Saleesh NV

Skype for business 2015 - Recover user data from SQL backup restore

Saleesh Neduvayalil — Mon, 26 Mar 2018 20:22:33 GMT

This blog may be helpful for reference when recovering the user data from back-end rtcxds database via SQL restore. I have seen many cases in which user data is either corrupted or lost due to various circumstances. I have two SFB 2015 pools in my lab , rtcxds database is part of SQL.green.com. I am trying to restore the database to another SQL server and recovering the user data. I hope , you are taking the SQL backup of rtcxds database on regular basis. If not , please plan the SQL backup in your environment. Currently, I am using my SFB FE server SQL express database to restore the rtcxds database. You can also use other SQL server in your setup. Please note , SQL express server 2012/2014 has 10GB size limitation for data restore. If your database size is more then 10GB , you should use SQL enterprise version for restore. Please copy the SQL backup data and log file to FE server. Create a blank rtcxds database on the SFB FE server. Right click on the blank rtcxds database > select task > restore and click on database. Edit the database path and make sure that correct database restore path is selected. Rtcxds restore has been completed on FE server and it was mounted. Open SFB management shell and run following command. This command will export the user data from restored rtcxds database to a zip file. export-csuserdata -SqlInstanceName "Fe.domain.com\rtclocal" -DbName rtcxds -Filename c:\backup.zip You can import the data for all users or selected users to the blobstore. Either use Import-CsUserdata or Update-csUserData command based on the requirement. Btw, update command does not require a FE service restart. Import-CsUserData -PoolFqdn pool.domian.com -FileName c:\backup.zip Update-CsUserData -Filename "C:\backupa.zip" -UserFilter "user@domain.com" If your rtcxds database is down, you can create a new database using below command and import the user data. install-csdatabase -update -sqlserverfqdn sql.domain.com -configureddatabases I hope this blog may be helpful for reference. Please comment if you have any questions.

Skype for business- How to take SQL profiler tracing for a specific SPROC

Saleesh Neduvayalil — Thu, 21 Sep 2017 19:59:39 GMT

This document may be helpful when setting up SQL profiler tracing on Lync/SFB servers. Identify the Lync SPROC which is possibly causing the issue. You can find the SPROC reference normally in User service CLS logging /queries etc. Navigate to backend SQL database and make a note of the SPROC name. Open SQL server profiler on the SQL backend server. Click File > Template > New Template. Select the relevant SQL version and enter a template name. Select the condition for profiler trace like SRPC start/end , RPC start/end etc. Click on the Column filter tab on right hand side bottom page, select the database name and enter the Lync/SFB database and click OK. Navigate to Objectname and enter the SPROC like below and click OK. Save the template. Navigate to File > Template > export template. Save the template locally for future or sending to customers etc. You can import the saved template in another SQL server and start the tracing. If you need custom configuration like circular logging , location etc. Connect to the SQL instance where in database/SPROC is located. Run the profiler trace with new saved template. While it was running , navigate to File > export > Script trace definition> SQL version. Save the profiler template as a script and modify the maxfilesize and InsertFileNameHere to make the logging circular. You can find start/stop steps ;https://blogs.technet.microsoft.com/beatrice_popa/2013/01/16/how-to-capture-a-circular-sql-server-profiler-trace/

Unable to filter Polycom user agent in Call quality Dashboard (on-prem)

Saleesh Neduvayalil — Fri, 18 Aug 2017 15:23:39 GMT

Skype for business CQD on-premise deployment by default will not add the category for third party endpoints. Following article may be helpful for adding a new category for third party endpoints. When you try to add a user agent filter in CQD dash board, you may see the message like ' we could not find any matching record'. I have verified manually in QOEarchive user agent table in SQL database and polycom endpoints does exist , however their category is set to NULL by default. Create a new category for Polycom devices in user agent def table like below. I have specified a sample UAType (15000) for polycom devices. INSERT INTO [QoEArchive].[dbo].[UserAgentDef] (UAType,UAName,UACategory) VALUES ('15000','PolycomVVC-VVX_400-UA/5.5.2.8571','Polycom') Update all polycom endpoints to the new UAtype/category in user agent table. Please see the sample query below. UPDATE [QoEArchive].[dbo].[UserAgent] SET UAType = 15000 WHERE UserAgent like 'polycom%' Now, Polycom endpoints are assigned with a proper UAtype in user agent table. Wait for 15 minutes to complete the Cube processing and replication. Now, you can filter the polycom user agents in CQD dashboard.

