GlobalProtect VPN not working with T-Mobile

SOLVED! After days with my IT department and then with Global Protect in Pali Alto, here's the bottom line. T-Mobile High speed broadband can't handle IPv6 dynamic IPs therefore can't communicate in internet. Global Protect can only handle IPv4.

There are no settings on T-Mobile gate way to make it just use IPv4.
Global Protect doesn’t have a fix/VON software to fix this advanced IPv6 communication 

I can access my company's server for data files, outlook for email etc, but cannot access internet based apps like one login or any websites. Except MSN.com - explain that. Not even Google. Com.

Have to switch to my Verizon cell data hotspot to my company laptop to access internet. Then switch back to T-mobile when done with internet  

T-Mobile is using advanced technology that companies are not ready to handle, and will take them a long time to become compatible.

Since most users don't have IOv6, there's no rush to upgrade corporately. For example, they advise that all the scanner guns in our warehouse aren't compatible with IPv6, so if they upgrade VPNs now, none of the equipment would work in the warehouse.

Nor are VPN providers putting resources into IPv6 compatibility.

im so annoyed that I switched to the T-Mobile high speed broadband new technology that NO ONE at T-Mobile advised this would be an issue. Even calling tech support, they had no idea what the issue would be. After my IT department figured it out I HAD TO CALL BACK T-MOBILE AND BRUNG THEM UP TO SPEED.  Am I in the twilight zone? Ridiculous 

So much for all this infrastructure across the US. If we get this new technology, then can't connect with old technology being used by 99% of corporations, then we're screwed until they decide to upgrade.

How can this be such a mystery in 2021. IPv6 has been in development for more than 10 years.  WHAT's the holdup and lack of warning of the issue.

So annoyed that I switched to this with no heads up. I'm screwed now unless I switch back to my unreliable Cox cable internet that had service outages at least twice a week while I've been working from home.

Just got my new T Mobile gateway and set it up.  Exact same issue with exact same VPN.  Nothing works on it!

I can confirm that lowering MTU worked for me. I set it to 1300. 

Well looks like two years later and this is still an issue…

Tried calling T-Mobile tech support and they couldn't downgrade or upgrade my firmware. So they put in a ticket to engineering. Fingers crossed. 

No luck so far.  I even had T-Mobile roll back the version of my gateway's firmware, because I had heard that fixed the problem for some people.  The service rep said he couldn't do it, but when I said I needed to cancel my service then, suddenly it became possible.  It did get a little better, some web pages eventually load, but it's still not usable.

I have one last thing to try.  There are some people who say lowering the MTU setting for globalprotect to 1350 or less might solve the issue.  I doubt it will work, but I'm going to try it.  I don't have access to do it myself, but I'll try to get the IT guys to do it when I'm in the office on Tuesday.  If you have admin access on your machine you can try it yourself:

netsh int ipv4 set subinterface “Ethernet 2” mtu=1350

Replace “Ethernet 2” (keep the quotes) with whatever name your computer uses for the globalprotect virtual interface in ipconfig.

Also confirmed reducing MTU value in netsh configuration resolved GlobalProtect VPN issue for Windows 10. 

NOTE: You need root/admin access to be able to change it through command line.

1. While connected to VPN, open a Command Prompt CMD (Right Click CMD -> Run Ad Administrator)

2. To verify your Virtual Ethernet Adapter Interface, Type the following:

netsh interface ipv4 show subinterfaces

Change Windows MTU Size

3. As mentioned on the above replies. credit Rich T, Type the following: 

netsh int ipv4 set subinterface “Ethernet 2” mtu=1300 store=persistent

Replace “Ethernet 2” (keep the quotes) with whatever name your computer uses for the globalprotect virtual interface in ipconfig.

4. Test your sites

Browse some Corp and Internet sites while connected to the VPN.

Note: You may have to restart your VPN connection by disconnecting and reconnecting. 

Allso ref: https://amithkumarg.medium.com/resolved-t-mobile-home-internet-vpn-issue-2f5ca594c23e

Fixed immediately … T-Mobile tech rep advised they need to downgrade my gateway firmware and they set to stop automatic update to prevent reverting to the update. Fixed it immediately. Unreal that he was only T-Mobile rep who had this knowledge,

needed to downgrade to ..,,168 from ..,178

see below 

WRONG;

Correct firmware version:

Hey all,

Same problem as most, wife’s now WFH and her work laptop’s VPN GlobalProtect would conectar, but upon connecting, she couldn't actually access any sites.   And her work was unwilling to make the MTU adjustment.

Called T-Mobile Home Internet Tech Support at 844-275-9310, tonight on Sept 2nd 2021.  After a decent hold time, the representative got on the line, told him we had the GlobalProtect conflict, and he seemed to know immediately what to do.

Interesting part is I asked him what they were going to do, and he said they would NOT roll back to .168.  Instead, he said T-Mobile has recognized they had issues with not only GlobalProtect but also other VPNs (believe he mentioned Cisco), and so their engineers have been working on it. 

He then remotely put our router on version 1.2101.00.1609.  (before the call we were on .0178). My wife then got on GlobalProtect, tested all her apps, and at least with a few minutes of testing everything seems to be working well now. 

Thanks for everyone who posted info about this problem on this thread.  **hopefully** it's fixed now with this .1609 update that we just got.  A few more days' testing time will conclude one way or the other.

I was able to find a fix for my VPN. I have GlobalProtect VPN for my work. I was having trouble accessing my work network other than email and Teams. I have a router. I went in and turned on my VPN on my router, which is a no brainer. I also switched my IPv6 from disable to passthrough and my VPN works now. Has been for a while. It is a little slower but not much. Try the pass through on the IPv6 and see if it helps. It helped me. 

Not sure if other people continue to have this issue, but I moved to T-mobile a couple months ago, and it has been a nightmare with Global Protect.

Just called T support, and they said they cannot do the ipv6 fix or the firmware update, which doesn't make any sense to me. They even refused to check this thread and see the solutions that were already mentioned.

My last chance is trying to get the fix with my employer IT support making the adjustments on the MTU.

Did someone had any other solutions more recently? Or found a way to update firmware version without having to go through T-mobile support?