VVX 600 and PIN auth. fails on Lync 2013 Common Area Phones

[snydosaurus]

Issues:

• Polycom VVX600 and CX3000 phones are unable to authenticate via PIN method.  Phone reports "Lync Sign In has failed".
• VVX 600 users randomly lose authentication, and cannot reauthenticate their phones using AD credentials via either VVX control panel or BToE. Woirkaround is to assign bluetooth headsets as "soft phones" to eleminate Polycom from the picture.  Works fine this way.

Environment:

• Lync 2013 with three front-end servers running on Windows Server 2012 R2.
• UC Software Version 5.3.0.12074

Recent Changes:

• Lync Certs renewed

VVX App Log Error:

• 0318093543|tickt|4|00|[MsgSoWebTicketSignWithPinAuth]: Bad cert sign parameters

Attached Log Aquisition Method:

•  Logs were cleared, then PIN authenticaiton was attempted from the Web interface, at which point it failed.  Log was then exported and attached to this message.

Engagements:

• Spent 30 hours with a 3rd party service partner, and several hours with Microsoft directly.  They directed me to contact Polycom support, where I have ticket 1-11818221078 logged.

Things Tried:

• 4 different Polycom UC software revs, all the way up ot 5.9.x
• Microsoft cleaned out obsolete certs, and verified the ones assigned on all three front-end servers are correct.

[SteffenBaierUK]

Hello @snydosaurus ,

welcome to the Polycom Community.

First of all if a CX3000 fails then this would be Microsofts responsibility as Polycom only provides the CX3000 hardware and the software is 100% Microsoft's responsibility.

So therefore if this fails for both a CX3000 and a VVX then I assume it's something Microsoft can help you with.

Secondly the logs do not contain anything useful as these most likely did not have any form of correct logging applied or simply everything to debug which is not helpful either.

Please study this post and then try and provide some fresh logs:

Jan 17, 2017 Question:How can I troubleshoot simple Skype for Business, LYNC or Office365 issues?

Resolution: Have a look => here <

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[snydosaurus]

Attached is a fresh log during the PIN authentication attempt with logging set as indicated in the JPG attachment.

[SteffenBaierUK]

Hello @snydosaurus ,

Again the log does not really show anything but you have not yet answered if the CX3000 also fails?

Did you set the following aka Settings > Logging > Global Settings > Global Log Level Limit > Debug

Also did you raise Settings > Logging > Global Settings > Global Log Level Limit > Log File Size (Kbytes) > VVX prior to 5.5.0 = 180 after 5.5.0 = 1000 or Trio 10240

We may need a remote session to troubleshoot this.

As your unit is no longer within warranty please be prepared to Pay Per Incident / PPI. This is all outlined in detail here

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[snydosaurus]

Yes, the problem occurs with the CX3000.  The logs I provided were taken with the maximum log size of 180, and global logging level at Debug.  

Microsoft is requesting the following information, which I am hoping you can provide, or indicate where I can find it:

"As discuss, we need to know more about Certificate currently installed on your Polycom Phone.  As we have renewed the Front End certificate we need to ensure that the same certificate is installed on Polycom, if Front End server certificate and Polycom certificate is different then there will be an issue. Hence we need certificate information of Polycom phone as requested below:

Server certificate Thumbprint:

Root CA thumbprint:"

[SteffenBaierUK]

Hello @snydosaurus ,

any currently supported software does have a log size larger than 180kb.

• Currently Microsoft supported versions can be found => here <=
• Currently Polycom supported software is UC Software 5.9.1

A Polycom phone has built in certificates which we usually list on the individual Phone Model support page under Documentation > Other Documents as example => here <=

The above aside usually a phone would get the certificate from the AD Server in a correctly setup Skype for Business environment.

In addition you can manually specify a certificate using the web interface Settings > Network > TLS and in example Application CA 6 

Again as your CX3000 is not working either this tells me something is fundamentally wrong with your installation and Microsoft needs to be consulted on the CX3000 issue as the software for the CX3000 is a simple Skype client running on Windows CE.

All of the above is Microsoft standard and Microsofts responsibility.

As you have not attached a backup of your configuration we are unable to comment if you have maybe configured something wrong.

The initially posted FAQ has details how to troubleshoot Option 43/120 issues which can lead to Extension & PIN failures.

Your phone in question was purchased via SCANSOURCE COMMUNICATIONS and they can open a PPI case for you with Polycom support in case you need additional help.In order to raise a support ticket you need to work with your Polycom reseller as they need to do this for you.

End Customers are unable to open a ticket directly with Polycom support.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[snydosaurus]

Hello,

In this thread it's mentioned that the VVX600 is no longer supported as of Feb. 2019.  I'm having trouble finding that statement on the website.  Can you point me in the right direction?  Thanks.

[SteffenBaierUK]

Hello @snydosaurus ,

welcome to the Polycom Community.

I am struggling where within this post you are coming to this conclusion but the 5.9.0 and 5.9.1 release notes explain that certain VVX models no longer receive an update after UC Software 5.9.x

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[snydosaurus]

"As your unit is no longer within warranty please be prepared to Pay Per Incident / PPI. This is all outlined in detail here"

[SteffenBaierUK · Accepted solution]

Hello @snydosaurus ,

As you are having an issue and I am assuming most likely we can only troubleshoot this via working with Polycom support. As your phone is no longer withing warranty this process is not free of charge.

Therefore I am asking you to work with your reseller who can open a ticket with Polycom once PPI / Pay Per Incident is paid.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier