Managing the 2FA configuration for the AITS VPN is different from how 2FA is managed for everything else. The AITS VPN does not prompt for you to choose a 2FA method when connecting. The AITS VPN uses your default login method that is set in Duo Classic Manager. This article goes into further detail.
First, you must have a 2FA working device setup on your account at the NetID Center: 2FA, Enroll a new phone/new phone number (uillinois.edu)
The university recommends using Duo Push as your authentication method use the Duo Mobile Application on your smartphone. See KB 67790 for more information: 2FA, Installing the Duo Mobile app (uillinois.edu)
Once a 2FA device is set up under the NetID Center, set the default login setting for the AITS VPN using Duo Classic Manage:
When you initiate a connection to the AITS VPN it will now send a Duo Push prompt to your phone, or it will call you based on the setting made.