Local accounts for VPN users can't change their passwords.

[kevin.joyce]

I have setup local users on my ASA that are allowed to connect over the AnyConnect VPN client.  Unfortunately, these users are not able to change their own password through vpn client.  I have to manually tell users their passwords and reset them on the firewall.  This is a security/confidentiality concern for me as well as the users.  Can the functionality be added so an administrator can check a box that would prompt the user to change their password at the first login?  We should also be able to expire local accounts after a certain period and/or on a certain date.  

If there is a fix/work around for this I would like to see it.

[Marvin Rhoads]

The ASA local password functionality is pretty limited. Cisco doesn't really intend for it to be used as the primary credential store for remote access users.

For AnyConnect users to be able to change their own password, you need to be using an external identity source (like Active Directory).

You can set expiration date for local passwords but the ASA doesn't give the user any warning or notice of it - the password just stops working for them.