topic No Office Mode IP anymore since R81.10 take 45 in SASE and Remote Access

No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 18:27:30 GMT

Today we updated a CP HA Cluster from R81.10 take 30 to take 45.

After the update the VPN Client throwed an error, that they are unable to get an OfficeMode IP at this time!

We use a DHCP server to get the IPs for the OfficeMode Clients. On the server are free IPs. The DHCP server works and I can see the requests to server in the log.

cpstop;cpstart & fwaccel off doesn't solve the problem.

But, after uninstall take 45 and use take 30 again everything works...

Any Ideas?

Re: No Office Mode IP anymore since R81.10 take 45

the_rock — Thu, 07 Apr 2022 18:48:04 GMT

Hm, thats odd...I tested on mine and no issues with take 45 at all. Clearly, its an issue if you removed that jumbo and works again with 30. Was everyone having the same problem with take 45? Did you try different client versions? Its very hard to say what could have caused this after take 45 install, since you removed it since, so Im thinking even if you opened TAC case they would most likely ask you to replicate the issue, so it can be troubleshot further.

Did you at least get any message logs or anything from the smart console when it was failing?

Andy

Re: No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 19:02:26 GMT

We tested it with several Clients, but all E86.20 (this version is provided by the gateways...)
At the moment we have only downgraded one of the Cluster Node, so it may be possible to do quick tests on the other node, if we temporally switch the cluster...
In the SmartConsole Log I only see the Login Message of the user after that no additional messages for this user....

Re: No Office Mode IP anymore since R81.10 take 45

the_rock — Thu, 07 Apr 2022 19:05:56 GMT

One thing that came to my mind was license, but it made no sense, since license would never change with an upgrade. Do you have screenshot of the error? lets do remote if you are available to show me the issue.

Re: No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 19:44:38 GMT

This the Error Message, which the user see after login. Regards the SmartLog the Login is successfull.

The SmartLog Entries:

Failed Login (take 45):

successful login (take 30):

Both are from the same client, only to the different Cluster Nodes...

Re: No Office Mode IP anymore since R81.10 take 45

Danny — Thu, 07 Apr 2022 19:24:41 GMT

Did you try if an eval license helps to overcome the situation until TAC finished analyzing this?

Re: No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 19:30:08 GMT

No, why should it be a license problem? It was only a JHF installed, no new version or HW. With take 30 we didn't have any problems. And after uninstall take 45 we didn't have the problem anymore. We simply uninstall take 45 on the gateway and go back to take 30, no restore from backup.

By the way the gateways node still have a valid eval, because of HW replacing 10days before...

Re: No Office Mode IP anymore since R81.10 take 45

Danny — Fri, 08 Apr 2022 07:23:24 GMT

Maybe there is a new enforcement mechanism introduced in the new GA Jumbo (JHF Take 45).
Testing an eval licence would have confirmed if it's a license issue or not.
Also using the latest GA Take follows Check Point's recommendation as described in the Jumbo Hotfix FAQ - sk98028:

Re: No Office Mode IP anymore since R81.10 take 45

the_rock — Thu, 07 Apr 2022 19:33:34 GMT

Highly unlikely, but I agree, worth a try.

Re: No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 19:43:39 GMT

Maybe an option, but I think for the moment take 30 is our workaround.
If there is a license problem because of wrong enforcement CP should be able to analyze and fix that fast. I didn't saw such information in the release notes.
My expectation about recommended JHF is, that they must not generate new license problems.
What runs before, must be able to run afterwards again. Such JHF should able to be installed automatically without worry what will be not work this time after install the recommended fix.

Re: No Office Mode IP anymore since R81.10 take 45

the_rock — Thu, 07 Apr 2022 19:48:48 GMT

You are correct. In perfect world, none of those things would ever happen and probably not many of us would have IT jobs if that were the case : - ). Anyway, glad it works when back on JHF 30, so personally, I would have TAC investigate with whatever info you generated during the issue.

Some related links:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164318

https://community.checkpoint.com/t5/Remote-Access-VPN/you-cannot-receive-an-office-mode-ip-address-at-this-time/td-p/128786

Re: No Office Mode IP anymore since R81.10 take 45

DH — Thu, 07 Apr 2022 19:49:31 GMT

The SR is already opened, but I hope someone had already solved the problem before.😉

Re: No Office Mode IP anymore since R81.10 take 45

Wolfgang — Fri, 08 Apr 2022 06:22:12 GMT

@DH we have customeres reporting the same issue after installing Jumbo take 45.

tagging @Chris_Atkinson , please would someone from Check Point investigate.

Re: No Office Mode IP anymore since R81.10 take 45

DH — Fri, 08 Apr 2022 06:39:21 GMT

Thank you for the information. So it seems it is not a problem which is specify to us.

Re: No Office Mode IP anymore since R81.10 take 45

Chris_Atkinson — Fri, 08 Apr 2022 06:43:58 GMT

Please share any applicable SRs with me in private and I'll reach out internally.

Wouldn't be the first time I've seen seemingly "random" DHCP issues appear after upgrades so please triple check your policies conform to sk104114 section 4 or equivalent where appropriate to be safe.

@eranzo

Re: No Office Mode IP anymore since R81.10 take 45

the_rock — Sat, 09 Apr 2022 19:10:37 GMT

I dont know what to say, honestly...I tested this in lab, no issues. Customer also upgraded to same jumbo, no problems either.

Re: No Office Mode IP anymore since R81.10 take 45

Naama_Specktor — Sun, 10 Apr 2022 08:43:08 GMT

Hi 🙂

My name is Naama Specktor and I am checkpoint employee ,

I will appreciate it if you will share the TAC SR# with me , here on n PM.

thanks!

Naama

Re: No Office Mode IP anymore since R81.10 take 45

GHaider — Tue, 12 Apr 2022 06:42:52 GMT

seeing the exact same behaviour on my cp cluster, my clients are on endpoint E86.25 and after install of JH 45 no office mode ip, after uninstall and back to JF 30 ist works again

...will update here when i get results out of the cp case...

Re: No Office Mode IP anymore since R81.10 take 45

idants — Tue, 12 Apr 2022 07:51:49 GMT

Hi,

We are investigating this issue internally - I will update once we have any conclusion.

Thanks,

Idan Tsarfati.

R&D Group manager of IPsec VPN & HTTPs inspection.

Re: No Office Mode IP anymore since R81.10 take 45

JohAicher — Tue, 12 Apr 2022 08:39:14 GMT

Hi, we are also impacted - very bad situation!!!

Johann