cisco ASA 5516 - Password Policy

[sahrizal123]

Hi,

If i configure lifetime 90 days.....before the password expired...

1. any notification during before password expired ?

2. The password related to local password VPN anyconnect as well ?

    anyconnect user can change their own password ...before expired at 90 days ?

3. Password policy feature dont have at 8.0(5)25  firmware ?

[Marvin Rhoads · Accepted solution]

1. No

2. Yes - as long as you haven't checked the box at the bottom of that form.

3. For the expiration policy only - yes - that feature has been around since ASA 7.1(1). For the more full set of features (length, character types etc) - no. Those features were introduced in ASA Software Release 9.1(1).

[sahrizal123]

Thanks Marvin,

1. How to know when the password will expired ? all user need to remember manually ?

   Beacuse for windows server it will prompt warning before password expired....

2.  " Login Password Retry Lockout " can configure at ASA version 9.5(2) ? currently no radius server for credential all in local ASA

thank you :)

[Marvin Rhoads]

sahrizal123  ,

Unfortunately the password management features when using the ASA local password storage are very limited.

Typically the admin sets the local user passwords and, yes, that admin needs to keep track manually of the expiry date.

One cannot set the retry lockout for local passwords.

Cisco recommends using an external AAA server like a RADIUS, LDAP, AD server etc. if you want those sort of features.