Global Protect / Vodafone / Germany

[Tim_Jenkins]

Since around Jul/Aug 2024,  our users in Germany using Vodafone broadband connections have started to have problems accessing public web-sites over Global Protect, routing via our Data Centre Firewalls which have SSL-decryption enabled.    All web access fails and in the logs we see "decrypt-unsupport-param".

If the user switches to a non-Vodafone connection, it all starts working.  Anyone know if Vodafone Germany have started to recently do some sort of SSL inspection of their own or something?

[Bhavesh.Patel]

Hi Tim,

Were you able to figure what the cause was by any chance?

I am seeing the exact same behaviour with our 2 users in Berlin. Both are on Vodafone and whenever they connect to VPN (back to our London Gateway), I see the decrypt-unsupport-param errors and certain websites/Outlook Plugins fail to connect. Another issue we keep seeing is disconnection from MS Teams (MS Teams subnets are split-tunnelled). As soon as we  disconnect from VPN or use another ISP, everything works as expected.

Thanks,

[Tim_Jenkins]

Hi, yes.  We fixed it by disabling the following in Chrome / Edge

In Chrome go to chrome://flags and search for “kyber”. Change from Default to Disable

In Edge go to edge://flags and search for “kyber”. Change from Default to Disable

Hope this works for you also.

[Bhavesh.Patel]

Thanks Tim, we already have the kyber flags disabled but still an issue. Strange that it's only with Vodafone in Berlin.

I'll post here if we figure it out.