Pages

Monday, August 30, 2010

Windows Server 2008 R2 UAC strikes again causing problems with installing NET’s SmartSIP

Yes, it almost sounds like I had a heck of a lot of issues installing SmartSIP but note the following:

  1. I wasn’t using the right package one of the times.
  2. The manual said to use the IP but I went ahead and used the DNS name anyways.
  3. Problems from X-Lite calls to MOC was because of server being multi-homed as per Microsoft’s best practices. I used to have a lot of these problems with OCS’ Edge Transport server as well so it’s no surprise to me.

This problem was solely because of good old UAC (User Activation Controller) on Windows Server 2008 and it reminds me of the time when I had problems installing Exchange because double clicking on the package doesn’t elevate the permissions properly so Microsoft’s recommendation was to run it as administrator. In the case of this problem, you need to do the same.

So here I am going through the install by double clicking on the package on a Windows 2008 Server R2 64-Bit:

image

image

image

image

image

image

Looking good so far.

image

image

Success!

image

image

image

The source was not found, but some or all event logs could not be searched. Inaccessible logs: Securiy.

Interesting…

image

Seeing how the error referred to event logs, I proceeded to try activating it to see what would happen.

image

image

image

image

Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quite, the application will close immediately.

Object reference not set to an instance of an object.

I was able to proceed with the next screen to try and enter the license but I would keep getting an error:

image

There was a problem validating the license, it may be have expired or there may have been a connectivity issue such as a firewall problem.

Let’s just say I’ve tried a lot of things at the Customer Registration window and nothing worked. I’d see a flash like this:

image

Then get a No License in system message.

image

While I am able to get to the Ready status which was further than where I got with the bad package, I knew something was wrong.

image

image

I could proceed with the activation but I would end up getting this:

image

Error setting up event log.

Exception = Access to the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\SmartSIP' is denied.

Error setting up event log.

Exception = Requested registry access is not allowed.

The contact could not be created.

Exception from HRESULT: 0xC3EC7D81

Error configuring ASP.NET security.

Exception = Attempted to perform an unauthorized operation.

Error configuring Service security for Mediation server.

Exception = The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

Error configuring Service security for ECSmartSIPCore.

Exception = The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

Error configuring Service security for ECADHelper.

Exception = The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

Error configuring Service security for ECEmbededWebServer.

Exception = The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

Error configuring Service security for ECSmartTFTPServer.

Exception = The process does not possess the 'SeSecurityPrivilege' privilege which is required for this operation.

Error installing Soft Switch.

Exception = Access to the path 'C:\Program Files\NET- Network Equipment Technologies\SmartSIP\SoftSwitch\x86\conf\freeswitch.xml' is denied.

Activation ecountered an error while provisioning files.

Exception = Access to the path 'C:\Program Files\NET- Network Equipment Technologies\SmartSIP\conf\provisioned_config\smartsip{ip_addresses}.xml' is denied.

Activation ecountered an error while provisioning files.

Exception = Access to the path 'C:\Program Files\NET- Network Equipment Technologies\SmartSIP\conf\provisioned_config\smartsip.section[configuration].configuration[sofia.conf].profiles.profile[ocs].gateways{Remote Servers}.xml' is denied.

Activation ecountered an error while provisioning files.

Exception = Access to the path 'C:\Program Files\NET- Network Equipment Technologies\SmartSIP\ECSmartSIPServerCore.exe.config' is denied.

Activation ecountered an error while provisioning files.

Exception = Access to the path 'C:\Program Files\NET- Network Equipment Technologies\SmartSIP\ECSmartTFTPServerSvc.exe.config' is denied.

Remembering the experience I’ve had with other applications that weren’t NET, these are debugging codes that infrastructure guys wouldn’t understand so I stepped back and thought about what I could do from a Windows perspective.

The first thing that popped into my head was to try and run the activation as an administrator from the start. The problem with that is that when I use the start menu to right click on it, the option wasn’t there because it was an LNK file and Windows doesn’t give you the option “run as administrator”. I tried right click, properties to click on the find target button to get to the source but that option wasn’t there either. What I ended up doing was finding it in the C:\ProgramData\Microsoft\Windows\Start Menu\Network Equipment Technologies folder.

image

Here’s what I ended up doing:

Open a command prompt as an administrator:

image

Ran the install again. Went to the folder with the Activate SmartSIP.LNK file:

image

Executed the lnk file went through the wizards and voila!

image

image

Seeing progress was great!

image

image

image

image

image

Wow! Success!

image

Error 1001 encountered when uninstalling NET’s SmartSIP

I’m not sure what caused this error when I was uninstalling SmartSIP so I won’t assume that it’s because of the application but rather a combination of the server being Windows Server 2008 R2, the hotfixes installed, UAC, and possibly the OCS version I had installed on the server already. I’ve ran into many of these problems in the past and it’s almost always a combination of things on the server.

