Pulse VPN issue with DualStack-Lite connection (IPv6)

[kapilaks1]

We have several reports of people having issues to connect office network from home over Pulse secure vpn client. Affected users are located mostly in EMEA.

Common scenario is that the VPN tunnel gets initiated and the connection gets established. However people are not able to browse the internet/internet on their machine. They get network drives assigned and they are working fine.

We did some tests and results are:

- Users in Kronberg with that issue are using Unitymedia (aka UPC). They provide a DualStack-Lite connection (IPv6 & IPv4). Same issue is also being faced by users in Ireland also have this DS-Lite or IPv6 connection
- If connecting to a pure IPv4 connection (mobile phone hotspot) everything works fine.
- Beside of Laptops, also iPads are affected if you connect via Junos Pulse (VPN setup works but connection to VDI as an example times out)
- I found a couple of articles in the Internet that changing the MTU value might help, so I tried that at home (MTU was set to 1500, now it is at 1460). That fixed my issue with the T-Mobile WLAN call which wasn’t working properly but not the office VPN issue.

any thoughts?

[zanyterp]

Another thing to check is if the ISP uses "DNS helper" (aka hijacking) that allows a search page to be presented with names of misspelled items to provide a possible next destination.
What version of the client are you using?
What version of the gateway are you using?

[kapilaks1]

Hi,

Client version is 5.1.3 (55675)
Gateway is running on 8.2R6 (build 51693)

[fleisch]

I am facing the exact same issue, cannot browse any web pages, but can ping computer on company networks with Unity Media.

Is there any workaround for this ?

[TsUk6uh4oLfq2Z]

Also having this issue. I'd prefer not to have to disable IPv6 in order to get this to work

[TsUk6uh4oLfq2Z]

If it helps anyone. What I ended up doing is going to https://support.microsoft.com/en-us/help/929852/guidance-for-configuring-ipv6-in-windows-for-advance... and then choosing the "Disable IPv6 on all tunnel interfaces". This seemed to work, and allows for IPv6 to still be priority.