Info: GlobalProtect VPN with iOS 10.2 and T-Mobile LTE network not working

[jjhernandez]

T-Mobile appears to no longer be issuing IPv4 addresses on their LTE network for iPhones running iOS 10.2 and Carrier Profile 27.1. This caused GlobalProtect VPN on our iOS 10.2 phones with T-Mobile LTE to stop working. 

Summary of the testing - See attached screenshots:

• Platforms: Two iOS 10.2 iPhones - one on T-Mobile LTE and one on AT&T LTE
• Tools used: Hurricane Electric's Network Tools App -> Interface data.
• T-Mobile LTE: No IPv4 addresses. IPv6 addresses only.
• AT&T's LTE: Both IPv4 and IPv6 addresses.
• GlobalProtect 2.X.X and 3.X.X do not support IPv6. (Current iOS version is 3.0.2.) 

Notes:

• Impact is confined to T-Mobile LTE only at this time.
  • Verizon. AT&T, Sprint, etc. do not have this issue.
• Based on how its working today, an educated guess says T-Mobile has an IPv6->IPv4 translation gateway where they connect the LTE network to the Internet. 

Workaround:

• For T-Mobile LTE customers, use Wifi for VPN.

Fix:

1. GlobalProtect 4.0, which does support IPv6, is due out soon.
2. We have a beta copy and it works properly with iOS 10.2 and T-Mobile. 

Please talk to your PAN Account Rep and open a support case with PAN about the issue if you are being impacted. For reference, our case is #00598890. 

[BPry]

This is a widely documented problem with Asian mobile carriers and most mobile carriers in India. Since most of the major websites that users visit are IPv6 capable it isn't that large of an issue for daily browsing, but most carriers will use a NAT64 gateway so that you can still reach IPv4 only services. This of course is handled pretty poorly on a GlobalProtect and most other VPN solutions unless they actually support IPv6. 

[jjhernandez]

Thanks for the heads up on the international ramifications. We had not (yet) run across that problem.

[jdelio]

Just an FYI,

With the release of GlobalProtect 4.0 (to be used with PAN-OS 8.0) supports IPv6.

I hope this will help those trying to get IPv6 working with GlobalProtect.