Skype for business 2015 - Call quality dashboard (CQD) troubleshooting tips

Saleesh Neduvayalil — Wed, 16 Aug 2017 20:34:39 GMT

This document may be helpful for troubleshooting CQD installation and configuration related issues. I have captured few common issues observed during CQD deployment and configuration. CQD installation failure with Error -2147217900 (QoEArchive): Above error will be logged when a previous instances of QoEarchive database files (mdf,ldf) available in the installation directory. Check the installation directory and delete the files and re-try the CQD installation. CQD installation failure with Error -2147217900 (QoERepository): Verify the installation directory and delete existing QoERepository databases and log. Retry the setup. QoEarchiveupdate SQL job failure. Right click on QoEarchiveUpdate job and select view history and find the error message. Check the QoEarchiveupdate job schedule , it should run ~ in every 15 minutes. Job will fail if interval is low or overlap with previous instance. Verify the RW access on the source CDR database. You may see an access failure when job is initiated. CQD deployment normally use QoEproxy account to run the job. Try to change the run as account to a SA account if you see any failure due to service account or proxy account as below. ( QoEarchive update > properties > steps > edit QoE archive update >change the service account) Cube database does not show any data even after successfully running QoEarchiveupdate job: Process the cube data manually. ( Right click on QoEcube and process the data , also right click on QoEmetric views and process the data) Verify if CQD QoEdatabase received the data from QoEmetric (Lync monitoring)database: Run below query against QoEarchive and QoEmetric database and compare the latest data. You may see 15 difference in data sync. Select * FROM [QoEArchive].[dbo].[Conference] order by NextUpdateTS DESC Select * FROM [QoEMetrics].[dbo].[Conference] order by NextUpdateTS DESC CQD re installation failure at last stage with below error. Launch CQD MSI file from administrator command prompt. Configure MSI logging as seen below and repro the issue. Make sure that proxy account is deleted if a previous installation was failed during SQL job setup. Please see the proxy account path for reference. Open the MSI installation failure log and navigate to the failure section. It may give you the possible cause of the failure. CQD portal error as below. Please make sure that following ASP NET pre requisite is installed on the portal server. CQD portal loading error or data not visible. Enable debugging logging on the portal buy editing the config file as below. Refresh the portal and find the cause of failure. Portal will show the logs on the bottom pane with summary. Review the logs to narrow down the issue. Again, there are various reason for failure like , web configuration data mismatch/error, IIS permission , service account permission etc.

Skype for business 2015 - Limit fabric tracing logs growth

Saleesh Neduvayalil — Tue, 15 Aug 2017 03:04:25 GMT

Skype for business server fabric traces are enabled by default. You can find the fabric traces in following location; C:\ProgramData\Windows Fabric\Log\Traces. There is a possibility, some strange fabric issues can fill up your system drive space. Following article may help you to reduce the fabric traces to one day. Take a backup of the 'ClusterManifest.Xml.Template' file from following location ;C:\Program Files\Skype for Business Server 2015\Server\Core. Open the ClusterManifest.Xml.Template file in notepad and change the 'DataDeletionAgeInDay' parameter under local winFabEtlFile section to 1 and save the file. Repeat the same steps on all FE servers in the skype for business pool. Restart the servers one by one, whichever FE server comes online first will generate the manifest from this file and will be distributed throughout the cluster. Please note, fabric update/CU update may overwrite the ClusterManifest.Xml.Template file. You need to modify the files once changes are completed. Now fabric traces will be overwritten on each day.

Skype for Business 2015 Server- Default SQL instance with custom ports - Failover test

