topic Re: Global Protect / Vodafone / Germany in GlobalProtect Discussions

Global Protect / Vodafone / Germany

Tim_Jenkins — Thu, 19 Sep 2024 15:19:37 GMT

Since around Jul/Aug 2024, our users in Germany using Vodafone broadband connections have started to have problems accessing public web-sites over Global Protect, routing via our Data Centre Firewalls which have SSL-decryption enabled. All web access fails and in the logs we see "decrypt-unsupport-param".

If the user switches to a non-Vodafone connection, it all starts working. Anyone know if Vodafone Germany have started to recently do some sort of SSL inspection of their own or something?

Re: Global Protect / Vodafone / Germany

Bhavesh.Patel — Tue, 19 Nov 2024 09:33:22 GMT

Hi Tim,

Were you able to figure what the cause was by any chance?

I am seeing the exact same behaviour with our 2 users in Berlin. Both are on Vodafone and whenever they connect to VPN (back to our London Gateway), I see the decrypt-unsupport-param errors and certain websites/Outlook Plugins fail to connect. Another issue we keep seeing is disconnection from MS Teams (MS Teams subnets are split-tunnelled). As soon as we disconnect from VPN or use another ISP, everything works as expected.

Thanks,

Re: Global Protect / Vodafone / Germany

Tim_Jenkins — Tue, 19 Nov 2024 09:57:23 GMT

Hi, yes. We fixed it by disabling the following in Chrome / Edge

In Chrome go to chrome://flags and search for “kyber”. Change from Default to Disable

In Edge go to edge://flags and search for “kyber”. Change from Default to Disable

Hope this works for you also.

Re: Global Protect / Vodafone / Germany

Bhavesh.Patel — Wed, 20 Nov 2024 09:09:17 GMT

Thanks Tim, we already have the kyber flags disabled but still an issue. Strange that it's only with Vodafone in Berlin.

I'll post here if we figure it out.