topic Re: Cannot Connect to GlobalProtect from hotspot in GlobalProtect Discussions

Cannot Connect to GlobalProtect from hotspot

FAleais — Sun, 21 Jan 2024 19:06:38 GMT

I have T-mobile as my phone carrier and when I connect my work laptop (Macbook pro) to my personal phone hotspot GP is not able to connect.

I did some search and found that people in past changed MTU value but tired and didn't work.

I find this is as miss from GP because sometime there's power outages in my area and I have to use hotspot or sometimes there's ISP maintaince.

Any idea if there's a workaround or this is expected and if so is there plan to handle hotspots ?

Re: Cannot Connect to GlobalProtect from hotspot

OtakarKlier — Mon, 22 Jan 2024 20:40:21 GMT

Hello,

Are you able to perform any web browsing at all? Could be a DNS resolution issue? Once on the hotspot, exit out of GP and relaunch it.

Regards,

Re: Cannot Connect to GlobalProtect from hotspot

FAleais — Tue, 23 Jan 2024 03:49:49 GMT

No issue accessing things that don't require VPN but I cannot access work-related resources.

Re: Cannot Connect to GlobalProtect from hotspot

OtakarKlier — Tue, 23 Jan 2024 15:40:17 GMT

Hello,

I would guess that something is blocking the VPN connection? Check the PAN logs and see if the traffic is making it.

Regards,

Re: Cannot Connect to GlobalProtect from hotspot

DrewNumberTwo — Thu, 25 Jan 2024 19:50:32 GMT

If you are having MTU issues on Global Protect on TMobile the issue commonly presents as "gateway appears connected, but actual data will not pass through the created tunnel." So web sites will not work, outlook will not connect, etc even though the gateway appears connected in the Global Protect. If the problem is MTU, switching to SSL (though note it will not automatically fail over to SSL for this issue) will get connections flowing. Also as you have noted lowing the MTU helps as well. As far as I have seen MTU on Tmobile is 1420-ish. Thus as I understand, you would want the GP MTU setting to be Tmobile's MTU minus the IPSEC header size which will vary based on what encryption parameters you are using. Though I have been only working on this problem for a few days so most of my info is coming from what I learned over on /r/TmobileISP and from Tmobile's support forums.

Re: Cannot Connect to GlobalProtect from hotspot

LEEJUWON — Fri, 26 Jan 2024 13:29:35 GMT

I have same problem.

I think this issue was occurred IPhone' IOS 17.2 later.

Temporarily, I changed IP Setting from dhcp to static on Macbook.

Ex : 172.20.10.5/24

Gateway : 172.20.10.1

Re: Cannot Connect to GlobalProtect from hotspot

KhaleelE — Mon, 29 Jan 2024 10:40:34 GMT

From Iphone there is option you can select the certificate which used for the GP and Enable trust this will work tried in one customer firewall.

Re: Cannot Connect to GlobalProtect from hotspot

FAleais — Mon, 29 Jan 2024 17:37:11 GMT

GP not installed on the iPhone, so not sure if that applies

Re: Cannot Connect to GlobalProtect from hotspot

FAleais — Thu, 01 Feb 2024 06:27:40 GMT

That didn't help in my case

Re: Cannot Connect to GlobalProtect from hotspot

CDowd — Thu, 15 Feb 2024 22:05:54 GMT

There's a bug in the GP client code that's encountered when connecting via an iPhone hotspot that's using an IPv6 only cell carrier where NAT64/CLAT are used. Under these conditions PanGPS segfaults and crashes while it's processing gateway's from what appears to be a null pointer dereference. The bugged logic seems to occur from the 192.0.0.2/32 your WiFi interface is receiving from the iPhones DHCP. Apple must have made a change here in one of the recent IOS updates.

As a workaround, change your WiFi interface to a static IP with a netmask that isn't /32:
Something like:
> networksetup -setmanual Wi-Fi 172.20.10.3 255.255.255.240 172.20.10.1
And when you disconnect from your hotspot and reconnect to regular wifi you would need to revert with:
> networksetup -setdhcp Wi-Fi

You can verify if you're encountering the same bug by checking the crash log (.ips extension) in the GP troubleshooting logs.
You'll see:

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000020
Exception Codes: 0x0000000000000001, 0x0000000000000020

The segfault always occurs in the pan_connect_socket() function (3140 bytes in on ARM64; 3408 bytes in on x86), usually in the 'CaptivePortalDetectionThread' thread, but sometimes on other threads such as the "NetworkDiscoverThread".

Re: Cannot Connect to GlobalProtect from hotspot

FAleais — Mon, 19 Feb 2024 20:00:01 GMT

that's my issue. Thanks for providing a workaround

Re: Cannot Connect to GlobalProtect from hotspot

fbaumgar — Thu, 29 Feb 2024 21:24:33 GMT

Given this is a known issue, I would assume PaloAlto will provide a fix eventually.

Is anybody aware of an internal ticket that this is being worked on?

Re: Cannot Connect to GlobalProtect from hotspot

jjhernandez — Wed, 13 Mar 2024 21:59:00 GMT

Per PAN TAC, this is a known issue and the fix will be in 6.3 (when released), 6.1.5, 6.2.3, and 6.0.10, when they ship.

My case number is 02936908.

Re: Cannot Connect to GlobalProtect from hotspot

dolphinonland — Fri, 26 Apr 2024 22:55:18 GMT

When are they expected to be shipped?

Re: Cannot Connect to GlobalProtect from hotspot

SHAWN_P_MURPHY — Sat, 27 Apr 2024 14:47:56 GMT

As a major palo alto customer, I just switched back to a company ATT iphone. A hassle, but otherwise we wait for Palo to patch, and our FW team to vet and implement. Still not working. Was an unpleasant surprise when remote and oncall, and couldn’t connect.

Re: Cannot Connect to GlobalProtect from hotspot

Sascha_D — Tue, 07 May 2024 19:43:25 GMT

When I switched my iphones APN setting manually to a legacy ipv4 APN, this helped getting the issues resolved. Not sure if this a general workaround, but at least it helped for T-Mobile here in Germany. Hope that helps!

Re: Cannot Connect to GlobalProtect from hotspot

AaronAxvig — Wed, 22 Jan 2025 19:20:16 GMT

I have a user experiencing this issue on GP 6.3.1 on Verizon 5G Home service. A support case is opened to find the status of the fix and we may try the workaround, but I wanted to at least mention this much.

Re: Cannot Connect to GlobalProtect from hotspot

StephenLittle — Mon, 23 Jun 2025 18:17:45 GMT

Did Palo support solve your issue?

Re: Cannot Connect to GlobalProtect from hotspot

AaronAxvig — Thu, 03 Jul 2025 18:32:32 GMT

It was a typical support experience... Eventually they recommended upgrading to 6.3.2 even though saying GPC-19545 and GPC-20970 were fixed in 6.3.0, and even though saying that the 6.3.1-383 that I was on is newly released and there are no similar bugs in that version.

We uninstalled 6.3.1 and installed 6.3.2 and the user has been good ever since! I have zero good information on why though.

Oh BTW as part of the "solution" provided they said "Refer to this document" and linked to this thread (which I had actually linked to in my Description in the first place). LOL

Re: Cannot Connect to GlobalProtect from hotspot

blakeae — Sat, 12 Jul 2025 15:52:34 GMT

I use T-Mobile as well. I turned off IPv6 in the adapter settings and now Global Connect works!