> Source: [sk116957](https://support.checkpoint.com/results/sk/sk116957) # sk116957 - "Connection Failed: You cannot receive an Office Mode IP address at this time" message when VPN Remote Access client tries to connect | Property | Value | |----------|-------| | Solution ID | sk116957 | | Date Created | 2017-04-18 | | Last Modified | 2023-05-03 | | Technical Level | General | ## Solution ### Introduction This article describes different scenarios for "`Connection Failed: You cannot receive an Office Mode IP address at this time. Try to connect again. If the problem persists, contact your administrator.`" message when VPN Remote Access client tries to connect to a Check Point Security Gateway / Cluster. Each scenario has its own cause and solution. See the Table of Contents below. **Table of Contents:** * Scenario 1: Both *user.def* and *ipassignment.conf* configuration files are used * Scenario 2: Standby cluster member becomes Active in a Full HA cluster * Scenario 3: Static IP Assignment via RADIUS is used * Scenario 4: Connecting to ClusterXL in Load Sharing mode with enabled CoreXL is used * Scenario 5: External DHCP server used * Related documents * Related solutions Show the Entire Article ### Scenario 1: Both *user.def* and *ipassignment.conf* configuration files are used {#Scenario 1} **Symptoms:** * "`You cannot receive an Office Mode IP address at this time`" message when VPN Remote Access client tries to connect to Security Gateway / Cluster. * Both *user.def* and *ipassignment.conf* configuration files are used. Show / Hide solution **Cause:** > * When the **`om_use_ip_per_src_range`** attribute is configured with the value "**`Exclusively`** ", the Security Gateway / Cluster will look for the user's Source IP address in the "**`user.def`** " file. If that Source IP address is not configured in the "**`user.def`**" file, then the Security Gateway / Cluster will not assign an Office Mode IP Address. > > It is preferable to use the **`ipassignment.conf`** file. **Solution:** > **The recommended way to resolve this issue is to only use the `ipassignment.conf` file.** > > To enable the use of the **`ipassignment.conf`** file (if you are migrating from the **`user.def`** file), you must modify the value of the relevant global parameter: > > 1. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, etc.). > > 2. Connect with the [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to the Security Management Server / Domain Management Server. > > 3. In the left pane, go to '`Table`' - '`Global Properties`' - '`properties`'. > > 4. In the upper right pane, click on '`firewall_properties`'. > > 5. Press CTRL+F (or go to '`Search`' menu - `Find`) - paste **`om_use_ip_per_src_range`** - click on '`Find Next`' button. > > 6. In the lower pane, right-click on the **`om_use_ip_per_src_range`** parameter - click on '`Edit...`'. > > 7. Change the current value from either "`exclusively`", or "`true`" - to "**`false`** " - click on '`OK`'. > > 8. Save the changes: '`File`' menu - click on '`Save All`'. > > 9. Close the GuiDBedit Tool. > > 10. Connect with SmartDashboard to the Security Management Server / Domain Management Server. > > 11. Install the security policy onto the relevant VPN Gateways. > > For more information, refer to *VPN Administration Guide* ([R60A](http://supportcontent.checkpoint.com/documentation_download?id=5584), [R61](http://supportcontent.checkpoint.com/documentation_download?id=6360), [R62](http://supportcontent.checkpoint.com/documentation_download?id=6823), [R65](http://supportcontent.checkpoint.com/documentation_download?id=7261), [R70](http://supportcontent.checkpoint.com/documentation_download?id=8751), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10320), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11675), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13961), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16210), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22927), [R77](http://supportcontent.checkpoint.com/documentation_download?id=24849)) - "**Configuring IP Assignment Based on Source IP Address**" ### Scenario 2: Standby cluster member becomes Active in a Full HA cluster {#Scenario 2} **Symptoms:** * "`You cannot receive an Office Mode IP address at this time`" message when VPN Remote Access client tries to connect to Full HA Cluster. * The issue only occurs when the Standby cluster member becomes Active in a Full HA cluster. Show / Hide solution **Cause:** > * There is a collision issue between the Management HA servers because both Management HA servers are in active/active state (instead of one being active and the other one standby). Consequently, no synchronization happens between them. > > In a Management High Availability environment, the license information is shared from the primary Management server to the secondary member during the sync process. If the Management servers have a sync problem, the license cannot be shared, causing the issue. **Solution:** > Resolve the collision issue between the Management HA servers by setting one of the Management servers as Backup and then synchronize the database on both Management servers. > > Once the synchronization has occurred, the license information will be shared between the two Management servers, and the VPN Remote Access clients will be able to get an Office Mode IP address. ### Scenario 3: Static IP Assignment via RADIUS is used {#Scenario 3} **Symptoms:** * "`You cannot receive an Office Mode IP address at this time`" message when VPN Remote Access client tries to connect to Security Gateway / Cluster. * *$FWDIR/log/vpnd.elg* file on Security Gateway shows: `RADIUS Account Server Cannot Be Reached. Dropping Request.` ` Login unsuccessful for {user_name}. Unable to connect to the RADIUS accounting server.