VPN connection failures are almost always one of: credentials expired, MFA push not arriving, network blocking, or the client itself in a broken state.

1. Confirm your network reaches the internet

A VPN client can't connect over a broken network. Open a browser and load any site. If that fails, fix the network first — see [Wi-Fi connected but no internet](/kb/no-internet-but-wifi-connected).

2. Check your credentials

If your password recently changed (most companies expire it every 60-90 days), the VPN client may still be cached with the old one. Update:

  • Cisco AnyConnect: type your new password directly in the prompt
  • GlobalProtect: Settings → re-enter username and password
  • OpenVPN: usually a config file with cached credentials; remove the saved password

If you've forgotten your password, see [resetting your password](/kb/forgotten-password).

3. MFA push not arriving

If your VPN uses Duo, Microsoft Authenticator, or another MFA app:

  • Confirm your phone has internet — the push notification needs it
  • Open the Authenticator app manually if no push appears — sometimes you see the request waiting there
  • Last resort: use the rolling 6-digit code from the app instead of the push

If pushes consistently fail, the app may have lost its registration — see [reset Microsoft Authenticator](/kb/reset-microsoft-authenticator).

4. Restart the client cleanly

Just closing the window doesn't quit the underlying VPN service. To fully restart:

  • Windows: Right-click the system tray icon → Quit. Then relaunch from Start. If the icon won't quit, restart your laptop.
  • macOS: Cmd+Q in the client; if it won't quit, Activity Monitor → kill any vpn process

5. The "captive portal" trap

If you're on hotel or coffee shop Wi-Fi and the VPN client refuses to connect:

  1. Disconnect the VPN
  2. Open a browser → visit http://neverssl.com
  3. Sign in to the captive portal that pops up
  4. Try the VPN again

Many VPN clients are blocked from doing this on their own.

6. Driver / TAP adapter

Some VPN clients (OpenVPN, some old Cisco builds) install a virtual network adapter. If you see a TAP adapter in Device Manager with a warning triangle, reinstall the VPN client.

7. Time and date

If your laptop clock is wrong by more than a few minutes, certificate validation fails and the VPN refuses to connect. Check the system clock; if it's off, fix it — Windows Settings → Time & language → set automatically.

8. Server selection

Some VPN clients let you choose a server. If the default server is unreachable, try another:

  • Cisco AnyConnect typically has a dropdown of gateways
  • GlobalProtect rotates automatically but you can force a specific portal in Settings

When to ticket

Open a ticket if:

  • You've confirmed credentials work elsewhere (e.g. Outlook web)
  • MFA is firing successfully
  • Other people on the same network are connecting fine

Include the VPN client name and version, the specific error message verbatim, and the gateway/server name you're trying.