do I keep all this traffic from hammering my edge server?  What I am assuming it is trying to do is get the presence for every person in every email being sent or received (or read?)
Thanks,
Bob

If you're not going to leverage Lync federation and enable it for your environment, it's probably worth considering the removal of your public SRV record for federation for the sake of tidiness. They won't do you any harm providing that they are indeed genuine
subscription requests from foreign users.
Kind regards
Ben
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems or queries.
Lync | Skype | Blog: Gecko-Studio

Similar Messages

  • Many security events have been identified by the proxy stack.

    On our Lync Edge servers I can see lots of warning events are getting generated every second. Any idea how to stop this events.
    Log Name:      Lync Server
    Source:        LS Protocol Stack
    Date:          3/26/2014 5:40:43 AM
    Event ID:      14425
    Task Category: (1001)
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      servername
    Description:
    Many security events have been identified by the proxy stack.
    In the past 55 seconds, 30 security events have been identified by the proxy stack. A large number of security events could indicate that the server is under attack. The last event was:
    $$begin_record
    LogType: security
    Text: The connection from a remote user client is refused because remote user access is disabled
    Result-Code: 0xc3e93d6d SIPPROXY_E_CONNECTION_EXTERNAL_INTERNET_ACCESS_DISABLED
    Peer-IP: 192.168.10.1:50224
    Peer: 192.168.10.1:50224
    $$end_record
    Cause: The server may be under attack, or there might be a configuration problem that is causing errors.
    Resolution:
    Launch the Lync Server 2010 Logging Tool. Select the "SIPStack" component, the "Errors" level and the TF_SECURITY flag. Review the events reported to the trace log using the "Analyze Log Files" feature of the logging tool.

    Hi,
    What's your Edge NIC and certificate configuration? And the DNS SRV records?
    It may happen because the Lync server does not pass the correct certification authority information back to the Lync client during the negotiation of the TLS connection.
    You can refer to the part “Workaround” in the link below:
    http://support.microsoft.com/kb/2464556
    Best Regards,
    Eason Huang
    Eason Huang
    TechNet Community Support

  • How to determine which of the Oracle security products have been installed

    Hello!
    I would like to determine whether or not the Oracle security products have been installed for an Oracle database.
    The Oracle security products are:
    * Oracle Database Vault
    * Oracle Audit Vault
    * Oracle Configuration Management
    * Oracle Total Recall
    * Oracle Advanced Security
    * Oracle Data Masking
    * Oracle Label Security
    * Oracle Secure Backup
    * Oracle Database Firewall
    So what I thought is to look at the "DBA_REGISTRY" table which displays information about the components loaded into the database.
    But on the other hand there also is the "V$OPTION" view which lists database options and features.
    Does anybody know, how I could correctly determine whether or not each of the product is installed?
    I guess for "Oracle Database Vault" I should query V$OPTION, but what should I do with the other ones? And in case DBA_REGISTRY would be the right table, how would the comp_ids look like for the products?
    SELECT 'Oracle Database Vault' , nvl( (SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault'),'FALSE') FROM sys.dual
    OR
    SELECT 'Oracle Database Vault' , nvl2( (SELECT 'valueFound' FROM DBA_REGISTRY WHERE comp_id = '??????' AND status NOT IN ('INVALID', 'REMOVING' , 'REMOVED')),'TRUE','FALSE') FROM sys.dual
    Thanks in advance
    Kai

    Hi kai;
    There are some script avaliable on net, first please check them and run it on test server first!
    http://www.google.com.tr/#hl=tr&biw=1259&bih=793&q=installed%2Bproducts%2Boracle&aq=f&aqi=&aql=&oq=&gs_rfai=&fp=71a534c4a5161590
    Secondly you can check oraInventory and also oratab file or you can run runInstaller and can check Installed product tab on installation screen
    Regard
    Helios

  • Hi, I want to know if in the AppStore exist an app that count how many messages I have been used. Thanks

    Hi, I want to know if in the AppStore exist an app that count how many messages I have been used

    Some carriers have iOS apps that will tell you this info...see if yours does, or can't you just login to your account online & see such info?

  • HT4623 I have an ipad mini.  When I tried to update my apps many of them have been showing a "waiting" message for two days and I cannot open the app or delete the app.  Any ideas?

    I have an ipad mini.  I did an app update and now many of them have been showing a "waiting" message for two days and I cannot open the app or
    delete the app.  Any ideas?

    Double tap the Home button to bring up the multi-tasking bar...tap & hold any app until they all start to wiggle...tap the red minus sign to remove every app shown. Tap the Home button when finished. Try to delete the app now.

