topic Re: you cannot receive an office mode ip address at this time. in SASE and Remote Access

you cannot receive an office mode ip address at this time.

gtsanava — Mon, 06 Sep 2021 14:37:29 GMT

hello

We have upgraded from R80.30 to R81 everything seems fine, but on Remote Access VPN we have periodic connection failures for several users and they have next error: “Connection Failed You cannot receive an office mode IP address at this time…” there is screen also.

we noticed that, problem appears to users which had unexpectedly disconnected from VPN for several various reasons.

And that’s why problem repeats every day with several various users (5 to 10 users by day), also 2-3 same users too.

At this point we are resolving this 5-10 issues by changing ip addresses in ipassignment.conf file for problematic users. Also for troubleshooting purposes I have returned old ip to user after several minutes but same error appeared.

it seems as if there is problem with tunnel for user also problem is resolved by resetting tunnel but in most cases session disappears in "tunnel and user monitoring" view so I cant reset it and I am forced to change ip address in ipassignment .conf file and access policy too for each user.

we are assigning ip addresses to vpn users only via ipassignment.conf file. Also we have edited $FWDIR/conf/trac_client_1.ttm file according to our needs. And this configurations worked for us fine on R80.30 and we think that this settings should be okay with R81 also.

please share your experience, I have already opened case but still waiting for response.

Respectively,

George Tsanava

Re: you cannot receive an office mode ip address at this time.

PhoneBoy — Mon, 06 Sep 2021 16:32:19 GMT

This is definitely going to require TAC assistance.
That said, it is one of the limitations of using ipassignment.conf to assign a specific user a specific address.

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Tue, 07 Sep 2021 10:34:06 GMT

One of our partners has the same issue with a lot of customers - issue started after installing R81 JT 36 ! So to resolve this issue, you would have to uninstall JT 36 and go back to JT 29. This can be replicated very easily, but although a SR# is open since 17.8., no solution was found yet.

Workaround is to remove the IP from om_assigned_ips...

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Tue, 07 Sep 2021 11:11:32 GMT

Can you share the SR# in a private message so i can point it out to CP ?

kind regards,

--
Guenther Albrecht
Arrow ECS Internet Security AG A-1100 Wien, Wienerbergstrasse 11
Tel: +43 1 370 94 40 325 Fax: +43 1 370 94 40-33

Re: you cannot receive an office mode ip address at this time.

gtsanava — Tue, 07 Sep 2021 11:44:13 GMT

yes I have sent it to you in PM

Re: you cannot receive an office mode ip address at this time.

the_rock — Tue, 07 Sep 2021 23:14:40 GMT

I had that exact same error with one customer and it turned out to be a license. Im not saying thats the case with you, but maybe worth checking.

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Wed, 08 Sep 2021 07:22:30 GMT

Usually, the error could also be a licensing issue. But if all had been working as expected until JT 36 was installed, this is simply a bug 8)

Re: you cannot receive an office mode ip address at this time.

gtsanava — Wed, 08 Sep 2021 07:27:30 GMT

yes it looks like bug. licensing was checked very first, its not about that.

Re: you cannot receive an office mode ip address at this time.

Naama_Specktor — Thu, 09 Sep 2021 11:17:27 GMT

thank you for the information 😀

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Thu, 09 Sep 2021 11:30:41 GMT

At least two TAC tickets are currently open for this issue...

Re: you cannot receive an office mode ip address at this time.

idants — Thu, 09 Sep 2021 15:58:08 GMT

Hi,

I am Idan Tsarfati, R&D VPN group manager.

Thanks for letting us know about this issue - we investigated it and found out that there is a bug in this take which related to the mentioned configuration file.

We have a fix for this issue, so you can contact me in order to get it.

A WA is to remove the user from the configuration file.

Thanks.

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Fri, 10 Sep 2021 07:30:49 GMT

We have received an update:

On R81 T36, the IKED project was integrated. This project is about creating a new daemon that can handle IKE negotiations for VPN connections. The new daemon is called iked and its disabled by default.

As part of this project, Office mode allocation was changed (mainly, moved from user-space to kernel-space) for coordination and stability purposes.

The issue we see with these customers is related to ipassignment.conf when a user disconnect implicitly (without informing the GW). In such cases, the OM IP will be stuck inside om_assigned_ips kernel table.

With the new OM allocation mechanism, that implicitly disconnected user wont be able to connect unless the om_assigned_ips entry reaches its expiration.

Even though the ike is disabled by default, the new OM allocation mechanism is enabled (since its mainly I/S that cannot be disabled).

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Thu, 16 Sep 2021 14:10:43 GMT

A fix is ready, fw1_wrapper_HOTFIX_R81_JHF_T36_752_MAIN_GA_FULL - at our customers it did resolve the issue !

Re: you cannot receive an office mode ip address at this time.

gtsanava — Fri, 17 Sep 2021 08:33:04 GMT

yes fix resolved our case. thanks to all Checkpoint Staff Members who worked on it ❤️

Re: you cannot receive an office mode ip address at this time.

G_W_Albrecht — Wed, 29 Sep 2021 11:38:46 GMT

Fix is included in Ongoing Jumbo Take 44 : https://community.checkpoint.com/t5/Product-Announcements/R81-Jumbo-Hotfix-Accumulator-New-Ongoing-take-44/ba-p/130545/jump-to/first-unread-message