The problem is that this option is on the ‘3 rd Party Configuration’ tab, which is normally not shown when the ClusterXL option is selected (which is normally the case for a cluster).To enable the ‘3 rd Party configuration’ tab you have to uncheck ClusterXL in General Properties of the cluster. The returned DHCP packet will come from the cluster IP address and will be blocked as not statefull by the Microsoft Firewall running on the client.To correct this issue the option ‘Hide Cluster Members’ outgoing traffic behind the cluster’s IP Address’ needs to be unchecked. Microsoft Windows clients this “can” cause problems if the client is running Microsoft Firewall or similar. When the firewall needs to work as a DHCP relay for e.g. I don't see a lot of this traffic in the tracker either, but I can see it in FW MONITOR and zdebug. My rulebase is using the new dhcp-request and dhcp-reply services as per the above document. I've gone through SK104114 - Configuration of IPv4 BOOTP/DHCP Relay using new services and configured everything as instructed.

It kind of looks like the NAT rule is being ignored when its DHCP. I have a NAT rule in place to keep the packets at their original addresses, but it seems to come out as the public IP, which is the final NAT rule. The capture on the VPN server shows the DHCP offer coming from an incorrect IP - its coming from the public internet IP of my firewall instead of the DHCP server address. Wireshark packet captures on the DHCP server show the request coming in and a proper response going back out.

I am unable to receive DHCP offers from the DHCP Server. The VPN server acts as the DHCP relay for its clients and uses the same DMZ DHCP server to service its clients. The problem is I have a new 3rd party VPN application. I have a half dozen subnets that have the firewall as their default gateway, and the firewall acts as the DHCP relay for them, with the DHCP Server being located in a DMZ zone. I am having issues getting DHCP relay to work through my R77.30 security management and gateway cluster.

Checkpoint vpn client r77.30