Troubleshooting end-user problems

[Gary_Chapman]

Hi. We’re using Duo on an increasing basis, so finally we start to have enough usage
to stimulate the occasional interesting or difficult problem (from the end-user perspective).
E.g. right now we have three users experiencing an inability to use their home phones
with our integrated Cisco VPN service. As always, we encounter difficulty in troubleshooting
end-user problems when we have incomplete information from our clients.

My question is, have folks developed troubleshooting procedures (beyond asking a few
questions and seeing what people say!) that would facilitate problem resolution?

E.g. I’m thinking we really should develop a robust procedure for trying and testing things for a
person having difficulties, have them take a few steps, and fill out a form providing all
the information we’d like to collect plus the results of their testing. A person complaining
about “push” not working, for example, would be asked to confirm that other methods are
working (or not) for them.

Thoughts? - Gary Chapman, NYU IT

[nsuss]

Hi Gary,

Do your users have mobile devices as well as landlines on their Duo accounts? If so, have they tried using https://guide.duo.com/append-mode?

I created a troubleshooting guide for the most frequent use cases in our environment and it’s worked pretty well.

Thanks,

Neil

[mkorovesisduo]

Hey Gary,

Though this may not directly address the home phone issue you describe, we recently released a Help Desk Guide that is designed to help Duo customers troubleshoot issues end-users may encounter. You can find a download link for it here:

https://kb.duo.com/s/article/Help-Desk-Guide

Hope that helps.

[gleezy1]

For troubleshooting this type of issue I would check the following:

Have the user try with a passcode - if this works every time, you likely have a timeout issue. Timeout issues can happen in Cisco Anyconnect if the user has an issue getting the AnyConnect profile that increases the timeout from 12 to 60 seconds. 12 seconds is awfully quick to perform a phone authentication.

Check with Duo Push. Does the auth work after 12 seconds but before 60? This is another good way to see if it is a timeout issue. Sometimes you will get additional pushes or calls in this scenario as well. If so, you aren’t getting that beloved AnyConnect profile.

If it is just phone call that is having the issue,

1. check the “Max credits per action” in settings,
2. the telephony rate card: https://duo.com/docs/telephony_credits#rate-card
3. and the telephony actions log: https://help.duo.com/s/article/1023

As far as a troubleshooting template, I would say try with other methods, Duo Mobile passcodes are immune to most types of errors.

Cheers