  • I haven't added events but am getting "This calendar is unreadable. No events have been added to your iCal calendar"

    I recently started getting the message "This calendar is unreadable. No events have been added to your iCal calendar".  However, I typically add my events by typing them myself either on my MacBook Pro or my iPhone. I don't import from outside sources. I don't know if it's related or just coincidental that around the same time, events that I add to my MacBook Pro are not syncing to my iPhone, but the events added by iPhone seem to appear on my MacBook Pro and my MiniMac.  Is there a way to find the event that is being referenced in this error message??

    iPhone:
    Plug in your iPhone
    Go to iTunes > Your iPhone > Info and ensure that calendars is not checked off to sync -- if you are using MobileMe to sync, this option should not be checked
    On both Macs:
    1.) Go to Apple > System Preferences > MobileMe > Sync and remove the check Mark for calendars.  With the new MobileMe calendar system there is no need to have this checked.  Close the MobileMe window once this is complete.
    2.) Open iCal and then go to iCal > Preferences > Accounts and remove the MobileMe account from here with the minus sign.
    3.) Go to iCal > Quit iCal
    4.) Remove the following to the trash and restart your computer:
    Home > Library > Caches > com.apple.ical
    Home > Library > Calendars > Calendar Cache, Cache, Cache 1, 2, 3, etc. (Do not remove Sync Cache or Theme Cache if present)
    Home > Library > Preferences > com.apple.ical (There may be more than one of these. Remove them all.)
    5.) Open iCal and go to iCal > Preferences > Accounts
    -- If the MobileMe Account is already here remove it again and then re-add it being very careful to use the correct name and password (for your 10.5 system follow these steps for re-adding: http://support.apple.com/kb/HT4330)
    -- If the MobileMe account is not already here, add it in.
    iCal will download your calendars from the MobileMe server.  Watch and see if you get the error message.  If it completes the download (little spinning gear stops spinning next to the MobileMe calendar) go ahead and add a new uniquely named event to one of your MobileMe calendars on both computers and see if it syncs between.
    Let us know what happens.

  • "iCal can't read this calendar file. No events have been added to your iCal calendar."

    How do I deal with this error message-"iCal can’t read this calendar file. No events have been added to your iCal calendar." ? .ics vs .vcs?
    Thanks

    Greetings,
    What version of the Mac OS and what version of iCal are you running?
    Are you using MobileMe calendars (or any other server based calendars like Google) in your iCal?
    While you answer those questions you can try the following troubleshooting:
    1. First make an iCal backup:  Click on each calendar on the left hand side of iCal 1 at a time highlighting it's name and then going to File Export > Export and saving the resulting calendar file to a logical location for safekeeping.
    2. Remove the following to the trash and restart your computer:
    Home > Library > Caches > com.apple.ical
    Home > Library > Calendars > Calendar Cache, Cache, Cache 1, 2, 3, etc. (Do not remove Sync Cache or Theme Cache if present)
    Home > Library > Preferences > com.apple.ical (There may be more than one of these. Remove them all.)
    ---NOTE: Removing these files may remove any shared (CalDAV) calendars you may have access to. You will have to re-add those calendars to iCal > Preferences > Accounts.
    Once the computer is back up and running open iCal and test.
    Hope that helps.

  • How do you set up iCloud on the iPod touch if it says too many apple accounts have been signed onto the device

    How do you set up iCloud on the iPod touch if it says too many apple accounts have been signed onto the device.

    Welcome to the Apple community.
    Unfortunately you will need to create your Apple ID (account) on another mobile device or a Mac computer. Once three iCloud accounts have been created on an iOS device, it doesn't matter what you do to that device, no further accounts can be created on it.

  • Help when established any Claude tell me the accounts have been identified free to iclod device does help Bliss

    Help

    You'll need to rephrase your title inside a reply post.  Your title doesn't make sense to me.
    Help when established any Claude tell me the accounts have been identified free to iclod device does help Bliss

  • Export as Many Records, as Have Been Imported

    Hi, guys!
    I have to Export as many records from FDM, as have been Imported. Can you advise any script, which can do such actions?
    Best Regards

    You don't need a script to do this, just create pass through maps in each dimension.

  • How can I see which and how many iCloud accounts have been created on my Mac?

    I have reached the limit of iCloud accounts that can be created on my Mac (bit of a shock, I was blissfully unaware that there is a limit). In the past I had an iCloud account for each user but have since consolidated the users, now I am wondering if there is some way of seeing which accounts are attached to my Mac ID.
    Additionally if I delete some of those iCloud accounts, does the available limit reset? (From posts it seems not, but no real clarity on the issue).
    Thanx

    AFAIK this information is not available, but in any case there is nothing you can do once the limit has been reached. Of course you can check which accounts are signed in, but not accounts which may have been created but signed out from. Deleting accounts won't reset the limit, it's tied to the hardware (not the user account).
    If you want another account the only way is to create it on another device: then you can sign into it on your Mac.

