Problem with Capsule on 3900 R82.10 Take 24

[MonoAEK21]

I have a cluster of 2 3900's R82.10 initially Take 22.

I want to upgrade both to R82.10 Take 24.

When I did the first one and failover to it to handle traffic, (clusterXL is healthy no pnotes or any other problem, and sessions are correctly synchronized between members), Capsule VPN does not work in IPSec Mode only in SSL mode.

Office mode is not offered by the Firewall but from a DHCP server. When trying to connect via Capsule in SSL it connects immediately and works fine. However in IPSec mode it says "Failed to allocate IP address". Pool is fine, i get correct authentication log followed by a "drop" log with the public IP of the capsule as source indicating the same problem.

ipassignment.conf files are identical (non-changed at both Firewalls). 

The only useful thing I could get from my troubleshooting is that when z-debug with the IP of the DHCP server, whenever I try to connect via Capsule with IPSec it shows this immediately:

@;2378783.1152;[vs_0];[tid_0];[fw4_0];fw_log_drop_ex: Packet proto=17 <DHCPSERVERIP>:67 -> <FWINTERFACEIP>:68 dropped by fw_post_vm_chain_handler Reason: Handler 'dhcp_reply_code' drop;

(addresses hidden by me).

Is there any limitation on how these Firewalls in this firmware handle dhcp requests/replies?

To note, when failovering back to the non-upgraded one everything works correctly.

Thank you!

[PhoneBoy]

That error may be a red herring.
However, it sounds like a TAC case is in order.