Move DHCP Server for SSL VPN (with Edge Client) to an internal MS DHCP via iAPP

Question

Dear all,&nbsp;we have a working SSL VPN configured via Big IP Edge Client, DHCP Server is running on the F5 APM. Nowwe have to move the DHCP Server to the internal MS DHCP Service and installed a iAPP (APM_DHCP.app) as a Relay Agent.We see the Discover on the DHCP Server and the offer from the DHCP Server with the IP form the correct range. But after the clienttried to get the offered IP (request) the DHCP Server sends a "NAK" and declined it. We see nothign in the DHCP logs why. Also th debug on the F5 Applainces shows no further info for me why this happens.Also the Wirehark trace shows the NAk by the DHCP Server but we have no clue why. I have also wireshark traces but can not find a reason for the NAK because all shows find before.&nbsp;Maybe any help on this?Thanks an regardsMartin&nbsp;&nbsp;&nbsp;DEBUG ont he F5 BIG-IP Console:13:25:11.114924 00:1d:d8:e4:22:12 &gt; 00:09:0f:09:00:04, ethertype 802.1Q (0x8100), length 364: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 45001, offset 0, flags [DF], proto UDP (17), length 326)&nbsp;&nbsp;&nbsp; 10.8.5.25.18839 &gt; 10.129.5.40.bootps: [bad udp cksum 0x200d -&gt; 0xb86a!] BOOTP/DHCP, Request, length 298, htype 20, hlen 4, hops 1, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Discover&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-Class Option 60, length 6: "f5-APM"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MSZ Option 57, length 2: 1344&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 4294967295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 out slot1/tmm6 lis=13:25:11.117660 00:09:0f:09:00:04 &gt; 00:1d:d8:e4:22:12, ethertype 802.1Q (0x8100), length 376: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 124, id 19, offset 0, flags [none], proto UDP (17), length 338)&nbsp;&nbsp;&nbsp; 10.129.5.40.bootps &gt; 10.6.8.10.bootps: [udp sum ok] BOOTP/DHCP, Reply, length 310, htype 20, hlen 4, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Your-IP 10.6.8.16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-IP 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Offer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Subnet-Mask Option 1, length 4: 255.255.255.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RN Option 58, length 4: 43200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RB Option 59, length 4: 75600&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 86400&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 in slot1/tmm0 lis=13:25:11.119743 00:1d:d8:e4:22:12 &gt; 00:09:0f:09:00:04, ethertype 802.1Q (0x8100), length 413: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 3103, offset 0, flags [DF], proto UDP (17), length 338)&nbsp;&nbsp;&nbsp; 10.6.8.10.bootps &gt; 10.129.5.40.bootps: [bad udp cksum 0x2308 -&gt; 0x292e!] BOOTP/DHCP, Request, length 310, htype 20, hlen 16, hops 1, xid 0x6715d734, Flags [none] (0x0000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: Request&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Requested-IP Option 50, length 4: 10.6.8.16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-Class Option 60, length 6: "f5-APM"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MSZ Option 57, length 2: 1344&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lease-Time Option 51, length 4: 4294967295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Agent-Information Option 82, length 34:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Circuit-ID SubOption 1, length 12: 83.x.x.x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Remote-ID SubOption 2, length 18: 84.167.6.206:51076 out slot1/tmm0 lis=/Common/APM_DHCP.app/__DHCP-for-APM-013:25:11.121173 00:09:0f:09:00:04 &gt; 00:1d:d8:e4:22:12, ethertype 802.1Q (0x8100), length 366: vlan 805, p 0, ethertype IPv4, (tos 0x0, ttl 124, id 20, offset 0, flags [none], proto UDP (17), length 328)&nbsp;&nbsp;&nbsp; 10.129.5.40.bootps &gt; 10.6.8.10.bootps: [udp sum ok] BOOTP/DHCP, Reply, length 300, htype 20, hlen 16, xid 0x6715d734, Flags [Broadcast] (0x8000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Gateway-IP 10.6.8.10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vendor-rfc1048 Extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Magic Cookie 0x63825363&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DHCP-Message Option 53, length 1: NACK&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server-ID Option 54, length 4: 10.129.5.40 in slot1/tmm0 lis=&nbsp;

alexbct · Answer

Hi Martin, &nbsp;The problem you are describing sounds a lot like this one: https://social.technet.microsoft.com/Forums/en-US/20e50652-5a19-4dee-a6af-4c09f3fcfd1b/windows-dhcp-server-replying-with-dhcp-nak-rfc3527-link-selection-suboption?forum=winserveripamdhcpdns &nbsp;There is a solution discussed about halfway down the page (creating an addtional DHCP scope and then excluding it) &nbsp;Would that help?

Forum Discussion

Move DHCP Server for SSL VPN (with Edge Client) to an internal MS DHCP via iAPP

1 Reply

Welcome! a la Communidad DevCentral LATAM de F5!

The New F5 Certified BIG-IP Administrator Certification Exams Now Live

Recent Discussions

Issue on connection limit

F5 Distributed Cloud Services Simulator Connect

Wireshark Plugin for TLS

F5 CIS -> NGINX Plus Ingress Controller Integration

Catch Dynamic CRL Errors and Return Friendly Page

Related Content

2 internal server vlans

BIGIP Next - SHARED-00001: Internal server error

F5 MCP(Model Context Protocol) Server

Client vs Server SSL profile

Use BIG-IP LTM Virtual Server & iRule for an internal "What's My IP" website

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS