VPN issues

I'm having the same issues with connecting to my wife's company's VPN.  I thought I'd be able to get away from Spectrum, but T-Mobile doesn't like like a viable solution - despite significant efforts on my part to make it work.

About three weeks ago, I tried connecting to T-Mobile. Initial attempts in connecting to T-Mobile weren't good - and I was only able to achieve download speeds of 15 mbps.  I called their technical support and found they were having tower/equipment issues - and had been for about 3 weeks - with no anticipated date for repair.  I put back the Spectrum service and told them I'd try it again when they had their equipment issues fixed.

ON 2/1, I re-installed the T-Mobile Gateway equipment - NOKIA 5G21 GATEWAY: T-MOBILE HOME INTERNET and connected T-Mobile Gateway via Cat 5 ethernet directly to my TP-Link Archer AX11000 wireless router.  I did repeated internet bandwidth testing using Speedtest - both through my computer's Chrome browser, and through the TP-link app - directly from the wireless router.   I wasn't having any issues with any of my internet-based usage and needs -   achieving download speed ranging on the low-end from 50 Mbps to 110 Mbps. We can stream 4K programming to our TV's, monitor outdoor 1080p security cameras, conduct video conferences, and all of the normal data applications and downloads. 

Using a Cisco AnyConnect VPN is a WHOLE DIFFERENT STORY.  It DOESN'T WORK with T-Mobile. As soon as I connect to the VPN, my internet speed/bandwdth is non-existent and I can't access any of the company systems.  Beginning on Friday, I spent two days troubleshooting the issue.  In every case, I would have connection bandwidth speeds between 50 Mbps to 110 Mbps on all of my devices - including the computer I need to connect to the VPN.  With my first attempt, I used Speedtest on two successive runs, with upload speeds were 15 and download speeds were 49 and 72.  Next, I successfully connected to the company VPN  (IPsec) IPv4) , ran Speedtest, and received 10 down and 1 up, and then 6 down and 10 up.  I simultaneously ran the TP-Link Speedtest app and received 86 down and 7 up.  I disconnected from the company VPN, and recorded speeds of 70 Mbps. 

Later on in the evening, we ran more comparative tests and the results were even more disconcerting.  The T-Mobile speeds in general were lower - averaging about 50 down and 8 up - as measured both on my wife's computer through her Chrome browser using Speedtest prior to VPN connection and independently on my TP app also using Speedtest.  However, once connected to the VPN, opening the Chrome browser and attempting to run Speedtest, I couldn't even get the Speedtest to run - receiving "Download Test Error". 

The company's IT Director took the computer home over the weekend to troubleshoot it in his home environment with Spectrum.  He had no problem connecting through the VPN, and recorded speeds in excess of 70Mbps.

This evening, I again attempted to connect to the VPN, and had the same results.  After a 2 hour wait to get T-Mobile support, I had a nice support rep who simply took down my information, created a trouble ticket, and said someone will get back to my in 24 - 48 hours.  After reading all of the other people who are having the same issues, and having no addressable solution, I placed an order for Spectrum to have my service restored.

This is what support sent me.  Sent it to my IT to see if Cisco Any connect supports this.  My IT is not willing to enable IPv6 due to extra maintaince and security patching.  No T-Mobile for me.

There are no known issues with VPNs and how they interact with the T-Mobile network to provide internet service. There may be an underlying factor (that can only be addressed by the owner of that VPN client) where there is a need to have ipv4 and ipv6 double stacked into the setup configuration to avoid any service issues. Please have the customer reach out to their VPN client support to check if this is indeed the configuration being used and to also further troubleshoot the VPN issue.   Failed outbound VPN connection is caused by a known carrier grade NAT issue relating to T-Mobile's implementation a fully IPv6 network and the implementation of 464XLAT, NAT64, and DNS64 for accessing IPv4 resources. The customer's VPN or VPN server they are connecting to is not properly configured to work with an IPv6 network. This is a third party issue that T-Mobile cannot help with.Thanks for being best part of T-MobileBest Regards!

This is the response I got back from them…."This is the workaround engineering has provided to us. We only use IPv6. This is a known pain point that is currently under review. There currently is nothing to escalate"

Mine was just the MTU issue, was able to resolve it by lowering the number. If this blog can be helpful for anyone to troubleshoot and resolve the issue:
https://amithkumarg.medium.com/resolved-t-mobile-home-internet-vpn-issue-2f5ca594c23e

Update: They did in fact end up rolling my firmware back and it is working again.

@FlyingDog For sure the performance is worse when connected to the VPN.  The previous several months this was always the case for me, I'd get about a 10-fold reduction in download speed and there was always massive latency.

I read somewhere that turning off IPV6 could solve the issue. Having said that, configuring IPv6 is not an option on the router settings. Not from the app. Not from the router's webpage. 

Some troubleshooting info for folks: I had to swap from WireGuard to OpenVPN, had to swap from a UDP to a TCP connection type and I was able to get my VPN to function.

Got my gateway 3 days ago. No success accessing my employer VPN either. I will call IT and TMO support, but it seems Comcast is very happy right now...

I too am having this issue with the Grey T-Mobile Gateway and GlobalProtect. I live out in the middle of nowhere so we don't have any other real high speed options by any definition of the word. It is very unfortunate that when I finally sign up for a real high speed option, it doesn't work with my company's VPN. My company won't change anything since I am 1 case in about 8000 employees so I hope there will be a fix soon from T-Mobile.

Honestly though, I can't imagine their QA team did enough testing before releasing this product. They have to have known that people would intend to work on this network through a VPN. 

msyed wrote:

Looks like nobody here has been able to resolve this issue. Has anyone's IT department been able to get this thing working?

I have the same issue with following configuration:

• Gateway Nok 5g21 Grey
• VPN Client: GlobalProtect by Palo Alto

My VPN is able to connect but connection to any work related resources (websites, servers, etc) fail. While on VPN, things that do work though: I do get a decent speed using googles speed test, non-work websites, Microsoft teams.

Same VPN works perfect on cellular hotspot using T-mobile’s network.

If this doesn’t get resolved, I might cancel t-mobile home internet.

 

I'm about to make your day. You ready? There's a solution! Check out this reddit post: https://www.reddit.com/r/tmobileisp/comments/lw75ul/0168_firmware_update_has_fixed_my_cisco/

This solution worked for me with GlobalProtect and has been working perfectly since. You're welcome! :)