I have an Aastra 6725ip handset (running version 4.0.755.4066) and the handset intermittently signs out and I see the following error in the Lync server event log on the standard edition server. I have also observed this behavior with a Polycom CX500, but it doesn't seem to be effecting other handsets (Mix of Polycom CX500 & CX600)
Log Name: Lync ServerSource: LS Protocol Stack
Date: 05/07/2012 14:08:49
Event ID: 14507
Task Category: (1001)
Level: Warning
Keywords: Classic
User: N/A
Computer: LyncServer.domain.local
Description:
At least one attempt to reference stale (non-existent or deleted) security association was detected.
There were 1 messages with signature that referenced stale (non-existent or deleted) security association in the last 115 minutes. The last one was this SIP message:
Trace-Correlation-Id: 3956458956
Instance-Id: 00004B7B
Direction: no-direction-info
Message-Type: request
Start-Line: REGISTER sip:domain.co.uk SIP/2.0
From: <sip:user@domain.co.uk>;tag=e46fa2f41d;epid=ce147c8b1d
To: <sip:User@domain.co.uk>
CSeq: 1 REGISTER
Call-ID: b7647d0cb37ad851d0c2cf356800e2e5
Contact: <sip:172.16.1.214:50667;transport=tls;ms-opaque=944216978e;ms-received-cid=B9E00>;methods="INVITE, MESSAGE, INFO, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY";+sip.instance="<urn:uuid:83461967-81BD-5B62-B491-961144E4FD56>"
Via: SIP/2.0/TLS 172.16.1.214:50667;ms-received-port=50667;ms-received-cid=B9E00
Max-Forwards: 70
User-Agent: CPE/4.0.7577.4066 OCPhone/4.0.7577.4066 (Microsoft Lync 2010 Phone Edition)
Supported: gruu-10, adhoclist, msrtc-event-categories
Supported: ms-forking
Supported: ms-cluster-failover
Supported: ms-userservices-state-notification
ms-keep-alive: UAC;hop-hop=yes
Event: registration
Ms-Device-Info: MAC=00-08-5D-31-06-B1, vendor=Aastra, version=6725ip
Proxy-Authorization: TLS-DSK qop="auth", realm="SIP Communications Service", opaque="75AABBF0", targetname="LyncServer.Domain.local", crand="d0e7dd70", cnum="85", response="d1724a6b86118acecb509a20e185b91452c54468"
Content-Length: 0
Cause: This could be due to users that utilize large number of devices (in excess of configured maximum), or due to connection refresh logic re-balancing remote users to a different director in a bank or a pool, or it could be due to an attacker.
Resolution:
None needed unless the failure count is high (>100). Check if number of allowed devices per user is too low for existing usage scenarios. Check your network for any rogue clients. Restart the server if problem persists.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="LS Protocol Stack" />
<EventID Qualifiers="33769">14507</EventID>
<Level>3</Level>
<Task>1001</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-07-05T13:08:49.000000000Z" />
<EventRecordID>122664</EventRecordID>
<Channel>Lync Server</Channel>
<Computer>LyncServer.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>115</Data>
<Data>1</Data>
<Data>Trace-Correlation-Id: 3956458956
Instance-Id: 00004B7B
Direction: no-direction-info
Message-Type: request
Start-Line: REGISTER sip:domain.co.uk SIP/2.0
From: <sip:user@domain.co.uk>;tag=e46fa2f41d;epid=ce147c8b1d
To: <sip:user@domain.co.uk>
CSeq: 1 REGISTER
Call-ID: b7647d0cb37ad851d0c2cf356800e2e5
Contact: <sip:172.16.1.214:50667;transport=tls;ms-opaque=944216978e;ms-received-cid=B9E00>;methods="INVITE, MESSAGE, INFO, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY";+sip.instance="<urn:uuid:83461967-81BD-5B62-B491-961144E4FD56>"
Via: SIP/2.0/TLS 172.16.1.214:50667;ms-received-port=50667;ms-received-cid=B9E00
Max-Forwards: 70
User-Agent: CPE/4.0.7577.4066 OCPhone/4.0.7577.4066 (Microsoft Lync 2010 Phone Edition)
Supported: gruu-10, adhoclist, msrtc-event-categories
Supported: ms-forking
Supported: ms-cluster-failover
Supported: ms-userservices-state-notification
ms-keep-alive: UAC;hop-hop=yes
Event: registration
Ms-Device-Info: MAC=00-08-5D-31-06-B1, vendor=Aastra, version=6725ip
Proxy-Authorization: TLS-DSK qop="auth", realm="SIP Communications Service", opaque="75AABBF0", targetname="LyncServer.domain.local", crand="d0e7dd70", cnum="85", response="d1724a6b86118acecb509a20e185b91452c54468"
Content-Length: 0
</Data>
</EventData>
</Event>