Clients are not getting ip address on radius based SSID authentication in one site only

[Devendra]

We have one remote location sectup like our other locations, where we have extreme AP250 on ExtremeCloudIQ, and setup 2 SSID one is guest which uses password based authentication and other is radius based authentication. 

The guest one is working fine, the issue with radius one is that , after the authentication is successfully the clients are not getting the ip address from the DHCP server, on portal troubleshooting page , we keep seeing this message "DHCP server sent out DHCP OFFER message to station" but clients never get the ip address. 
No issue with the configuration and vlan tagging all is fine.

Any one quickly here to suggest , what could be the wrong here

[Adam_Minowski]

Do you use firewall policy on user profile to which your client goes after radius auth? 

[Devendra]

Hi Adam, on the user profile firewall policy all traffic is allowed on outbound rules and there is no rules setup for inbound  and permitted.

[Jordan]

What does the vlan probe option show for the vlan in question, does it get a DHCP offer?
(Select AP -> Utilities -> Tools -> VLAN Probe)

Is DHCP server on the vlan in question? If not Is IP helper configured to relay the requests to it?