VPN & Remote Access Tickets

At 8:40 on a Monday the desk at Bluewater Bank had nine VPN tickets, which was unusual. By 8:55 it had forty, which was a pattern. The certificate on the gateway had expired at midnight. It had been due to expire at midnight for exactly one year. The calendar entry that would have said so had belonged to someone who left in the spring. Every remote worker in the organisation was now being told, by a dialog box, that the office could not be trusted. In a narrow sense that was true. The fix took eleven minutes. The forty tickets took the rest of the morning, one apologetic reply at a time.

This series is about the remote-access ticket in all its forms. It covers the VPN ticket categories and their first questions. It covers can't connect as a cheapest-first diagnostic order, from the hotel Wi-Fi to the gateway. It covers connected but can't reach it, which is nearly always a split tunnel and a user who was never told what works where. Then come certificates, expiry and the morning everyone fails at once, with the calendar that prevents it. It covers second-factor problems: the new phone, the lost device and the re-enrolment that must verify a person first. And it covers reducing VPN tickets with a setup guide, a self-check and a known-issue list. The tunnel is simple. Explaining it is the job.

Articles in This Series

• The VPN Ticket Categories and Their First Questions
  Cannot connect, connects then drops, connected but cannot reach, slow over the tunnel, a certificate warning, a credential or second-factor failure; the first question for each; and the category table.
• Can't Connect: The VPN Diagnostic Order, Cheapest First
  Is the internet up, is the client running and current, are the credentials current, is the second factor working, is it this network, is it everyone. Covers six steps cheapest first, and the card.
• Connected But Can't Reach It: Split Tunnels and What Works Where
  Split tunnelling in plain words, the resource that only exists on the tunnel, and the one that only works off it. Covers the name-lookup confusion, explaining it without teaching networking, and the what-works-where sheet.
• Certificates, Expiry and the Morning Everyone Fails at Once
  The expiring certificate as a calendar event, client version drift, the renewal runbook, the communication before the change, the major-incident shape when it is missed, and the certificate calendar.
• Second-Factor Problems: New Phones, Lost Devices and Lockouts
  The new phone with no authenticator, the lost device, backup codes, identity verification before re-enrolment, the enrolment runbook, and the re-enrolment runbook itself.
• Reducing VPN Tickets: Setup Guide, Self-Check and Known Issues
  The setup guide, the self-check, the always-connected question, the known-issue list, the measurement by category, what remote-first design removes, and the self-check article.

Explore More Topics

This series is part of the QuerySolv helpdesk topic library. It covers the foundations, processes, communication, knowledge, tooling, metrics, classic ticket domains, people and strategy behind a support desk that works. The library pairs well with the software we build: QuerySolv. It is a self-hosted help desk that runs as one Windows service on your own network. It is licensed once per installation, not per agent per month.