GlobalProtect 3G issue on Windows 8 pro tablet

[sboelter]

Hi,

we installed GP 1.2.1 on a Windows 8 32 bit pro tablet (thinkpad 2). With WiFi it works perfectly but when we use 3G, we can't even open the Portal website in the Internet Explorer and the GP client can't connect.

I thought it could be a problem with the certificate but then it would not work with WiFi?

[cpainchaud]

Could it be your 3G provider that filters ipsec or something like that ? Can you try your 3G card on another system that runs Windows 7 or a Mac ?

[gwesson]

I ran into a similar issue with the IPSec GP function on a Windows 8 tablet with 4G-LTE. The issue was caused by the client sending a large MSS (something like 4000 bytes). When an HTTP 200 response was sent by the server, it was larger than 1500 bytes. The server-side was correctly transmitted on multiple frames, but when the PA transmitted it, it would transmit as a single, IP-fragmented packet. The PA must do that as the client is indicating its wishes for the frame to be sent as a single chunk. Since the MTU of the firewall (and next hop) is 1500, the packet must be fragmented.

The client-side sent the 4000-byte MSS and should have been ok with the IP fragmentation, but those fragments were never making it back to the client. The solution was never really ironed out, but the correct solution is to either lower the MSS on the inbound SYN (could be from the tablet or from the carrier, I'm not sure) or to convince the carrier to transmit the fragmented IP traffic back to the client.

You can see if this is the same issue by taking a packet capture on the firewall and checking the transmit stage. If you see fragmented IP frames leaving toward the client but never getting an ACK, it's probably the same issue.

Hope this helps,

Greg Wesson

[sboelter]

..we tried it with a notebook running windows 8 64bit and a 3G USB stick and it's working, so our provider (Vodafone Germany) doesn't seem to be the problem. Maybe it's the tablet's internal 3G modem.

[kbe · Accepted solution]

Hi,

i had the same issue on a Win 8 x64 Laptop with integrated 3G Modem and a Vodafone Germany contract.

But on my older Win7 X64 Laptop it worked without problems with the same contract.

If you have a business contract with Vodafone the 3 G should always get an routable IP. Using a private contract could lead to get a private non-routable IP and the NAT from Vodafone might bring up the issues.

In my case the problem was caused by a MTU size for the 3G Modem that was much too large.

I set the MTU tu a normal value and now it works fine.

To check the MTU open a cmd with admin privilege and use

netsh interface ipv4 show interfaces

To change the MTU look for the right Index of the 3G Modem (the Idx in row 1 of the above command) and issue the following command (in the following example the Idx is 25):

netsh interface ipv4 set subinterface 25  mtu=1476 store=persistent

HTH

[sboelter]

Hi,

changing the MTU solved the problem (it was 2048).

Thanks a lot for your help