Move DHCP Server for SSL VPN (with Edge Client) to an internal MS DHCP via iAPP

Question

Dear all,&nbsp;we have a working SSL VPN configured via Big IP Edge Client, DHCP Server is running on the F5 APM. Nowwe have to move the DHCP Server to the internal MS DHCP Service and installed a iAPP (APM_DHCP.app) as a Relay Agent.We see the Discover on the DHCP Server and the offer from the DHCP Server with the IP form the correct range. But after the clienttried to get the offered IP (request) the DHCP Server sends a "NAK" and declined it. We see nothign in the DHCP logs why. Also th debug on the F5 Applainces shows no further info for me why this happens.Also the Wirehark trace shows the NAk by the DHCP Server but we have no clue why. I have also wireshark traces but can not find a reason for the NAK because all shows find before.&nbsp;Maybe any help on this?Thanks an regardsMartin&nbsp;&nbsp;&nbsp;DEBUG ont he F5 BIG-IP Console:13:25:11.114924 00:1d:d8:e4:22:12 &gt; 00:09:0f:09:00:04, ethertype 802.1Q (0x8100), length 364: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 45001, offset 0, flags [DF], proto UDP (17), length 326)&nbsp;&nbsp;&nbsp; 10.8.5.25.18839 &gt; 10.129.5.40.bootps: [bad udp cksum 0x200d -&gt; 0xb86a!] BOOTP/DHCP, Request, length 298, htype 20, hlen 4, hops 1, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Discover&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-Class Option 60, length 6: "f5-APM"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MSZ Option 57, length 2: 1344&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 4294967295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 out slot1/tmm6 lis=13:25:11.117660 00:09:0f:09:00:04 &gt; 00:1d:d8:e4:22:12, ethertype 802.1Q (0x8100), length 376: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 124, id 19, offset 0, flags [none], proto UDP (17), length 338)&nbsp;&nbsp;&nbsp; 10.129.5.40.bootps &gt; 10.6.8.10.bootps: [udp sum ok] BOOTP/DHCP, Reply, length 310, htype 20, hlen 4, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Your-IP 10.6.8.16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-IP 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Offer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Subnet-Mask Option 1, length 4: 255.255.255.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RN Option 58, length 4: 43200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RB Option 59, length 4: 75600&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 86400&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 in slot1/tmm0 lis=13:25:11.119743 00:1d:d8:e4:22:12 &gt; 00:09:0f:09:00:04, ethertype 802.1Q (0x8100), length 413: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 3103, offset 0, flags [DF], proto UDP (17), length 338)&nbsp;&nbsp;&nbsp; 10.6.8.10.bootps &gt; 10.129.5.40.bootps: [bad udp cksum 0x2308 -&gt; 0x292e!] BOOTP/DHCP, Request, length 310, htype 20, hlen 16, hops 1, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Request&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Requested-IP Option 50, length 4: 10.6.8.16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-Class Option 60, length 6: "f5-APM"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MSZ Option 57, length 2: 1344&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 4294967295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 out slot1/tmm0 lis=/Common/APM_DHCP.app/__DHCP-for-APM-013:25:11.121173 00:09:0f:09:00:04 &gt; 00:1d:d8:e4:22:12, ethertype 802.1Q (0x8100), length 366: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 124, id 20, offset 0, flags [none], proto UDP (17), length 328)&nbsp;&nbsp;&nbsp; 10.129.5.40.bootps &gt; 10.6.8.10.bootps: [udp sum ok] BOOTP/DHCP, Reply, length 300, htype 20, hlen 16, xid 0x6715d734, Flags [Broadcast] (0x8000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: NACK&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40 in slot1/tmm0 lis=&nbsp;

alexbct · Answer

Hi Martin, &nbsp;The problem you are describing sounds a lot like this one: https://social.technet.microsoft.com/Forums/en-US/20e50652-5a19-4dee-a6af-4c09f3fcfd1b/windows-dhcp-server-replying-with-dhcp-nak-rfc3527-link-selection-suboption?forum=winserveripamdhcpdns &nbsp;There is a solution discussed about halfway down the page (creating an addtional DHCP scope and then excluding it) &nbsp;Would that help?

Forum Discussion

Move DHCP Server for SSL VPN (with Edge Client) to an internal MS DHCP via iAPP

1 Reply

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

F5Access | MacOS Sonoma

Transaction looks successful but file not downloading

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

Related Content

2 internal server vlans

After applied ASM Policy to Virtual Server, connections will reset with Internal error in log

Use BIG-IP LTM Virtual Server & iRule for an internal "What's My IP" website

ADFS WAP servers failed to establish trust with ADFS 2019 servers using internal vip

Passing Client CAC / Smart Card Cert to Application Server