Enabling Password Change Control for RADIUS/TACACS

[Nerd_Herd]

I have settings enabled for Active Directory users to change their password if its expired. I was able to successfully test it on two Cisco C8500-12x's with TACACS. I have not been able to get it to work on Arista, Palo Alto, or other Cisco devices using RADIUS or TACACS. There was nothing special in the AAA configs on the C8500-12x. Is there a guide that goes in to specifics for configuring this setting?

[Arne Bier]

I have also only ever used this with Cisco IOS devices when they are configured with AAA using TACACS+.  

I believe in the RADIUS world, if you're still using EAP-PEAP MSCHAPv2, then you can change your password via the login dialogue of your Windows/iOS/Android supplicant. But I have never tried that. MSCHAPv2 is dying off slowly and so are username and passwords. 

[Nerd_Herd]

We don't plan on using RADIUS in prod so its not that big of a deal. Is there a standard Cisco config though to get it to work?

[Arne Bier]

Password change during a telnet/ssh session over TACACS+ does not require any special IOS configuration commands. The feature is enabled on the TACACS+ server.

In ISE it's configured as below - don't worry about the "telnet" wording below - it also works with SSH!

Once enabled, you telnet/ssh to the network device, and enter the username. When prompted for the password, press Enter.

In my case I used an ISE Internet Network Access User account. But I believe this will work with an AD account as well.

[MHM Cisco World]

Share config let me check 

MHM

[Nerd_Herd]

tacacs-server host x.x.0.22 vrf NDPMGMT11008 key 7 06571E20560F38rgt383F450518142rr41D181C
tacacs-server host x.x.0.23 vrf NDPMGMT11008 key 7 06571E20560F38383dssF450518142rr41D181C
aaa group server tacacs+ ndpt-ise-servers
server x.x.0.22 vrf NDPMGMT11008
server x.x.0.23 vrf NDPMGMT11008
aaa authentication login default group tacacs+ group ndpt-ise-servers local
aaa authentication login console group tacacs+ group ndpt-ise-servers local
aaa authorization exec default group tacacs+ group ndpt-ise-servers local
aaa authorization commands all default group tacacs+ group ndpt-ise-servers local