Change Password on Next Login for VPN using AnyConnect with ISE

[fatalXerror]

Hi Guys,

Good Day!

Is it possible for the remote access VPN using AnyConnect with ISE as the RADIUS server to perform change password on next login? My ISE is configured with RADIUS protocol and it is just using internal database for the username and password of the VPN users.

Thanks for the help.

[Aditya Ganjoo]

Hi,

On the ASA/Anyconnect server you need to use just "password-management" in the tunnel group configuration.

In order to configure ASA to communicate over MSCHAPv2 with radius, we should have "password-management" under the tunnel-group. This change would add a new field for the end user to enter the domain-name, however, it's optional. If you leave it blank, it would use the local domain.

You can check this thread as well:

https://supportforums.cisco.com/discussion/10023171/asa-password-management-command-vpn-pasword-alerts-w-ias

Regards,

Aditya

Please rate helpful posts.

[fatalXerror]

Hi Aditya,

Good Day!

So this solution will work if I check the "Change on Next Login" in the username properties in Cisco ISE right?

Thanks for the feedback.

[Aditya Ganjoo]

Hi,

You need to make this change in the tunnel group on the ASA as well.

tunnel-group testAnyVPN general-attributes
password-management

Regards,

Aditya

Please rate helpful posts.

[fatalXerror]

Hi Aditya,

Good Day!

But how about in the ISE which is my RADIUS server and serves as the DB of my users. No need to change something?

Because we have a scenario that my client wants to enable, for example a user forgot his password, we will provide them a default password but in their next login they should change it. 

Does the password-management in ASA support this?

Thanks

[Aditya Ganjoo]

Hi,

I think it may not be supported as per the following doc:

https://supportforums.cisco.com/document/11934926/password-management-ldap-vs-radius-vpn-users

ASA does not support password management under the following conditions

• when using LOCAL (internal) authentication
• when using LDAP authorization
• when using just RADIUS authentication and when the users reside on the Radius server database.  

Regards,

Aditya

Please rate helpful posts.