Hi halijenn,

Thank you for respond. Followed your instruction, I did it again this morning, but it doesn't work, still the same....

I enabled DHCP address looking in address assignment, and configured my own DHCP server 10.100.100.1(ping test OK), added NT domain authentication server both in Configuration | System | Servers | Authentication and Configuration | User Management | Groups | highlight the specific group | click "Authentication Sever" button and add DHCP server 10.100.100.1(authentication test successful) - frankly speaking, I don't think I need to set it the first "global" one. Last, I wanted to give DHCP Network Scope as 10.100.100.0/25 in my group, but it wouldn't take it, so I gave 10.100.100.0, but VPN client couldn't get IP (error 427). Then I tried IP local pool assignment as you mentioned ( I also tried yesterday), VPN client will get IP address in this range(10.100.100.155/8), but it can't get correct gateway/subnet mask from my DHCP server.

SO, NT authentication is GOOD, for some reason, IP/gateway/subnet mask can't be passed from DHCP server!

There are some configs(DHCP option and Subnet mask) under GROUP Client Config tab, do I need to configure there? thanks!

Looks like you are trying to assign ip address via the authentication server, not DHCP server.

In this case, you would need to enable the following:

Configuration | System | Address Management | Assignment | enable "Use Address from Authentication Server"

Default gateway on the vpn client really wouldn't make any difference because all traffic will be sent towards the VPN Concentrator headend, and it depends on what is configured on the VPN Concentrator routing table to send it across internally. What is important is the subnet mask assigned to the vpn client because potentially if the mask covers your internal subnets as well, then vpn client will try to ARP for it since they are in the same subnet when trying to access those internal resources.

Hi Halijenn,

Thanks. My authentication server is NT domain controller also the DHCP server. I checked Auth server, DHCP and Address pool, but still the same.

Right now, the only way to let vpn client get IP is to add group address pool, but IP subnet will be /8 instead of /25 what I wanted and where servers are.

temporary fix - assign IP from group address pool (the same segment with private interface), define different segment to different routes. no DHCP is in use at this moment.