cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2408
Views
0
Helpful
4
Replies

Cisco VPN Login Fail After Enable Password Management

Steven Chua
Level 1
Level 1

Hi,

I have a VPN setup consist of Cisco ASA, Cisco ACS and a Microsoft LDAP server. The VPN client will be authenticated via the LDAP server and authorized via the ACS.

The software version that I am using is 8.4(3).

The VPN connection is ok until I enabled the Password Management option on the ASA. Thus, I would like to enquire if this is a bug or any additional configuration needed.

Thanks and Rgds

4 Replies 4

Tarik Admani
VIP Alumni
VIP Alumni

You can only use password management with radius since mschapv2 is used to change the password. Ldap doesn't support mschapv2 even though you connec to ad.

You will need acs to join to your ad domain and allow it do perform the authentication.

Thanks

Sent from Cisco Technical Support Android App

Travis Hysuick
Level 1
Level 1

Hi Steven,

We had some issues when enabling the password  management feature through ASDM; if you check the box in the gui, it  adds the additional "password-expire-in-days 14" argument, which has  been documented to cause issues (this is directly from the TAC case  engineer I worked with). It was recommended to me to add the password  management option from the CLI to the connection profile without the  expiry option.

ASA(config)# tunnel-group MyVPN general-attributes

ASA(config-tunnel-general)# password-management

There were also some issues in earlier 8.4 releases  (regression of a previously noted bug) that caused auth to fail with  password management enabled, I don't have the bug ID handy but I recall  that it was marked as fixed in 8.4(1).

We are using Active Directory as the external identity store in CSACS with the  Enable Password Change option checked and it is working very well.

Hope this helps!

Tarik Admani
VIP Alumni
VIP Alumni

I also read in the asa user guide that you can use ldap with AD but you must bind to it using ldaps.

Sent from Cisco Technical Support Android App

Steven Chua
Level 1
Level 1

Hi Tarik / Admani,

Noted for the advice, I will join my acs to the ad and enable mschapv2 for the authentication. I will keep you guys updated.

Rgds

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: