IOS IKEv2 VPN over LTE does not work anymore

[kris2k]

I’ve read the recent posts about people affected by usage NordVPN complaining, but in my case, it’s my personal network and my internal users.

I’ve ran through the preliminary details and it appears that the phone is initiating a direct IPV6 tunnel that’s superseding the device’s routing table and not allowing the device to use the IPv4 or IPv6 gateways provided by the VPN tunnel (our IPSec tunnel is dual-stack) which are provided by the device’s routing table.

What’s up with this?

Any recommended IOS profile tweaks to push down?

[kris2k]

Hey everyone!

A little bit of an update for this.  

For Apple devices: 
Apple has released the latest iOS 12.0.1 software which may resolve issues for certain remote/VPN Apps using the IPv6-only connections.

If you’re experiencing this issue, please update to iOS 12.0.1 (or newer) and test again.

A possible workaround for Android devices only:
Modify the APN “ltemobile.apn” to IPv4 instead of the default IPv4/IPv6 in the phone settings, under Wireless & Networks - Cellular Networks - Access Point Names.

Power cycle the device and test the VPN connection again.

If the issue persists, please note the date and time of the failure and let us know so we can send you a PM to look closer into this with you.

[FidoAmanda]

Hey kris2k!

Are you able to try the connection on another network? Does it work when you're connected to wifi?

Let us know!

[kris2k]

Of course; via WIFI, VPN works flawlessly.

I’m unable to ping the next-hop VPN-encrypted gateway either via IPv4 or IPv6 when I’m on LTE.

A tcpdump from the firewall side reveals no packets entering the tunneled interface from the mobile device.

[FidoAmanda]

Let's take a closer look at that together. 

You'll have a PM coming your way shortly.

[awefawe]

Did this issue end up getting fixed? Or does it have to be fixed on a case by case basis?

I'm having the exact same issue.

[FidoAmanda]

Hey awefawe!

We'll check into that for you! So that we can get you the right info, could you confirm if your also using an iOS device or are you using an Android?

Let us know and we'll go from there.

[awefawe]

Hello @FidoAmanda - I'm on iOS, latest version as of today.

My wife also has the same problem on iOS, also on latest iOS version.

[kris2k]

Hey Awefawe;

Indeed, my situation got fixed by Fido. It appears that they pushed an alternate APN configuration to use the dual-stack IPv4/IPv6 Gateway again.

From a technology standpoint,I’m sure it’s not what they want (since being IPv6 native has some added benefits for data transmission reliability and efficiency), but I’m confident the bugs have been documented + submitted to Apple, and there’s a ‘hope’ for next IOS version to have additional capabilities to better handle ipv4/ipv6 vpn connections with an ipv6-only WAN.

[FidoAmanda]

Thanks for confirming, awefawe!

We'll be sending you a PM so that we can get that up and running for you. 

Talk to you soon! 

[Nineteen84]

Hi @FidoAmanda, I’m having the exact same issue.  

Can I please get assistance via PM?

Thanks!

[FidoRanya]

Hey @Nineteen84 , 

Sending a PM your way !

[prochon]

Good afternoon,

I am an employee of a large company developing a mobile application that uses an external Bluetooth device and our app acts as a bridge between this device and the Internet so the Bluetooth device can communicate with servers and exchange data. Unfortunately, this device is IPV4 only so on LTE or 3G using my iPhone device on iOS 11, these data exchanges fail due to Fido (and Rogers) expecting an IPV6 communication. Our customers and some employees who are with Rogers were able to have this issue fixed on an individual account basis by Rogers applying a temporary fix to their account while it works with Apple for a more permanent fix.

We need to test this fix on my Fido account. Here is the Rogers Community Forum thread dealing with this issue: http://communityforums.rogers.com/t5/Apple/Certain-Apps-Connect-over-Wi-Fi-but-not-Data/td-p/425522

Thanks

Pierre

[FidoRanya]

Hey @prochon, 

Welcome to the Community

I moved your message to this thread as it deals with a similar topic.

I'm sending you a PM so we can sort this out.

Talk to you soon!

[Paulie1]

Hi @FidoRany,

I have similar problem as @prochon.

Can you please send me the fix for IPv6 setup?

[FidoPhilippe]

Hey @Paulie1!

Welcome to the community.

I'll send you a PM shortly.