ASA Local User Password Policy

[SDKIM]

Hello,

I have two questions regarding ASA SSL VPN Local user password policy.

Q1. Currently there is no password policy predefined. But now I'd like to setup the local user password policy, e.g. lifetime 30days, Minimum length 8.

In this case, what will the previous users happen? they will still be able to login without any troubles? even it has less than 8digit password?

Q2. Is there any way for the users to change the password once the password lifetime is expired? (We are using the local users, not external AAA Server)

Any comment would be thanksful.

KIM

[Francesco Molino · Accepted solution]

Hi

When setting the password policy, existing users will be able to connect with their old password. The policy applies on new password.

However, using local database won't allow users to change their password, it has to be initiated by an asa admin.
I highly recommend to move with a radius or ldap database. If you have AD server in your infrastructure, just leverage it or you can deploy a radius server at low cost; and have a real password management system (users will be able to get notified when password expires or change their password and their own)

[SDKIM]

Appreciate for your reply. Good Luck!!