Office mode DHCP method failure

[the_rock]

Hey guys,

Just wondering if there might be something simple missing for office mode failing with dhcp server method ip allocation. We even replicated this in the lab (on R82 mind you), though customer is on R81.20 jumbo 92. 

We followed below steps, but no luck.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-...

When we try in the lab, it simply says "Connection failed. you cannot receive office mode IP address at this time, try to connect again"

There is an sk on support site about this exact error, but all it says its fixed in certain versions, which customer is on anyway.

Any clue what might be the fix? I even verified the connection in the lab back and forth from dhcp server, tried different VIP, no joy.

Tx as always! I attached some screenshots for this as well.

Andy

[the_rock]

All I keep sesing is whats attached, with few different MAC addresses, but though all are allowed, same issue.

Andy

[Duane_Toler]

Ah.  Looks like there's a filter list of MAC addresses.  Or the filter is enabled but no entries are in the list.

https://www.dtonias.com/configure-dhcp-server-2016-filters/

Check this and you may need to disable the filter if it's enabled. 

[the_rock]

Just working on some Fortinet SASE stuff now, will check in a bit.

Tx brother 🙂

Andy

[the_rock]

Looks like they are all allowed.

Andy

[Duane_Toler]

Do you have anything in the Policies folder under the scope?  Apparently more detailed filters can be configured in there.  I wonder if the server is seeing the virtual MAC address of the gateway and using that for the MAC filter address.

[the_rock]

I checked that last week, appears to be related only to Windows class.

[Duane_Toler]

Try adding the MAC address  50-01-00-01-00-00 to your Allow filter.  That's the MAC your earlier capture screen shot showed as coming from the firewall for the unicast DHCP relay.  I see you had 50-01-00-02-00-00, however.  And nothing in the Deny filter, I presume?  I'm just about out of ideas, tho. 🙂

If this doesn't work, can you delete everything in the Allow and Deny filters and let it ride?  Or do you require filter entries?

[the_rock]

Yep, just tried, no luck...o well, its long weekend here, so let me clear my head till Tuesday, maybe something else comes to mind! Thanks so much again for all your help.

Andy