Static IP ipassignment.conf not working correctly

[Itzel_Gtz26]

Hello

I configured my VPN user to be assigned a fixed IP from the pool, however, said IP is not reserved for my user and if I connect late it is assigned to another user and does not let me enter.

I have already validated the use of tabs between fields in the ipassignment.conf file and put the IP of my gateway instead of the name

Any idea what I'm missing?

[PhoneBoy]

Version/JHF level of gateway?
To ensure no other user can obtain that IP address, you need to ensure that you're specifying IPs in ipassignment.conf that are not in your standard Office Mode pool.

[Itzel_Gtz26]

My gateways are in R81 Take 74

So I have to put an IP that is not in my VPN pool, but if I want to assign a fixed IP to all my users with that same pool, can't it?

[PhoneBoy]

There needs to be no overlap between your Office Mode pool and anything in ipassignment.conf.
Otherwise you will experience the exact issue you're reporting.

[Blason_R]

Instead why then configure firewall with external DHCP server and reserve the IP addresses there?

[G_W_Albrecht]

Sorry, but the meaning here is very unclear ! Why use an external DHCP if ipassignment.conf is not working as expected ? We all know that it does usually work and we do not need an external DHCP server...

[latloto]

sorry, but that not works. there are no valid documentation for this case. why should spent a lot time to research this nano technology .... a simple ip address map to user/group.

[G_W_Albrecht]

Better consult CP TAC to get this resolved !

[AmirArama]

in case havn't seen yet

https://support.checkpoint.com/results/sk/sk33422

[latloto]

of course.

i am looking, how to assign static ip to Microsoft ldap user.

# Gateway Type IP Address User Name
# ============= ===== ==================================== 
10.0.25.1 addr 172.16.5.2, CN=Tom Sornim,OU=it department,OU=west europa,OU=europa,DC=NordicOil,DC=local

Tom login is tom.sornim

office pool is 172.16.4.0/24

and this config does not works.

[PhoneBoy]

How does the user authenticate?
If by user/password, then use the AD login name here, not the full DN (which is used for certificate authentication).
This is noted in the SK linked above.