Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1758
  • Last Modified:

CIsco PIX and ACS - VPN client won't prompt to change password

I currently have a PIX (IOS 6.3), and an ACS (v4.1) server. VPN clients connect to the PIX and are authenticated by the ACS through the external Windows database for Active Directory. The problem is when a user in AD has the option checked for "User must change password at next login", the VPN client fails immediately with Reason 413: User authentication failed.

One thing I found from here:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps6659/prod_white_paper0900aecd80478ad7.html
... but not sure if it applies because I am using an ACS. Would this be the correct usage line for the PIX

aaa authentication login USERAUTH passwd-expiry group radius

Is that needed even if using an ACS? Is there anything else I'm missing? Please let me know what other information you need to help me out.

Thanks!
0
djspin007
Asked:
djspin007
1 Solution
 
vivek283Commented:
Hi,

PIX 6.x does not support password change on expiry for VPN clients. For password change ms-chap-v2 must be used. IPSEC uses PAP.

This feature was introduced on PIX on 7.0. On 7.x the tunnel group can be configured for radius-with-expiry or password-management. This will work with AD as external DB to ACS.
0
 
djspin007Author Commented:
Thanks for the info! I guess that's why so many people had VPN Concentrators prior to upgrading to PIX 7.x or replacing it with an ASA. Glad to hear though I didn't miss something in the configuration.
0

Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

Tackle projects and never again get stuck behind a technical roadblock.
Join Now