  • Creative Sound Blaster X-Fi Xtreme Audio: Many issues I have been faci

    Hello everyone. This is my first post at these forums, with the hopes of getting my issues resolved once and for all.
    First and foremost, let me inform you that I have very high experience with computer hardware.
    A couple weeks ago, I bought a Creative Sound Blaster X-Fi Xtreme Audio sound card from a local retailer. (Yes, I am aware that this is not an actual X-Fi card with the designated chip). I previously had an onboard sound solution on my motherboard, and uninstalled and removed all of the drivers COMPLETELY before I installed my new sound card. I then opened up my case, and continued with the installation of the card. After I had downloaded and installed all of the latest drivers, I immediately started to notice issues with the card. My MAIN problem is that if I have a specific application open, whatever it may be, one of my headphones, either left or right, will stop producing sound, and then is followed by the second one, which leaves me with no sound output at all. If I restart the application, the problem is temporarily fixed, but then comes back again within a few minutes.
    This is VERY irritating to me, seeing as I originally thought the problem was not with the sound card. Believe it or not, I reinstalled my copy of windows over 5 times throughout the course of the last few weeks in hopes of finally fixing the issue. And here I am, on a brand new installation of windows, and the problem STILL persists.
    I can assure you all of my hardware is functioning correctly as I have tried 2 other sound cards which have not had any issues like this whatsoever.
    Yes, I have read the FAQ, but I couldn't seem to find the solution to my issue there, which is why I am posting it here. Sorry if I sound irritated, but this has bothered me very much and I have been starting to lose a lot of hope in Creative...
    Thanks in advance.

    Anybody?

  • I just did an itunes update on my windows vista 64 and have been getting a runtime error eversense.  Unstalled everything apple per microsoft forum discussions and solved the problem.  When is apple going to update this problem for itunes?

    I just recently did an itunes update on my Windows Vista 64 and have been getting a runtime C++ R0634 error ever since. Per microsoft forum discussions, I have removed everything apple on my computer to get this runtime error to stop.  When I tried to remove and reinstall itunes, I get an error message during installation and to try again. Has just become a cycle.  Apple, are you working on this? 

    I have exactly the same problem.  Got update notice from Apple for iTunes and getting the C++ runtime error R0634 ever since.  I have no clue how to fix it....meantime, I can't even pull up Outlook to check email.  HELP!!
    ksware

  • I have been getting a "Runtime Error" and can't open Adobe Photoshop Elements Editor

    We are using Adobe Photoshop Elements version 9.0.3 (20110328.m.11320).  For several weeks it has not been possible to open the Editor, although the Organizer opens as usual.  We get an error message that says "Runtime Error! Program: ...\Adobe\Photoshop Elements 9\PhotoshopElementsEditor.exe This application has requested the Runtime to terminate it in an unusual way.  Please contact the application's support team for more information."  What can we do to correct this problem?

    Thanks, Ken!  I have to reply by e-mail, as the Forum site has been down
    for maintenance since last night.
    I am running Windows 7 Professional SP1.
    Uninstalling and booting should be straightforward.  I saved the
    following files in my Downloads folder from my initial installation of
    Adobe PSE 9.0 on 4/22/11:
    Adobe_Photoshop_Elements_9-AkamaiDLM.exe (355 kb application)
    PhotoshopElements_9_LS15.exe (1,200 kb application)
    PhotoshopElements_9_LS15.7z (1,838,546 kb WinRAR archive)
    Will these suffice for reinstalling the program?  Can you tell me how I
    should go about the reinstallation?  (I tried to find a page to download
    the Adobe PSE 9.0 program on the Adobe website, but could only locate a
    patch for 9.0.3, which I think must already have been included in the
    original installation.)
    Also, there are four folders, corresponding to four catalogs, in
    C:\ProgramData\Adobe\Elements Organizer\Catalogs.  Will those survive
    the uninstall/reinstall process?  Should I back them up just prior to
    uninstalling to preserve them for restoration after the reinstall?
    Finally, should I back up the 9.0 and Organizer folders in
    C:\ProgramData\Adobe\Elements Organizer for restoration as well?  And
    the C:\ProgramData\Adobe\Photoshop Elements folder?
    Thank you.  I am grateful for your help!
    Peter

  • How stop iCal from switching all my events to the date beforeI assigned them? It saves but then when I open the program again all my events have been messed up.

    iCal on my macbookpro moves events to the day before I originally saved them..especially birthdays. I will create an event for the 2nd of September, for example, and then when I restart my computer and open iCal the same event is saved for the 1st even though I created it for the 2nd. I continue to correct the moved events but iCal continues to move them. I do not use an iphone or ipad with my macbookpro. My computer is operating on mountain lion. Please help!

    This happens if the file is no longer where iTunes expects to find it. Possible causes are that you or some third party tool has moved, renamed or deleted the file, or that the drive it lives on has had a change of drive letter. It is also possible that iTunes has changed from expecting the files to be in the pre-iTunes 9 layout to post-iTunes 9 layout,or vice-versa, and so is looking in slightly the wrong place.
    Select a track with an exclamation mark, use Ctrl-I to get info, then cancel when asked to try to locate the track. Look on the summary tab for the location that iTunes thinks the file should be. Now take a look around your hard drive(s). Hopefully you can locate the track in question. If a section of your library has simply been moved, or a drive letter has changed, it should be possible to reverse the actions.
    Alternatively, as long as you can find a location holding the missing files, then you should be able to use my FindTracks script to reconnect them to iTunes.
    tt2

Maybe you are looking for