> Source: [sk120652](https://support.checkpoint.com/results/sk/sk120652)

# sk120652 - "You cannot receive an office Mode IP address because the security gateway does not have a license for Office mode" error on SSL Remote Access VPN client that tries to connect to a Cluster

| Property | Value |
|----------|-------|
| Solution ID | sk120652 |
| Date Created | 2017-10-12 |
| Last Modified | 2025-11-04 |
| Technical Level | General |
| Products | Security Gateway, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, E89.X, E88.X |

## Symptoms

- * Connection from SNX client / Capsule VPN client / Capsule Connect client / Endpoint Connect client to the VPN Cluster in High Availability mode fails with the error:  

  `You cannot receive an office Mode IP address because the security gateway does not have a license for Office mode. Contact your administrator.`

* Restarting Check Point services ("`cpstop;cpstart`", reboot) on the Active cluster member resolves the issue until a fail-over occurs from the current Active cluster member to the Standby cluster member.

* Debug of VPND daemon (per [sk89940](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk89940)) on the Active cluster member shows that the number of "`snx_users`" is negative:  

  `available_om_licenses: number of connected users: om_users `*XX* `, snx_users `**-*YY***`, l2tp_users 0`

* when a connection to the active member succeeds, kernel debug ('`fw ctl debug -m VPN + warn`') on the Standby cluster member shows:  

  `;sslt_om_ip_params_post_sync: ERROR: Wrong # of vals XX;`

* All licenses are valid and attached correctly to the Cluster Members.

## Cause

Each time a Remote Access VPN client (SNX client / Capsule VPN client / Capsule Connect client / Endpoint Connect client) connects in SSL mode to a Cluster, its connection is synchronized to the Standby cluster member, but the counter of SSL users is not increased on the the Standby cluster member. However, when an SSL user disconnects, the counter of SSL users on the Standby cluster member is decreased.  
Eventually, this leads to a wrong (negative) license count on the the Standby cluster member.  
The issue becomes apparent after a failover from the current Active cluster member (that held the correct number of SSL users) to the Standby cluster member (on which the number of SSL users was not updated correctly).

## Solution

This problem was fixed. The fix is included in:

* [Check Point R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485)
* [Jumbo Hotfix Accumulator for R80.10 (R80_10_jumbo_hf)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) from Take 142
* [Jumbo Hotfix Accumulator for R77.30 (R77_30_jumbo_hf)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) from Take 331

Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content