If you don’t have AAAA records and you don’t have Interfaces listening to those addresses. You won’t “see” ANY “demand.” So since they don’t see ipv6 traffic, they think there’s no demand for it. It’s a self-fulfilling statistic.

It's far more likely the statement refers to a lack of user tickets, project requests, or compliance requirements as that's normally how IT finds out what to do next. I've never seen an IT staff with so little to do they are monitoring the network looking for packets for ideas of what they should implement next instead of implementing things they've been trying to get time for for the last 5 years. Link utilization maybe but that's a completely different beast.

Not to mention it's extremely hard to know how to check the statistic you described without becoming aware you don't have the things needed to generate the statistics so this reasoning kind of rules itself out with the exception of AAAA records - you'll actually see those requests even if all you have is A records on an IPv4 only DNS server.

Well of course your VPN won't work if the firewall isn't routing IPv6. That's a configuration problem and has nothing to do with IPv6 itself.

I'm unclear on how you suddenly know exactly what the issue was. I didn't say anything about a firewall.

I worked at an MSP during the peak of covid getting remote workers at many different companies settled in. When turning off IPv6 solved connectivity problems, 100% of the time it was because IPv6 DNS was taking precedence over IPv4. IPv6 DNS request gets sent over VPN, firewall doesn't know how to resolve it, and you can't get to anything on the network. Turn that off and the IPv4 requests are happily resolved. I'm not sure what else that problem could possibly be other than maybe misconfigured domain controllers, but that seems pretty unlikely if dual stack was enabled on the firewall as that is not the default in my experience.

Google, for example, "ipv6 anyconnect" and you will see issues that are solely on the PC before it ever gets to a firewall.

Yikes. Pushing IPv6 traffic through the IPv4 tunnel is just bad software design, seems like a bug. That's just bizarre. Incidentally, none of our clients used that. The issue is similar though, but different root causes.

Nothing wrong with doing that in the slightest. Just because the user's home internet is IPv4 does not mean corporate side v6 services should be unreachable. Either way the user is going through a tunnel to reach things, it doesn't matter if what's inside the tunnel is the same as what's outside it... it's a tunnel! Doesn't even have to be IP!

Now that doesn't mean things can't get misconfigured or poorly set up in that regard but by no means is the concept just wrong, I have several clients it has been useful for.