ASA 5515x Password Recovery issue

[hashimwajid1]

Hi 

our ASA 5515x password expired due to password Expiry limitation and unfortunately no service password-recovery command is enabled. is there any way we can recover password ? with or without losing existing configuration 

when we login on ASA it shows Password Expired

or do we have to contact with TAC ?

do password-policy lifetime command also expires Console password  or it just work for username/password ? if we connect console on ASA then Enable password will still work ? 

Regards

[Marvin Rhoads · Accepted solution]

Ability to use the console connection depends on whether or not you had configured it to also require the local username for authentication.

If both the ssh and console (and ASDM) logins required authentication with local username AND that credential is expired AND the no service password-recovery feature is enabled then you will have to rebuild the configuration from scratch.

[hashimwajid1]

Hi Marven,

Thanks for your Reply

i found this guide in witch it says Users from console are never locked down due to Password Expiration

Password-Policy lifetime days

(Optional) Sets the interval in days after which passwords expire for remote users (SSH, Telnet, HTTP); users at the console port are never locked out due to password expiration. Valid values are between 0 and 65536 days. The default value is 0 days, a value indicating that passwords will never expire.

7 days before the password expires, a warning message appears. After the password expires, system access is denied to remote users. To gain access after expiration, do one of the following:

• Have another administrator change your password with the username command.
• Log in to the physical console port to change your password.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html

I'll try it from console if not then it'll be a issue, you are right it might depends whether console login required local username/password database or not 

[Mohammed al Baqari]

contact tac but I am not aware about a way to fix it

**** remember to rate useful posts

[hashimwajid1]

Hi 

We are able to access via Console ( it did not ask about username/passswrod and only enable password was sufficient.

Regards