If you ever run into the following error during an install:

Error 1001. An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However the application might not fully uninstall after the uninstall is complete. –> The specified service does not exist as an installed service

image

I’m sure it’s possible to hacked away at the registry removing the services, the reference in the Programs and Features but the way that I got the package to uninstall properly was to not use the Programs and Features window to right click the SmartSIP application and choose uninstall. What you want to do is double click on the installation package and click remove in the wizard:

image

Once you uninstall it with this method, you will no longer run into the error message in the screenshot above.

Problems installing NET’s SmartSIP – Make sure you’re using the right package

The SmartSIP blog posts are a bit out of sync as I’ve posted a troubleshooting one earlier last week but so sorry about the ordering.

Problem

Went ahead through the install from a package I received but got stuck at the activation wizard’s Loading data status forever:

image

What I ended up doing was reach out to NET’s engineer for assistance and once the engineer saw the screen noted below, he immediately told me that we should try another build instead because this isn’t the right one:

Customer Registration:

image

The version that I later received has this window for the Customer Registration:

image

Once I used the second installation package I received, I was no longer stuck at the status I mentioned above:

image

I hope this helps someone out there that may encounter the same problem.

Event ID: 1136 and 1464 being logged every 5 minutes on the domain controllers

Ran into an interesting problem at a client a few months ago while deploying OCS. They had already deployed an OCS standard pool in their environment for testing purposes earlier but decided to get us in to deploy an enterprise pool from scratch. The administrator told me that he had already uninstalled the standard pool so the environment should be free of any OCS settings but when I arrived on site, I noticed that the domain controllers were logging the event ID 1136 error every 5 minutes with the following message:

Active Directory failed to create an index for the following attribute.

Attribute identifier:

2383405064

Attribute name:

msRTCSIP-ApplicationDestination

A schema cache update will occur 5 minutes after the logging of this event and will attempt to create an index for the attribute.

Additional Data

Error value:

-1403 JET_errIndexDuplicate, Index is already defined

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

image

image

image

The research I did on the internet didn’t help so I reached out to our Microsoft Partner Support forums and was recommended the following:

There are 2 ways to clear out the event ID 1136 on the domain controllers.

1. Clear up the corrupted database – This option is too complicated to do.

2. Temporarily disable index for this attribute in forest – Easier to do.

I would suggest to do option #2. Once we turn off indexing for this attribute and enough time has passed to ensure that all domain controllers have replicated and has defragged its database, we can then turn it back on.

Here are the steps to disable indexing for the attribute:

======

1. Logon to schema master DC.

2. Run adsiedit.msc

3. Expand schema partition.

4. Find object “cn=ms-RTC-SIP-ApplicationDestination”

5. Double click to modify the attribute

6. Find the attribute “searchFlags”

image

7. Modify it to 0 (by default is 3)

image

8. Save the setting and wait for AD replication.

This error will not be logged on the domain controllers anymore after the schema change has replicated to all the DCs.

To enable indexing again, take the steps above and change it back to what it was before in about 3 after weeks.

------------------

I went ahead and recommended #2 to the client, made the appropriate changes and the errors were cleared up on the domain controllers but after 3 months of error free logs, I went back to enable the flag only to find that the errors would come back. I went back to the Microsoft Partner forums and was told the following:

The only identified workarounds to eliminate the event are:

1. Do not index this attribute for containerized searches in the active directory like Paolo mentioned.

2. Or make sure the system locale installed in schema master doesn’t fall into the listed ones in the following article.

- ADPREP Challenges - Mark Empson's Blogalot - Site Home - TechNet Blogs ...

http://blogs.technet.com/b/mempson/archive/2009/06/11/adprep-challenges.aspx

I went back and asked the engineer:

We used Paolo's suggestion to stop the errors but would like to know how to fix it while still getting the improved search performance through indexing.

Is option #2 this KB? http://support.microsoft.com/kb/932862/

I looked at the steps and it's pretty much the same.

