I had the same problem, where I wasn't getting the needed push. Are you using a NPS server and if so is it located on your Duo proxy? If yes disable the NPS. I also discovered with help from Duo support that the section in your config file wasnt needed only the domain name was
try removing and save the config file restart duo services and see if you then get the needed push
security_group_dn="CN=Duo Checkpoint VPN,OU=Groups,DC=domain,DC=com"
Also, to help confirm that you don't have any misconfigs or errors, make sure to run and check the connectivity tool and check logs. This tool will be ran from the command window as an administrator, if all green your radius server is in good shape. If you get any error make note and correct and re-run the test.
"C:\Program Files\Duo Security Authentication Proxy\bin\authproxy_connectivity_tool.exe"
Last thing is to make sure the service account that you are using as the needed rights (read, write, list)
Hope this helps.