Test the credential at https://vip.symantec.com. If a PUSH is received and accepted, the app is working properly. If not, here are some common causes of a PUSH notification not being received on a device. 

Hint: For RADIUS logins, it is often possible to append your VIP security code to the end of the password (no spaces) during a login attempt. This directly authenticates the user without the need for a PUSH.  

• Outdated VIP Access for mobile: Update to the latest available version from the Apple App Store® or Google Play Store®. For Android, Android 6.0 or later is required. (Note: uninstalling and reinstalling the app will generate a new Credential ID and requires your organization's helpdesk to assign the new credential ID to you).
• VIP credential ID is not assigned to the user (this is common when a user gets a new device). 
• PUSH notification sent to a credential ID no longer in use (example: A user gets a new phone and VIP credential ID but hasn't yet registered the new ID or removed the old)
• Lack of connectivity to the internet via wifi or mobile data. 
• Environmental\building conditions that affect network connectivity. 
• Wifi connection firewall rules blocking PUSH notifications sent to or from services.vip.symantec.com.
• Notifications are disabled or hidden on the device, or set to notify only when the app is open and in focus. 
• Notifications ignored or denied
• Network latency
• Misconfigured validation server and/or NAS or VPN settings, such as improper timeout or retry values.
• If no users are getting the PUSH, confirm Enable Mobile Push is enabled in VIP Manager and that PUSH is enabled in the Validation Server settings. 
• VIP Administrators can use VIP Manager reports to see the credential ID(s) a PUSH is sent to (under mobile push sent details). 

Check Apple and Android PUSH services:

• For Apple, check the Apple Push Notification Service (APNS) status: https://developer.apple.com/system-status/
• For Android, check the Google Firebase status: https://status.firebase.google.com/ 

Temporary PUSH lock: The PUSH function will temporarily lock for 60 minutes if 5 consecutive PUSH notifications to the same device are denied or unacknowledged by the user. This is designed to prevent PUSH spamming or looping.

In this state, VIP logs show: <status>600D</status><statusMessage>Operation not allowed in current state of credential.

In VIP Manager, the VIP Access Push status shows as TEMPORARY LOCKED:

While temporarily locked, end-users can enter a security code manually as long as the Allow Security Code Validation option in VIP Manager is set to Yes. If set to No, the end-user will see Login failed. Please contact your administrator while PUSH functionality is temporarily locked. 

Example of PUSH becoming temporarily locked:
 
Push sent, user Denies PUSH = fail count 1
Push sent, user Denies PUSH = fail count 2
Push sent, user ignores = fail count 3
Push sent, user ignores = fail count 4
Push sent, user ignores = fail count 5, PUSH temporarily locked