` ` dhcp_bind_callback: Could not bind an IP address for user {user_name}` Show / Hide solution **Cause:** > * RADIUS server is not responding to the RADIUS Accounting request. **Solution:** > 1. In the GuiDBedit Tool, in the relevant RADIUS server object, set the value of the property **`allow_om_management`** to **`true`** per [sk105900 - Office Mode Static IP assignment via RADIUS server does not work](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105900) > > 2. In SmartDashboard, in the relevant RADIUS server object, reset the "Shared Secret". > > *Example* : > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106154/Shared_Secret1505250709.png) > 3. Install the policy onto the relevant Security Gateway / Cluster object. ### Scenario 4: Connecting to ClusterXL in Load Sharing mode with enabled CoreXL {#Scenario 4} **Symptoms:** * "`You cannot receive an Office Mode IP address at this time`" message when VPN Remote Access client tries to connect to ClusterXL in Load Sharing mode with enabled CoreXL. Show / Hide solution **Issue:** * 02500696 **Cause:** > * The DHCP Reply from DHCP Server that assigns the Office Mode IP address is sent to the DHCP-Relay address which is configured in SmartDashabord \> gateway object \> VPN Clients \> Office Mode \> "Virtual Ip address for DHCP server replies". > The "vpn decrypt" chain (refer to the output of the '`fw ctl chain`' command) translates the destination to a ClusterXL VIP address. > Then it is decided which CoreXL FW instance will handle that DHCP Reply. > > In a scenario where, according to the ClusterXL Sticky Decision Function (SDF). the packet before translation should be handled by one cluster member and the packet after translation should be handled by another member: > * One (or more) cluster member(s) will silently drop the original packet before translation on SDF. > * On the other cluster member, the packet will pass the SDF and will be translated. > However, if there is a restart of the chain because of a CoreXL decision, then it will go through SDF again, this time translated, and will be silently dropped on this cluster member as well. > > Note: There is also a mechanism after FireWall VM to pass the packet to the cluster member which made the DHCP Request, but due to this issue, the packet is dropped in ClusterXL SDF before the FireWall VM. **Solution:** > [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue. > A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. > For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and ClusterXL Members involved in the case. > > **Code was improved:** > > * The translation and CoreXL FW instance decision was moved from "`vpn decrypt`" chain to "`vpn multik forward`" chain (refer to the output of the '`fw ctl chain`' command), which is located before the ClusterXL SDF. > > * The new behavior is enabled by default and can be controlled by the kernel parameter **`vpnk_multik_enable_forwarding`**: > > |-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Value of kernel parameter | Behavior of ClusterXL | > | *vpnk_multik_enable_forwarding=1* | Default. The translation and CoreXL FW instance decision will be performed in the "`vpn multik forward`" chain. | > | *vpnk_multik_enable_forwarding=0* | Previous behavior. The "`vpn multik forward`" chain is skipped. The translation and CoreXL FW instance decision will be performed in the "`vpn decrypt`" chain. | > > **Hotfix installation instructions:** > > 1. Hotfix has to be installed on ***Security Gateway***. > > **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. > 2. Procedure: > > * Using CPUSE - On Security Gateway running Gaia OS R75.40 and higher: > > Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New). > > Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): > * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* > * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* > > You can also use the [sk111158 - Central Deployment Tool (CDT)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158) to install this hotfix on Security Gateways. > > **Note:** Reboot is required. > * Using Legacy CLI - On VSX Gateway running Gaia OS R75.40VS and higher; On Security Gateway running SecurePlatform/XOS/IPSO OS: > > Note: On these versions of VSX, the Gaia CPUSE does not support installation of hotfixes (refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#System requirements and limitations) - section "(2)" - "VSX Gateways"). > 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). > > 2. Unpack and install the hotfix package: > > ***\[Expert@HostName\]# cd /some_path_to_fix/*** > ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** > ***\[Expert@HostName\]# ./fw1_wrapper_\*** > **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. > 3. Reboot the machine. ### Scenario 5: External DHCP server is used {#Scenario 5} **Symptoms:** * "`You cannot receive an Office Mode IP address at this time`" message when VPN Remote Access client tries to connect to Security Gateway / Cluster. Show / Hide solution **Cause:** > * DHCP server has no available IP addresses to offer **Solution:** > 1. Clear out stale entries on the third party DHCP server Related documents * VPN Administration Guide ([R60A](http://supportcontent.checkpoint.com/documentation_download?id=5584), [R61](http://supportcontent.checkpoint.com/documentation_download?id=6360), [R62](http://supportcontent.checkpoint.com/documentation_download?id=6823), [R65](http://supportcontent.checkpoint.com/documentation_download?id=7261), [R70](http://supportcontent.checkpoint.com/documentation_download?id=8751), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10320), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11675), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13961), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16210), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22927), [R77](http://supportcontent.checkpoint.com/documentation_download?id=24849)) ### Related solutions {#Related solutions} * [sk44559 - DHCP Discover packets are dropped by Satellite Gateway in Star community after VPN is established](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk44559) * [sk105900 - Office Mode Static IP assignment via RADIUS server does not work](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105900) * [sk92503 - CPSB-SSLVPN-5000 license does not allow Check Point Mobile for Windows to connect](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92503) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content