Saleesh Neduvayalil — Sat, 08 Jul 2017 04:16:13 GMT

This article may help you to understand the behavior when setting up SFB 2015 EE pool backend with default SQL instance and custom SQL ports and paired. The idea was to test the CMS failover and DR with above setup. Topology : Two SFB 2015 EE pools. They are paired to each other. Backend server is SQL 2012 with default instance. Instance : I have modified the SQL port from default to custom port TCP 7000. An Alias record has been published in internal DNS with the same port. Confirmed the CMS location in AD and it is pointed to SQL1 default instance. Verified the backup sync replication between the nodes. They were not initiated. Invoked backup service sync between the pool and it was completed successfully. Verified the custom port by running netstat -ano on the SQL server and it was listening on TCP port 7000. Also confirmed that DNS alias record is resolving on the server. When I tried to run CMS move command , it was failed with SQL connectivity error. I have also tried to fail over the pool , but it didn't work either. I have collected network trace from FE server while running the cmdlet. Based on the investigation, I could not find any traffic hitting on TCP port 7000. However, I do see traffic on default port 1433 and getting a reset from SQL sever which is expected. It appears as SFB server is trying to connect over default port 1433 rather custom port when using default SQL instance with custom port. We don't have any option to specify the custom port as cmdlet input. I have changed the custom port to default 1433 and everything started working. This may be helpful for reference.

Skype for business - Response group workflow list timeout in control panel

Saleesh Neduvayalil — Thu, 06 Apr 2017 19:27:33 GMT

I have recently worked on an issue where RGS workflow list is not loading in SFB control panel, this post may be helpful for reference. When you click on the workflow under RGS, it will wait for few seconds and timeout. RGS deployment logs will report following exception when you access the workflow from Lync control panel. It appears as runspcewrapper thread is loading the response group configuration one by one. As per my lab testing, 48 response group configuration took ~ 1-2 seconds to load. When you have many response group spread across region, it can hit the RGS web config timeout and abort the session with below exception. Exception: RgsDeploymentApi,AcdDeploymentManager.GetBusinessHours:acddeploymentmanager.cs(301))Exception when invoking the cmdlet. Exception=[System.Threading.ThreadAbortException: Thread was being aborted. 3766 at System.Threading.WaitHandle.WaitOneNative(SafeHandle waitableSafeHandle, UInt32 millisecondsTimeout, Boolean hasThreadAffinity, Boolean exitContext) 3767 at System.Threading.WaitHandle.InternalWaitOne(SafeHandle waitableSafeHandle, Int64 millisecondsTimeout, Boolean hasThreadAffinity, Boolean exitContext) 3768 at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) 3769 at Microsoft.Rtc.Acd.Deployment.RunspaceWrapper.Invoke(String cmdName, Dictionary`2 parameters) 3770 at Microsoft.Rtc.Acd.Deployment.AcdDeploymentManager.GetBusinessHours(Nullable`1 BusinessHoursId)] Resolution: Note: Microsoft does not support editing the web config file directly, it may lead to serious issue. Login to SFB FE seerver and take a back of web.config file from C:\Program Files\Skype for Business Server 2015\Web Components\Rgs\Config Edit the webconfig file in notepad and add following string . I have mentioned 300 seconds as timeout value for loading the RGS configuration. /controls> Reboot the servers and check the status. Keep in mind , CU update may reset this custom configuration. You may have to make the custom changes after CU update.

Skype for business contact card with extension

Saleesh Neduvayalil — Wed, 04 Jan 2017 04:25:20 GMT

This article may help you to understand the client behavior when adding extension in skype for business 2016 contact card. I have installed SFB 2016 version 16.0.4266.1001 and SFB 2015 CU3 as backend. I have added a line URI with extension in following format in Active directory. I do have normalization rules to translate the number to E164 format. Updated user database and address book manually to update the new changes I have added ShowExtensionInFormattedDisplayString in the global policy. Below command is taken from Ken's blog , thanks for the great information. $x = New-CsClientPolicyEntry -Name "ShowExtensionInFormattedDisplayString" -Value "True" $y = Get-CsClientPolicy -Identity Global $y.PolicyEntry.Add($x) Set-CsClientPolicy -Instance $y I have successfully added the string in to SFB global policy. User has been assigned the same line URI with 4 digit extension. Later , updated client address book and tested the behavior in SFB 2016 client. I was able to see line URI with extension for NA numbers. Also tested a UK number to confirm the behavior and it was showing the extension as expected. I do see a duplicate number for call via work. It may not be related, it could be due to some other issue. I hope above information may be helpful for others if they wants to publish the line URI with extension in Lync contact card.

Skype for business mobile client distribution group (DL) expansion insights

Saleesh Neduvayalil — Fri, 11 Mar 2016 12:50:00 GMT

This article may be helpful for reference. I have used Skype for business 2015 server, ARR reverse proxy and Skype for business windows mobile client for the testing. Exchange DL name is empl@domain.com. I have separated DL expansion process in to four sections.

