ASA AnyConnect + ISE internal user password management

[ktoyoshi]

Hi,

Does ISE support expired password change feature via AnyConnect VPN connection for internal user (not AD/LDAP) ?

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/116757-config-asa-remote-00.html#anc8

Best Regards,

Kaori

[Jason Kunst · Accepted solution]

Existing community post I found when searching using google
https://community.cisco.com/t5/identity-services-engine-ise/password-change-vpn-ise-internal-user/td-p/3554092

[ktoyoshi]

Thank you Jason and sorry for that. I'm checking this configuration in my lab. 

Update:

It works well with "change password on next login", but not with password expiry because of account disable.

It seems ACS-RESERVED-Never-Expired attribute is not effective. Isn't this expected behavior?

[surasit.t1]

I've same problem.

Seem like ASA+ISE with internal user not able to change password when password expired. but working fine with next log on.

Do you have any idea?