My latest joy was tracking down a Lync problem where users on just a single pool were seeing the "Limited External Calling" error in their client after signing in. This had been working previously and no changes to the firewalls, certificates, DNS, or servers had taken place. All the usual stuff checked out OK and the logging traces on the client actually looked pretty clean. We saw no errors on the server and all other functionality seemed just fine.
After digging through the server-side traces I finally noticed a few diagnostic messages appearing periodically while looking for MRAS issues (some portions snipped for readability):
Text: Message expired in the outbound queue before it could be sent
SIP-Start-Line: SERVICE sip:<Edge Internal Pool Name>:5062;grid SIP/2.0
Peer: <Edge Internal Pool Name>:5062
Text: Message or one of its headers caused SIP transaction processing error
Result-Code: 0xc3e93f5b SIPPROXY_E_TRANSACTION_TIMEOUT
Data: Transaction Time-out: Type  Method [0x40] Call-Id [7d8d76435a474b568f430436e49cfcfd\n] RUri[sip:<SIP URI>;opaque=user:epid:uZWEVFe3nFqIKFtM_NzmFwAA;gruu] From[<SIP URI>;tag=8E780080] To[<SIP URI>;tag=af1b73d16f]
The timeout and expiry messages finally clued me in on the real problem - it turned out the timezone on this server had been flipped incorrectly by an automated process.
After correcting the clock settings and restarting the FE services we found the A/V authentication working properly again. So if everything else looks correct, it may come down to the basics - make sure your clock is set properly.