Authentication

When a user signed in to Skype for business mobile client, frontend server will provision a web ticket for the mobile user. Normally, this web ticket will be valid for 8 hours. Using this web ticket mobile client can request for the client certificate from skype for business cert provision service. By default, client certificate will be valid for 180 days. Mobile client will present the same web ticket for address book web queries and DL expansion requests if it is valid.

Search

I have launched SFB mobile client and signed in successfully. Then searched DL name with keyword ‘em’ from address bar.SFB mobile client initiated the web query as below. You can see the webticket header part of the request.

Log. 1. Search query from mobile

82005 GET https://ext.domain.com/ucwa/v1/applications/212484333169/people/search?query=em&limit=20
82006 Request Id: 065BDBDC
82007 HttpHeader:Accept application/vnd.microsoft.com.ucwa+xml
82008 HttpHeader:Content-Type application/vnd.microsoft.com.ucwa+xml
82009 HttpHeader:X-MS-Namespace internal
82010 HttpHeader:X-MS-WebTicket XXXXXXX

Log. 2. Query response from FE servers with XML.

82020 GET https://ext.domain.com/ucwa/v1/applications/212484333169/people/search?query=em&limit=20
82021 Request Id: 065BDBDC
82022 HttpHeader:Cache-Control no-cache
82023 HttpHeader:client-request-id ac8511da-29fc-4257-8237-64a0c2bc8bda
82024 HttpHeader:Content-Type application/vnd.microsoft.com.ucwa+xml; charset=utf-8
82025 HttpHeader:Date Wed, 09 Mar 2016 22:29:29 GMT
82026 HttpHeader:Server Microsoft-IIS/7.5
82027 HttpHeader:StatusCode 200
82028 HttpHeader:Strict-Transport-Security max-age=31536000; includeSubDomains
82029 HttpHeader:X-MS-Correlation-Id 2147484647
82030 HttpHeader:X-Ms-Namespace internal
82031 HttpHeader:X-MS-Server-Fqdn pool.domain.com
82032 HttpHeader:X-Powered-By ARR/2.5
82034 Falseucwa/v1/applications/212484333169/people/groups/empl@domain.com/expand" />empl@domain.comempl@domain.comempl & contra

DL expansion

Mobile client received a 200 OK from server. XML response from FE server has the DL expansion URL.I have selected DL name from search results and clicked on expand. Skype for business mobile client sent a new request to FE server. I got the DL membership information from the response. In my case test user1 is a member of this DL. XML response file will also include all relevant URLs for presence, photo download etc.

Log. 3. DL expansion request

82056 GET https://ext.domain.com/ucwa/v1/applications/212484333169/people/groups/empl@domain.com/expand
82057 Request Id: 065BF52C
82058 HttpHeader:Accept application/vnd.microsoft.com.ucwa+xml
82059 HttpHeader:Content-Type application/vnd.microsoft.com.ucwa+xml
82060 HttpHeader:X-MS-Namespace internal
82061 HttpHeader:X-MS-WebTicket XXXXXXX

Log. 4. DL expansion response from FE server

82073 GET https://ext.domain.com/ucwa/v1/applications/212484333169/people/groups/empl@domain.com/expand
82074 Request Id: 065BF52C
82075 HttpHeader:Cache-Control no-cache
82076 HttpHeader:client-request-id 377684b7-dede-49d2-a115-f463cc87be0d
82077 HttpHeader:Content-Type application/vnd.microsoft.com.ucwa+xml; charset=utf-8
82078 HttpHeader:Date Wed, 09 Mar 2016 22:29:32 GMT
82079 HttpHeader:Server Microsoft-IIS/7.5
82080 HttpHeader:StatusCode 200
82081 HttpHeader:Strict-Transport-Security max-age=31536000; includeSubDomains
82082 HttpHeader:X-MS-Correlation-Id 2147485827
82083 HttpHeader:X-Ms-Namespace internal
82084 HttpHeader:X-MS-Server-Fqdn SE.DOMAIN.COM
82085 HttpHeader:X-Powered-By ARR/2.5

82087 empl@domain.comempl@domain.comempl & contrapeople/testuser1@domain.com/location" />sip:testuser1@domain.comSameEnterprisetestuser1@domain.comUsertest user11476383057

Subscription

Once DL expansion is completed. Mobie client will sent a subscription request to FE server to get the presence status of the DL members. Received a response from server with the presence status. You can also see other requests such as photo download , supported media etc.

