GlobalProtect VPN not working with T-Mobile

pcguy63 wrote:

The users at my work are having the issue too with their hotspots and Global Protect.

Our fix is to set their MTU for their GP connection to 1300 and then set their IPv6 to link-local only for their Wifi’s TCP/IP setting.

Not a great fix. If a user reboots they have to run the command to reset their MTU to 1300 again…... if they had admin/sudo access.

Are your users having initial connection problems or issues accessing resources after connecting?

Gracias

emailtoashah wrote:

I am using the global protect and having the same issue with T - Mobile hotspot on my work mac. 

I am using GP 6.3.0-33 version. It used to work in some areas when I was traveling but now I am home and it doesn't work at all. 

 

Any help from T-Mobile team is appreciated.

 

Ankit Shah

I am in the same situation and I know Tmobile has a way to resolve it.

First, my home has TWO Tmobile Home Internet gateways, different models

A few months back, connecting to work with Global Protect worked but then I could not access any work resources… Strange, disconnect, reconnect, same issue.  So then I connect to the other gateway and connect to GP, everything works, as it should.

Took quite a bit of time to verify that I can reproduce the issue at will and that using the other gateway works every time.

With the information I gathered I contacted Tmobile and filed a trouble ticket, and of course it was after hours for the Telecom Engineers so they told me to call back the next day and they would have notes in my case and would connect me to a higher tier support to work on the issue.

Next day, mmm, everything is working as it should.

Now, here we are a few months later and it happened again last weekend, I just used the other gateway as I needed to get in and do some work via Global Protect.

NOW, tonight. . . BOTH gateways have the same issue, connect to Global Protect and I can ping lots of stuff at work, but RDP and every web application fails to connect.

But if I use my hotspot on my AT&T phone, works perfectly...

Tmobile makes it very hard to report these kinds of issues when I am willing to go out of my way to collect details and information AND I am the one who can (if really needed) make configuration changes to the Global Protect Gateway.

Tmobile - are you there?

This is the kind of thing that makes people jump ship.

I need to be able to work remotely, now more than ever and if this keeps happening I will find a more reliable source of internet.

The mtu and ipv6 change I mentioned earlier works for TMobile Internet users but trying to use my TMobile Hotspot on my Android and can't get Global Protect to work properly. No network connectivity at all. With GP, wifi works fine but can't connect to work.

I am using the global protect and having the same issue with T - Mobile hotspot on my work mac. 

I am using GP 6.3.0-33 version. It used to work in some areas when I was traveling but now I am home and it doesn't work at all. 

Any help from T-Mobile team is appreciated.

Ankit Shah

The users at my work are having the issue too with their hotspots and Global Protect.

Our fix is to set their MTU for their GP connection to 1300 and then set their IPv6 to link-local only for their Wifi’s TCP/IP setting.

Not a great fix. If a user reboots they have to run the command to reset their MTU to 1300 again…... if they had admin/sudo access.

I had the same problem with my T-Mobile hot-spot feature on iPhone. I assume it's similar to T-Mobile home internet since they both operate off 5G. After many months of futile attempts at trying to find a fix, I found this workaround resolved it for me on MacOS.

https://live.paloaltonetworks.com/t5/globalprotect-discussions/cannot-connect-to-globalprotect-from-hotspot/m-p/577422#M4976

 

As a workaround, change your WiFi interface to a static IP with a netmask that isn't /32:
Something like:
networksetup -setmanual Wi-Fi 172.20.10.3 255.255.255.240 172.20.10.1

 

And when you disconnect from your hotspot and reconnect to regular wifi you would need to revert with:
networksetup -setdhcp Wi-Fi

SaulGC wrote:

RonDLS wrote:

SaulGC wrote:

Got my Tmobile Home Internet yesterday and having same issue, will call Tmobile to rollback the firmware for Global VPN fix. Any issues on network speed by rolling back the firmware?

No need to rollback. Update to the latest 1609 version instead.

Yes, called Tmobile and updated my firmware to .1609 and Global VPN works now.
But I do notice that my speed is reduced when connected to the Global VPN, download speed reduces by a factor 2x and upload speed reduces by a factor of 10x. So when working on my remote desktop through VPN connection it is choppy/laggy.
Hoping this is a temporary issue hate to switch back to spectrum as Tmobile is faster and cheaper.  

So anything that's a live app through the tunnel will be like that cause of the translations needed to take place it cause some packet loss in the process

By the way solved means you have a solution to the problem not that you finally figured out what the problem actually is

KnappTime2515 wrote:

SOLVED! After days with my IT department and then with Global Protect in Pali Alto, here's the bottom line. T-Mobile High speed broadband can't handle IPv6 dynamic IPs therefore can't communicate in internet. Global Protect can only handle IPv4.

There are no settings on T-Mobile gate way to make it just use IPv4.
Global Protect doesn’t have a fix/VON software to fix this advanced IPv6 communication 

I can access my company's server for data files, outlook for email etc, but cannot access internet based apps like one login or any websites. Except MSN.com - explain that. Not even Google. Com.

Have to switch to my Verizon cell data hotspot to my company laptop to access internet. Then switch back to T-mobile when done with internet  

T-Mobile is using advanced technology that companies are not ready to handle, and will take them a long time to become compatible.

Since most users don't have IOv6, there's no rush to upgrade corporately. For example, they advise that all the scanner guns in our warehouse aren't compatible with IPv6, so if they upgrade VPNs now, none of the equipment would work in the warehouse.

Nor are VPN providers putting resources into IPv6 compatibility.

im so annoyed that I switched to the T-Mobile high speed broadband new technology that NO ONE at T-Mobile advised this would be an issue. Even calling tech support, they had no idea what the issue would be. After my IT department figured it out I HAD TO CALL BACK T-MOBILE AND BRUNG THEM UP TO SPEED.  Am I in the twilight zone? Ridiculous 

So much for all this infrastructure across the US. If we get this new technology, then can't connect with old technology being used by 99% of corporations, then we're screwed until they decide to upgrade.

How can this be such a mystery in 2021. IPv6 has been in development for more than 10 years.  WHAT's the holdup and lack of warning of the issue.

So annoyed that I switched to this with no heads up. I'm screwed now unless I switch back to my unreliable Cox cable internet that had service outages at least twice a week while I've been working from home.   

 

T this is the same problem my wife and I agree having cause her job is such in three past and using global protect which doesn't support the new thing and there's no way we're going back to Cox (suckers) as I call them. Over charging me for service they cuts out and is never the speed I pay for.  We to have Verizon phones but at our house it's LTE and with 1 bar if we're lucky.  TMobile out the box in a bag signal location was 50 mbps better then both of them.  It says that you can set up VPN  on the TMobile router I just want to know is a specific VPN does it have NAT or dual stack capabilities? I know proton VPN does

I got the router replaced to the Arcadyan one last week Thursday and did not have any issues connecting to work VPN from home so far.

When I had the Sagemcom router, I noticed that I had connectivity issues at home mostly on the day after I work from office. 

So today is the first day I went to work using the office connection. Will try tonight or tomorrow to connect from home. Fingers crossed 🤞.