VIP Enterprise Gateway Validation PUSH fails with reason=29 Access Denied Push Trampled

Products

• VIP Service

Issue/Introduction

Validation server log sample of error:

INFO "2020-08-18 18:55:35.117 GMT-0700"  0.0.0.0 Citrix_Netscaler:1822 0 0 "text=Evaluating Push Closure request for user [user1]" Thread-10848 VSAuthOTPStandardControllerImpl.cpp
INFO "2020-08-18 18:55:35.117 GMT-0700"  0.0.0.0 Citrix_Netscaler:1822 0 0 "text=Sending Acces-Reject for user [user1] , reason=29; PUSH Trampled." Thread-10848 VSAuthOTPStandardControllerImpl.cpp
AUDIT "2020-08-18 18:55:35.117 GMT-0700"  10.10.10.10 Citrix_Netscaler:1822 0 0 "text=Access DENIED PUSH Trampled. ,reason=29; PUSH Trampled." Thread-10848 VSValidationEngine.c

Cause

By default, PUSH timeout values are set to 60 seconds on the VIP Enterprise Gateway. Timeout values should be set similarly at the source of the validation request. 60 seconds allows time for the end-user to receive and acknowledge the PUSH request. If a retry request is sent to the validation server before the existing PUSH 60-second timeout has expired, the new PUSH request 'tramples' over (cancels) the previous PUSH. This can repeat until the max. number of retries in the VPN application settings is reached. This can affect end-user logins, create extra load on your VPN application, generate excess LDAP traffic, and unnecessary load on the the VIP EGW validation server. 

(Example: A Cisco AnyConnect client timeout is set to 15 seconds and the VIP RADIUS Validation Server is set to 60 seconds. An end-user does receive and accept the PUSH within 15 seconds so Cisco retried the transaction. The second attempt generates another PUSH that supersedes (tramples) the first, and results in an error in the logs: Access DENIED PUSH Trampled. ), reason=29; PUSH Trampled. 5 repeated empty PUSH requests will cause the PUSH portion of the VIP Mobile token to be disabled for 60 minutes. 

Resolution

Refer to your application vendor for instruction on how to set the timeout\retry values to 60-seconds.