Log. 5. DL member's presence subscription request

82211 POST https://ext.domain.com/ucwa/v1/applications/212484333169/people/presenceSubscriptions
82212 Request Id: 065BF01C
82213 HttpHeader:Accept application/vnd.microsoft.com.ucwa+xml
82214 HttpHeader:Content-Type application/vnd.microsoft.com.ucwa+xml
82215 HttpHeader:X-MS-Namespace internal
82216 HttpHeader:X-MS-WebTicket XXXXXXX
82218
82219 30
82220
82221 sip:testuser1@domain.comtem>
82222
82223

Log. 6. DL members presence subscription response

82367 HTTP/1.1 200 OK
82368 Cache-Control: no-cache
82369 X-Ms-Namespace: internal
82370 Content-Type: application/vnd.microsoft.com.ucwa+xml; charset=utf-8
82372 extailability">OnlinePC
82373 --ed58f802-3438-47d1-b646-965f70e2d5f5
82374 Content-Type: application/http; msgtype=response

SFB FE Server responses:

When I sent the address book query, UCWA collaborated with abs service and initiated a search query to find the DL information. Authentication module kicks in and verified webticket from header. Later, provided abs webquery results. UCWA called DLx module to contact AD and find the DL membership information. Dlx returned members list. Lync FE server collated all information in Xml response.

Log. 7. ABS web query on SFB FE.

08829 TL_VERBOSE(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:29.479.00013220 (Dlx,AbWebService.SexteSqlQueryResultToAbQueryResult:rtcabwebsvc.cs(1606)) 1/1 contacts added to web query result
08830 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:29.479.00013221 (UCWA,AddressBookService.GetSearchResultData:addressbookservice.cs(645)) Abs search return 1 results for Query: em

Log. 8. Webticket verification on FE.

08856 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.0001323B (WebInfrastructure,OCSAuthModule.BeginRequest:iismodule.cs(459)) [2147485827]Enter -
08857 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.0001323C (WebInfrastructure,OCSAuthModule.BeginRequestImpl:iismodule.cs(512)) [2147485827],
08859 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.0001323E (WebInfrastructure,OCSAuthModule.BeginAuthenticateUser:iismodule.cs(653)) [2147485827]
08860 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.0001323F (WebInfrastructure,OCSAuthModule.BeginAuthenticateUser:iismodule.cs(700)) [2147485827], , ,
08861 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.00013240 (WebInfrastructure,HttpWebticketAuthRequestHandler.ExtractCredentials:httprequestauthhandlerimpl.cs(228)) [2147485827]X-MS-WebTicket header found
08862 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.00013241 (WebInfrastructure,OCSWebTicketCredentials.ExtractInstance:credentialsimpl.cs(2134)) [2147485827]Exit: CompactWebTicketCredentials found
08863 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2FD4::03/09/2016-22:29:31.792.00013242 (WebInfrastructure,CompactWebTicketCredentials.ExtractValidWebTicketCallback:credentialsimpl.cs(2756)) [2147485827]Found user compact web ticket.

Log. 9. Dlx module lookup

08889 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.823.0001325C (Dlx,Service.GetGlobalCatalogDirectorySearcher:service.cs(786)) GC:DC.DOMAIN.COM[192.168.2.62], OS:Windows Server 2012 Datacenter, Domain:DOMAIN.COM, Site:Default-First-Site-Name

08890 TL_VERBOSE(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.823.0001325D (Dlx,Service.QueryADGetDistributionListInfo:service.cs(3929)) Looking up: empl@domain.com

