> Source: [sk1000194](https://support.checkpoint.com/results/sk/sk1000194)

# sk1000194 - Remote Access VPN IKEv2 Clients Fail to Receive Office Mode IP Addresses from RADIUS

| Property | Value |
|----------|-------|
| Solution ID | sk1000194 |
| Date Created | 2026-09-27 |
| Last Modified | 2026-09-30 |
| Technical Level | Advanced |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R82.20 |
| OS | Gaia |

## Symptoms

- <br />

* Authentication succeeds for Remote Access VPN users who connect using IKEv2 with Certificate and RADIUS (EAP) authentication, but the user does not receive an Office Mode IP address when RADIUS is configured as the Office Mode provider.

* IKE debug ("`ike debug on`") on the Security Gateway shows:

  `Internal address failure and Accounting finished with error`
* The same environment works correctly when:

  * IKEv1 is used.
  * Office Mode addresses are assigned from ipassignment.conf.
  * Office Mode addresses are assigned from a locally configured IP pool.

<br />

## Cause

An issue in the handling of RADIUS-based Office Mode IP assignment for Remote Access IKEv2 connections.

The issue occurs when the certificate Common Name (CN) differs from the user object name returned or registered through RADIUS.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content