Scott Oseychik : AOL

Upcoming scheduled AOL / PIC maintenance window - October 8, 2009

Scott Oseychik — Thu, 08 Oct 2009 02:11:00 GMT

Summary:

America Online will be performing scheduled maintenance on their SIP Access Gateways during the following maintenance window:

Confirmed Maintenance Start Date: 10/08/2009 04:00 ET (24 Hour Time)

Projected Maintenance End Date: 10/08/2009 06:00 ET (24 Hour Time)

There may be sporadic access service availability and users may experience service disruption.

User Action:

No action needs to be taken by your Office Communications Server administrator(s). Additionally, there will not be any further notification regarding this maintenance activity unless there is a broad disruption of service. In such cases, we will relay outage communication accordingly.

Additional troubleshooting step when encountering PIC issues w/AOL

Scott Oseychik — Fri, 24 Jul 2009 18:48:00 GMT

Summary:

America Online ("AOL") uses Global Server Load Balancing ("GSLB") to maintain their SIP gateway farm. Their configuration uses sub VIPs, one for each of their two datacenters. Whenever AOL performs maintenance (new code, hardware, etc.), they use GSLB to take one datacenter offline while they update it and point all of the SIP traffic to the secondary datacenter.

As with all GSLB systems, DNS caching on the client side can be an issue. For example, this past week (July 16th), AOL replaced some hardware at one of their sites. When doing so, they directed all traffic to their other site around 12am EDT. It takes a maximum of 30 seconds for these changes to be reflected in DNS.

Several of our Office Communications Server customers were having issues connecting via PIC to AOL (through their SIP gateways) as late as 6:30am that morning, but that the issue resolved itself in about an hour's time. This sounds very much like DNS caching at work. That is, the users began using the system at 6:30am and continued to have issues until their DNS was refreshed.

Action Item:

While it is unclear where the caching took place (local host, ISP DNS, local network, or within the OCS topology itself), a good rule of thumb is that whenever an OCS customer is unable to reach AOL's SIP gateways via PIC, the first troubleshooting step should be to initiate a DNS flush (and that it is best to use the sip.oscar.aol.com FQDN instead of a specific IP address when connecting to AOL).

Upcoming scheduled AOL / PIC maintenance window - July 15, 2009 - July 16, 2009

Scott Oseychik — Wed, 15 Jul 2009 19:52:00 GMT

Summary:

America Online will be performing scheduled maintenance on their SIP Access Gateways during the following maintenance window:

Confirmed Maintenance Start Date : 07/15/2009 22:00 ET (24 Hour Time)

Projected Maintenance End Date : 07/16/2009 00:00 ET (24 Hour Time)

There may be sporadic access service availability and users may experience service disruption.

User Action:

Upcoming scheduled AOL / PIC maintenance window - June 4, 2009

Scott Oseychik — Wed, 03 Jun 2009 22:14:00 GMT

Summary:

America Online will be performing scheduled maintenance on their SIP Access Gateways during the following maintenance window:

Confirmed Maintenance Start Date: 06/04/2009 04:00 ET (24 Hour Time)

Projected Maintenance End Date: 06/04/2009 06:00 ET (24 Hour Time)

There may be sporadic access service availability and users may experience service disruption.

User Action:

RESOLVED - OCS 2007 R2 PIC fails against AOL

Scott Oseychik — Fri, 03 Apr 2009 21:14:00 GMT

Issue:

Microsoft Office Communicator 2007 R2 in conjunction with Office Communications Server 2007 R2 would intermittently fail to communicate with AOL AIM clients via PIC. Note that this would only reproduce if your OCS 2007 R2 Edge role is running Windows Server 2008 (x64); not Windows Server 2003 (x64).

Resolution:

Essentially, it boils down to tweaking the Windows Server 2008 Edge role to initially establish the SSL dialog using the TLS_RSA_WITH_RC4_128_MD5 cipher suite.

In order to change the cipher suite order, do the following on your Windows Server 2008 (x64) Edge server:

1. Start -> Run -> gpedit.msc -> OK

2. Within the Group Policy Object Editor, expand Computer Configuration, Administrative Templates, Network

3. Under Network, select SSL Configuration, and then double-click on SSL Cipher Suite Order (by default, the SSL Cipher Suite Order is set to "Not Configured")

4. Select the “Enabled” radio button, and in the in the SSL Cipher Suites text box, copy the entire string into Notepad. It should look like the following:

TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5,SSL_CK_DES_192_EDE3_CBC_WITH_MD5,TLS_RSA_WITH_NULL_MD5,TLS_RSA_WITH_NULL_SHA

5. The objective here is to move TLS_RSA_WITH_RC4_128_MD5 to be a the front of the list. So, in your Notepad document, find TLS_RSA_WITH_RC4_128_MD5, cut it, navigate to the beginning of your notepad document, and paste TLS_RSA_WITH_RC4_128_MD5. The new order should look like the following:

TLS_RSA_WITH_RC4_128_MD5,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,SSL_CK_RC4_128_WITH_MD5,SSL_CK_DES_192_EDE3_CBC_WITH_MD5,TLS_RSA_WITH_NULL_MD5,TLS_RSA_WITH_NULL_SHA

6. Paste the newly-formatted string back into the text field in the GPO Editor, click OK, then restart your Windows Server 2008 (x64) Edge server for these changes to take effect.

We have verified (and re-verified) these steps work, and can now successfully communicate with AOL AIM clients using Office Communicator 2007 R2 via PIC.

Office Communicator clients cannot communicate with contacts homed on AOL

Scott Oseychik — Tue, 02 Dec 2008 18:26:00 GMT

Summary:

If your organization leverages Public Internet Connectivity (aka: "PIC") in conjunction with their Live Communication Server 2005 and/or Office Communications Server 2007 servers, you may not be able to successfully communicate with (or see the presence status of) America Online Instant Messenger users.

Explanation:

America Online changed their root certificates on their SIP Access Gateway at approximately 12/2/2008, 4:00 AM EST.

Resolution:

The America Online Root CA 1 certificate, which can be obtained from https://pki-info.aol.com/AOL/, needs to be in the trust list of all Live Communication Server 2005 and/or Office Communications Server 2007 servers (that connect to sip.oscar.aol.com) by 12/2/2008, 4:00 AM EST.

More Information:

Microsoft Customer Support Services has created a Windows Media Video to walk our customers through the process of adding this certificate.