Log. 10. Dlx AD query response on FE

08901 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.00013268 (Dlx,Service.QueryADGetDistributionListInfo:service.cs(4033)) Found : empl@domain.com08902 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.00013269 (Dlx,Service.ProcessADRequest:service.cs(3129)) User found. DN is CN=empl & contra,CN=Users,DC=domain,DC=ORG08903 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.0001326A (Dlx,Service.ProcessADRequest:service.cs(3163)) msRTCSIP-TenantId of the dl is 00000000-0000-0000-0000-00000000000008904 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.0001326B (Dlx,Service.ProcessADRequest:service.cs(3178)) msRTCSIP-GroupingId of the dl is 00000000-0000-0000-0000-00000000000008905 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.0001326C(Dlx,Service.GatherAndPopulateMembers:service.cs(3489)) Found : 2 members in CN=empl & contra,CN=Users,DC=domain,DC=ORG08906 TL_VERBOSE(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.0001326D (Dlx,Service.QueryADAndPopulateResults:service.cs(3550)) Requesting AD for properties of : 2 members08907 TL_INFO(TF_COMPONENT) [SE\SE]0B98.2B90::03/09/2016-22:29:31.901.0001326E (Dlx,Service.PopulateGroupMemberResults:service.cs(3812)) Ignoring member because SipUri is not found: CN=Administrator,OU=hybrid,DC=domain,DC=ORG

Conclusion:

This article may be helpful for understanding the DL expansion behavior in Skype for business mobile client and server. I haven't included any troubleshooting steps in this document. If you know the call flow if you would be easy to isolate the issue.

Lync 2013 - ARR reverse proxy - Troubleshooting Tips

Saleesh Neduvayalil — Wed, 18 Feb 2015 13:02:00 GMT

This blog may help you with troubleshooting Lync mobility connectivity failures and Lync external autodiscover issues. I have divided troubleshooting steps in to four different categories.

Network, Firewall and DNS

Try to resolve Lyncdiscover.domain.com externally and make sure that it is pointed to the correct IP address.

Do you have NAT rules configured for reverse proxy? If yes, can you cross check IP mapping in NAT rule? It should be mapped to RP external NIC.

Make sure that ports are opened on firewall. Telnet RP external IP address or FQDN on 443 or 80 and it should be working.

Try to access below URls externally and make sure that they are working. Replace domain suffix with your domain.

https://lyncdiscover.domain.com/autodiscover/autodiscoverservice.svc/root/ - You will prompt to download root file.

https://lyncdiscover.domain.com/WebTicket/WebTicketService.svc/mex - You will get an XML response from Lync server.

https://lyncdiscover.domain.com/WebTicket/WebTicketService.svc – It should prompt for credentials.

If above URL is not working , download and install fiddler debugging tool to collect more logs from client machine. It may give you a hint on the failure.

Certificate

Certificate will play a key role in reverse proxy configuration. You need to make sure that external certificate is valid and necessary SAN entries are present in the certificate. Following site may help you with external certificate verification. Open the URL and enter lyncdiscover.domain.com as host name and look at SN & SAN, certificate validity. https://www.sslshopper.com/ssl-checker.html

You need to make sure that internal root CA is available on RP. If RP server is not part of your internal domain, export the root CA and import in to trusted root certificate authority container in MMC.

Reverse proxy configuration

I would recommend to change the port configuration before adding to serer farm. Sometimes, you may observe external client try to connect internal server FQDN/pool FQDN directly for web ticket. This is mainly due to ARR port forwarding misconfiguration.

If you have ARR 2.5 , go ahead and install ARR 2.5 hotfix for IIS 7 if applicable. Download the patch from following location ; https://www.microsoft.com/en-ca/download/details.aspx?id=27121

Try to telnet port 4443 and 8080 from RP server to pool FQDN or Simple URLs like meet.domain.com and dialin.domain.com.

Do you internal load balancer for web traffic? If yes, try to bypass the LB by adding a host entry and ensure that external connection is working.

Cross check static route requirements in RP. You would have removed IP gateway from internal NIC card. Make sure that route is configured properly.

Lync backend Configuration

It’s always recommended to update Lync frontend server and client to latest CU.

Ensure that Exposed URL in MCx configuration is set to External. You can run get- csmcxconfiguration command from PowerShell to verify the same.

There are scenarios where in you may get an error code from client device. You can enable failed tracing on Lync frontend server by following below steps.

Open IIS manager and select default website and select failed request tracing option as below.

Click on Add and enter the error code to filter the logs and next > finish.

Later come back to default web site page and select failed request tracing from action pane and enable it. Reproduce the issue from client or mobile device. You can see the logs in following location; \C:\inetpub\logs\FailedReqLogFiles. Open the file and watch out for any failure related to web services or Lync autodiscover service. It may give some clue on the actual issue.

Conclusion

I hope above steps may help you with troubleshooting or narrow down the issue.