… then go this response:

Yes, the option listed in the KB is to remove the index for the specific attribute. So far the workaround to eliminate the errors are the two I mentioned in the last reply. Actually, the impact should be very small and the functionality won’t be affected since we don’t index only a single attribute. If you insist indexing the attribute, I’m afraid you have to install a DC (host schema master role) and make sure that the installed system locale doesn’t fall into the list of the link previously given.

It sounds like there really isn’t an easy way to fix this other than disabling the indexing of that attribute.

Error mounting NFS Store from ESX

Just wanted to make a reminder to myself about what I encountered today:

“Just because you were told that there are no port restrictions between the 2 VLANs, don’t count on the information always being true.”

Problem

I was assisting a client move an NFS device for their vSphere environment today and kept getting the following error after re-IP-ing the device:

Error during the configuration of the host: NFS Error: Unable to Mount filesystem: The mount request was denied by the NFS server. Check that the export exists and that the client permitted to mount it

image

Solution

As it turns out after doing all the sanity checks on the NFS device’s management console, the problem was because there were port restrictions between the 2 VLANs.

As per the following VMware KB article:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1007352

The ports required are: 111 and 2049 on UDP and TCP

Friday, August 27, 2010

NET SmartSIP X-Lite (SIP) calls to MOC Failing

This problem was interesting because it wasn’t so much the SmartSIP software but more of the networking aspect of how the NICs were setup on the Mediation server that had SmartSIP installed.

Analyzing the errors:

  • Whenever I try to make a call to another signed in X-Lite phone, OCS user, the call will ring for 4 times until I get a "The person you are calling is unavailable. Please try again."

  • Through reviewing the logs, I can see that SmartSIP shows it found the person but their phone never rings (X-Lite or MOC).

image

  • The X-Lite screen reads: "Call failed: Service Unavailable"

image

  • The SmartSIP logs shows: "NormalTemporaryFailure".

image

Since Google’s no help for applications such as these, I went to the install guide for help and but couldn’t find my answer there so I sat down and started thinking about the traffic between the OCS Front-End server, Mediation Server, and the SmartSIP application.

After tracing through the MOC client error logs, I found the following hint:

image

A SIP request made by Communicator failed in an unexpected manner (status code 80ef01f8). More information is contained in the following technical data:
RequestUri: sip:+5555@domain.com;user=phone
From: sip:unislumin@domain.com;tag=c2adc74c82
To: sip:+5555@domain.com;user=phone;tag=C9E58D6EEFCC24A2ABA5798B78861415
Call-ID: a3dc038401c844abb87eeafd9659228a
Content-type: application/sdp;call-type=audiovideo

(null)

Response Data:

183 Session Progress

101 Progress Report
ms-diagnostics: 13004;reason="Request was proxied to one or more registered endpoints";source="ocsharfe01.ad.domain.com";appName="InboundRouting"

504 Server time-out
ms-diagnostics: 1014;reason="Unable to resolve DNS A record";source="ocsharfe01.ad.domain.com";LookupFQDN="smartsip.domain.com"

Resolution:
If this error continues to occur, please contact your network administrator. The network administrator can use a tool like winerror.exe from the Windows Resource Kit or lcserror.exe from the Office Communications Server Resource Kit in order to interpret any error codes listed above.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------------------------------------------------------------------------------------------------------------------------

This is when I noticed that I wasn’t able to ping smartSip.domain.com. This was my mistake as I had asked the person who manages the root domain DNS on the BIND servers to add the record for smartSIP.ad.domain.com and not the actual smartSIP.domain.com. I’m not sure how I managed to get through the install but I’ll assume the installation process doesn’t care as much about the record as I thought it did. Once the record was added in, I am now getting the following error in MOC:

image

A SIP request made by Communicator failed in an unexpected manner (status code 80ef01f8). More information is contained in the following technical data:
RequestUri: sip:+5555@domain.com;user=phone
From: sip:unislumin@domain.com;tag=29f911a21d
To: sip:+5555@domain.com;user=phone;tag=C9E58D6EEFCC24A2ABA5798B78861415
Call-ID: 58dd148d93f34d7e93b19249928af2eb
Content-type: application/sdp;call-type=audiovideo

(null)

Response Data:

183 Session Progress

101 Progress Report
ms-diagnostics: 13004;reason="Request was proxied to one or more registered endpoints";source="ocsharfe01.ad.domain.com";appName="InboundRouting"

