ISE and AD Password Expiration Notification and allow user to change

[dirkmelvin]

We are almost ready to go live with ISE for our VPN users.

One last thing that has been asked is, how can we make ISE prompt a user when their AD password is about to expire, and allow them the opportunity to change it at that time?

I know the ASA has the ability if it is authenticating directly against AD, but that functionality goes away with IPN. So what settings are there to prompt users connecting via Anyconnect to the ASA VPN through ISE?

We do not have ISE setup for internal users/systems yet, this is strictly a VPN only setup for now.

Thanks,

Dirk

[Jatin Katyal]

Since we are using radius protocol so password expiration notification will not occur. The user will be prompted when password would expire. With ldap over ssl, user will be notified that "your password will be expired in x number of days" but we can't pick that method as it shoud be ASA integrated directly with AD/LDAP.

Since we have ISE in between acting as a radius server so we have to live with the option where user will not be notified but password can be changed by end-user.

Procedure for Configuring RADIUS Password Management

Requires tha tthe Radius server/ISE  be integrated with an Active Directory MS-AD server.

1. Enable "password-management" in tunnel-group/Connection Profile.

Note: "password-management password-expire-in-days X" will not work, use just "password-management"

2. Ensure that MSCHAPv1/MSCHAPv2 is enabled on the RADIUS/ISE server.

Jatin Katyal
- Do rate helpful posts -

[dirkmelvin]

I now have this configured on the ASA and ISE....we will wait and see if this works. I will try to remember to come back and let everyone know how it works out.

[Owner Technoma]

Hello Jatin, I have the same issue with an ISE Server. What configurations we need to do in the ISE to permit that the user can change her password after the expiration occured??

Thanks in advance!

[Jatin Katyal]

That's great. Let us know in case you need any further help.

Jatin
-Do rate helpful posts-

Sent from Cisco Technical Support Android App

[dirkmelvin]

This doesn't seem to be working.

I have an ASA that isn't using ISE yet, and that is prompting users to change their password at 14 days out.

I have the above settings in the ASA that IS using ISE, and I have MSCHAPv2 enabled. But we are not getting prompted that the password is expiring.

[Jatin Katyal · Accepted solution]

Yes, this is what I said in the first post.

Since we are using radius protocol so password expiration notification will not occur.

You will get a pop-up that password is expired, please change.

Jatin Katyal
- Do rate helpful posts -