Monday, September 30, 2013

Lync Edge Server Replication failed FALSE with red cross

LYNC REPLICATION NOT WORKING

In a Lync Deployment, where we have installed Lync Edge Server, we see the Replication is not healthy. You will notice a red cross or in the Management Shell the Replication is not UpToDate: False.

If actually have telnet to the Edge Servers Port 4443, you realize that the port is open and working.
As well you can test access the service itself:
https://<edgeserver.fqdn>/replicationwebservice

Via this access, you also be able to validate the assigned internal Certificate and the Certificate Chain. If you encounter an error with trusted root certificate, you will end up adding it other Trusted Root Authorities.

Afterwards, you will still encounter the red cross, or false up-to-date status.

This is normal!
The Replication itself is working fine, but your Connectivity to the Edge is limited.
This mean we cannot query the service due to the SECURE CHANNEL limitation.

Solution:
Open REGEDIT
navigate to:

HKey_Local_Machine\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

add the new DWORD:
ClientAuthTrustMode Value=2

Now reboot the edge server. After it has restarted, you might need forcing the CMS to replicate:
Invoke-CsManagementStoreReplication

Problem is now solved...!

-----------------------

Documentation:

Validation:





Set new Registry Key on Edge Server:

Do not forget the reboot.

Verification:



---------------------------------------

NOTE:
I was asked a few time, what acually is happened if the SQL Server shows a Red Corss.
This is failed topolgy configuration and should be validated.
I post a correct few.
 

 

You should also validated your Get-CsManagementStoreReplicationStatus. There should be not SQL Server shown.



20 comments:

  1. Thanks Thomas. I didn't even know I had this issue until I checked today after applying the January 2014 CU.

    ReplyDelete
  2. Hi Thomas, I have checked my topology and found for the SQL server it shows red cross. How to resolve this issue

    ReplyDelete
    Replies
    1. Hi Anil,

      this should not eb happend, SQL must show N/A.
      Since it has NO Lync services installed.
      Can you double check this.
      Cheers
      Thomas

      Delete
  3. Hello Thomas,

    Cross Checked, SQL showing with RedCross. do you have any resolution for the same.

    Regards,
    Neeranjan !!

    ReplyDelete
    Replies
    1. Hi Neeranjan,

      i have updated the article regarding the SQL Servers. This is a Enterprise Configuration with SQL Mirroring.
      As seen, there are no red cross.
      This is normal, due to, Lync need some Lync Componets to be installed and on any SQL Server this cannot be happend, even would not be supported.
      Therefor, if a red cross is shown, the lync topology is in an incorrect state.
      You need to validate the installation and have to move back to an supported topology.

      Delete
  4. Thanks so much! This did the trick for me.

    ReplyDelete
  5. Many thanks for your Great solution. It solved my issue after Jan 2014 CU

    ReplyDelete
  6. Solved my problem, thanks for shareing

    ReplyDelete
  7. I have faced the same issue with my second edge server in the pool. Issue resolved after modifying the registry as per your article. Thank much Thomas..

    ReplyDelete
  8. To all my fellow friends, thank you for all your comments, they much appreciated.

    ReplyDelete
  9. Any idea why this would have suddenly occurred? We discovered the issue when setting up a hybrid Lync environment and presence would not work between on-prem and online. Why would we need to add a registry key to the edge servers that didn't exist before when replication worked fine?

    ReplyDelete
    Replies
    1. Hi Chris,
      you asked a good question.
      In your case it was different. As I wrote the replication was still working and a secure channel was need just querying the status.
      In your case, it seem something else was fix, if the presence between the cloud and on-prem isn't working. there are other things you needed to fix, possible as you did.
      Hope this helps

      Delete
  10. Hi Thomas, I'm having this problem with Skype for Business, and I applied this regedit workaround but I'm still having the "X" on the Control Panel for the EDGE replication.

    I don't know if there is anything else I can do on Skype for Business 2015.

    PD: My servers are Windows 2012 R2 completely updated.

    Cheers,
    Saul

    ReplyDelete
    Replies
    1. Hi Soul, in Skype for Business it is the same solution. It is part of the OS, not of Skype or Lync. Therefor it should have solved you problem.
      Please check if the firewall inside (LAN) is setup correctly if you still experience a red X. If you have set the regkey, it might be the problem on the firewall.

      Delete
  11. Thanks for posting this! It fixed my issue.

    Doing a trace of replication in OCSLogger, I was getting '403 forbidden' errors after the cert was verified. Your reg hack worked like a charm.

    ReplyDelete
  12. Hi I'm new to lync, I have a replication issue. I think I have a cert issue but all the certs seem fine. anything I can try to get it working again. Please help

    ReplyDelete
  13. Hi Im new to lync, from where do I generate the cert to get the replication working again.
    Please advice

    ReplyDelete
    Replies
    1. Hi Ruaan
      you two cerficates on the Edge.
      Internal, this you request on you internal CA.
      External, this you request on an public CA, e.g. DigiCert or GoDaddy. (any other CA is possible too)
      Us the Certificate Wizard on the Edge an save the request in a file. Than you proceed as usual.

      Delete