504 Server time-out
ms-diagnostics: 1007;reason="Temporarily cannot route";source="ocsharfe01.ad.domain.com";ErrorType="Connect Attempt Failure";WinsockFailureDescription="The peer actively refused the connection attempt";WinsockFailureCode="10061(WSAECONNREFUSED)";Peer="smartsip.domain.com"

Resolution:
If this error continues to occur, please contact your network administrator. The network administrator can use a tool like winerror.exe from the Windows Resource Kit or lcserror.exe from the Office Communications Server Resource Kit in order to interpret any error codes listed above.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Definitely progress. So I went through the configuration again and thought about flow. One of the things I had to get my head wrapped around was that the configuration guide’s example was with a single NIC while our setup was using a dual NIC. I’m not exactly sure what SmartSIP recommends but Microsoft’s OCS deployment guide’s best practice is to use 2 NICs to separate data and voice traffic. After thinking more about the flow, I realized that call traffic actually gets routed to the voice NIC on port 5070 from the front-end server. A quick telnet test to the voice NIC’s IP via port 5070 shows:

Could not open connection to host, on port 5070: Connect failed.

Another ping test to the voice NIC’s IP via port 5070 shows:

Request timed out.

This got me double checking the firewall on the SmartSIP/Mediation server but it was already turned off. I went ahead and tried to have the SmartSIP/Mediation server telnet to itself, ping itself and they all worked. As all of the obvious Windows skills I used appeared to not help, this was when I had to drawn on my expired CCNA skills of routing.

Problem Solution:

Long story short, the mediation/SmartSIP server has 2 NICs. There is only 1 NIC with the gateway and this happens to be the data NIC and not the voice NIC. The voice NIC can receive the traffic from the front-end but it has no way of replying since there’s no gateway and it’s on a completely different subnet.

I went ahead and did a route add x.x.x.x mask gateway then tried again and this time I was able to call from X-Lite to MOC.

Unfortunately, X-Lite to X-Lite still doesn’t work but at least I got part of the problem sort of figured out. I still need to look into how to set the route to only be used for the voice NIC and not the data NIC.

Stay tuned for other posts about SmartSIP.

Update

After doing some research on the internet, I figured out how to specify the route for that specific interface. You basically have to do a route print then look at the Interface List section (highlighted in red).

C:\Program Files\NET- Network Equipment Technologies\SmartSIP>route print
===========================================================================
Interface List
13...a4 ba db 35 9a 8f ......Broadcom BCM5716C NetXtreme II GigE (NDIS VBD Clie
nt) #2
11...a4 ba db 35 9a 8e ......Broadcom BCM5716C NetXtreme II GigE (NDIS VBD Clie
nt)
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.106.1.1 10.106.1.10 266
10.102.0.0 255.255.0.0 On-link 10.102.1.4 266
10.102.1.4 255.255.255.255 On-link 10.102.1.4 266
10.102.255.255 255.255.255.255 On-link 10.102.1.4 266
10.106.1.10 255.255.255.255 On-link 10.106.1.10 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.106.1.10 266
224.0.0.0 240.0.0.0 On-link 10.102.1.4 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.106.1.10 266
255.255.255.255 255.255.255.255 On-link 10.102.1.4 266
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.106.1.1 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::/64 On-link
13 266 fe80::/64 On-link
11 266 fe80::38d3:7e62:110f:1465/128
On-link
13 266 fe80::9523:cd2b:5daa:5204/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
13 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

C:\Program Files\NET- Network Equipment Technologies\SmartSIP>

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

So now a simple:

C:\Program Files\NET- Network Equipment Technologies\SmartSIP>route add 10.106.1.0 mask 255.255.255.0 10.102.0.1 if 13
OK!

…does the trick.

NET/Evangelyze SmartSIP doesn’t like DNS name for proxy address

I’ve been setting up NET/Evangelyze’s SmartSIP application on a mediation server for a client the past 2 days and ran into a lot of issues during the install and configuring. I’ll write more about the install on another blog post but here’s a quick one:

Yes, the manual actually tells you to enter the IP address for the proxy address but my Windows best practice experience in the past was to use the name so I chose to enter the DNS A record in the proxy address instead of the IP and get a Registration error: 408 – Request Timeout.

image

I went ahead and changed it to the IP address, restarted X-Lite and the phone registered successfully.

image