Info: GlobalProtect VPN with iOS 10.2 and T-Mobile LTE network not working

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
jjason
L2 Linker

Info: GlobalProtect VPN with iOS 10.2 and T-Mobile LTE network not working

 

T-Mobile appears to no longer be issuing IPv4 addresses on their LTE network for iPhones running iOS 10.2 and Carrier Profile 27.1. This caused GlobalProtect VPN on our iOS 10.2 phones with T-Mobile LTE to stop working. 

 

Summary of the testing - See attached screenshots:

  • Platforms: Two iOS 10.2 iPhones - one on T-Mobile LTE and one on AT&T LTE
  • Tools used: Hurricane Electric's Network Tools App -> Interface data.
  • T-Mobile LTE: No IPv4 addresses. IPv6 addresses only.
  • AT&T's LTE: Both IPv4 and IPv6 addresses.
  • GlobalProtect 2.X.X and 3.X.X do not support IPv6. (Current iOS version is 3.0.2.) 

 

Notes:

  • Impact is confined to T-Mobile LTE only at this time.
    • Verizon. AT&T, Sprint, etc. do not have this issue.
  • Based on how its working today, an educated guess says T-Mobile has an IPv6->IPv4 translation gateway where they connect the LTE network to the Internet. 

 

Workaround:

  • For T-Mobile LTE customers, use Wifi for VPN.

 

Fix:

  1. GlobalProtect 4.0, which does support IPv6, is due out soon.
  2. We have a beta copy and it works properly with iOS 10.2 and T-Mobile. 

 

Please talk to your PAN Account Rep and open a support case with PAN about the issue if you are being impacted. For reference, our case is #00598890. 

 

 

AT-T.PNGt-mobile.PNG

BPry
Cyber Elite

This is a widely documented problem with Asian mobile carriers and most mobile carriers in India. Since most of the major websites that users visit are IPv6 capable it isn't that large of an issue for daily browsing, but most carriers will use a NAT64 gateway so that you can still reach IPv4 only services. This of course is handled pretty poorly on a GlobalProtect and most other VPN solutions unless they actually support IPv6. 

jjason
L2 Linker

Thanks for the heads up on the international ramifications. We had not (yet) run across that problem.

 

jdelio
Community Team Member

Just an FYI,

With the release of GlobalProtect 4.0 (to be used with PAN-OS 8.0) supports IPv6.

I hope this will help those trying to get IPv6 working with GlobalProtect.

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!