Symantec VIP PUSH notifications not received on a mobile device.

Products

• VIP Service

Issue/Introduction

• PUSH notification is not received on the VIP Access mobile app
• VIP prompts for the security code
• VIP does not send PUSH notifications for 60 minutes, then begins sending again. 
• Click here if PUSH is not received on the VIP Access mobile app after the number verification option is enabled in VIP Manager by a VIP administrator. 

 

Cause

Test the credential at https://vip.symantec.com. If a PUSH is received and accepted, the app is working properly. If not, here are some common causes of a PUSH notification not being received on a device. 

Hint: For RADIUS logins, it is often possible to append your VIP security code to the end of the password (no spaces) during a login attempt. This directly authenticates the user without the need for a PUSH.  

• Outdated VIP Access for mobile: Update to the latest available version from the Apple App Store® or Google Play Store®. For Android, Android 6.0 or later is required. (Note: uninstalling and reinstalling the app will generate a new Credential ID and requires your organization's helpdesk to assign the new credential ID to you).
• VIP credential ID is not assigned to the user (this is common when a user gets a new device). 
• PUSH notification sent to a credential ID no longer in use (example: A user gets a new phone and VIP credential ID but hasn't yet registered the new ID or removed the old)
• Lack of connectivity to the internet via wifi or mobile data. 
• Environmental\building conditions that affect network connectivity. 
• Wifi connection firewall rules blocking PUSH notifications sent to or from services.vip.symantec.com.
• Notifications are disabled or hidden on the device, or set to notify only when the app is open and in focus. 
• Notifications ignored or denied
• Network latency
• Misconfigured validation server and/or NAS or VPN settings, such as improper timeout or retry values.
• If no users are getting the PUSH, confirm Enable Mobile Push is enabled in VIP Manager and that PUSH is enabled in the Validation Server settings. 
• VIP Administrators can use VIP Manager reports to see the credential ID(s) a PUSH is sent to (under mobile push sent details). 

Check Apple and Android PUSH services:

• For Apple, check the Apple Push Notification Service (APNS) status: https://developer.apple.com/system-status/
• For Android, check the Google Firebase status: https://status.firebase.google.com/ 

Temporary PUSH lock: The PUSH function will temporarily lock for 60 minutes if 5 consecutive PUSH notifications to the same device are denied or unacknowledged by the user. This is designed to prevent PUSH spamming or looping.

In this state, VIP logs show: <status>600D</status><statusMessage>Operation not allowed in current state of credential.

In VIP Manager, the VIP Access Push status shows as TEMPORARY LOCKED:

While temporarily locked, end-users can enter a security code manually as long as the Allow Security Code Validation option in VIP Manager is set to Yes. If set to No, the end-user will see Login failed. Please contact your administrator while PUSH functionality is temporarily locked. 

Example of PUSH becoming temporarily locked:
 
Push sent, user Denies PUSH = fail count 1
Push sent, user Denies PUSH = fail count 2
Push sent, user ignores = fail count 3
Push sent, user ignores = fail count 4
Push sent, user ignores = fail count 5, PUSH temporarily locked
 

Resolution

PUSH functionality will be restored 60 minutes after the last PUSH was sent. A VIP administrator can manually set the PUSH functionality status back to enabled in VIP Manager. 

The device must be able to accept the PUSH notifications (powered on, service available or on WiFi, not in airplane mode, not on silent mode, VIP notifications are not blocked, etc)

Use VIP Manager end-user REPORTS to confirm if PUSH notifications are being sent to the user.

Presently, there are no API calls to check what increments the counter value. VIP Manager cannot filter for users with temp. locked push credentials since it will automatically unlock.