This document highlights the steps to configure the RADIUS Password Expiry feature on Cisco IOS® Easy VPN Servers. The Cisco® Secure Access Control Server (ACS) configured for Microsoft Challenge Handshake Authentication Protocol 2 (MS-CHAP2) is used as the RADIUS server in this example (Password Authentication Protocol [PAP] is not supported for this feature). With this feature enabled, VPN users are prompted to change an expired Microsoft Windows password when they launch the Cisco VPN Client to connect to the Easy VPN Server.
CHALLENGE
Currently, Cisco IOS Easy VPN clients send the username and password values to the EasyVPN Server, which in turn sends them to the authentication, authorization, and accounting (AAA) subsystem. The AAA subsystem generates an authentication request to the RADIUS server. If the password has expired, then the RADIUS server replies back with an authentication failure. The reason for the failure is not passed back to AAA subsystem, so the user is denied access because of authentication failure but does not know that the failure is due to password expiry.
SOLUTION
The AAA Password Expiry infrastructure notifies the Easy VPN client that the password has expired, and provides a generic way for the user to change the password.
Note: The Password Expiry feature is not supported on the hardware client.
COMPONENTS USED
The information in this document is based on the following software and hardware versions:
• Cisco Secure Access Control Server (ACS) Version 3.3 installed on a Windows 2000 server
Users in this document are defined in the Microsoft Windows 2000 Active Directory Server.
The information in this document was created from the devices in a specific lab environment. All devices used in this document started with a normal tunnel configuration, using either a cryptology map or Dynamic Virtual Tunnel Interface (DVTI). If your network is live, make sure that you understand the potential impact of any command.
NETWORK DIAGRAM
This document uses the network setup shown in Figure 1.
Use the following procedure to configure Cisco Secure ACS:
Step 1. Define the Cisco 2800 Series router as an AAA client. Be sure to select RADIUS (Cisco IOS/PIX) as the authentication method. Refer to Figure 2.
Figure 2. AAA Client Configuration
Step 2. Define the external user database for Windows Active Directory users.
Be sure to check the Dialin Permission and MS-CHAP2 boxes, and enter the domain name for the Windows Active Directory server (Figures 3 and 4).
Figure 3. Defining External User Database
Figure 4. Defining External User Database (continue)
Step 3. Add the external user to the Cisco Secure ACS user database. It is a reference pointing to the Windows Active Directory database.
Be sure to select Windows Database as the Password Authentication type (Figure 5).
Figure 5. User Setup
Step 4. Define a VPN user on Windows Active Directory.
Note: Windows users must check Allow access under the Remote Access Permission under Dial-in tab (Figure 6) and check "User must change password at next logon" under the Account tab (Figure 7) in the user profile.
Figure 6. Active Directory User Configuration-Remote Access Permission
Figure 7. Active Directory User Configuration-Account Options
Verify
The following examples demonstrate how the RADIUS Password Expiry feature works when the Windows password expires. The VPN user is informed that the password has expired and prompted to enter a new one.
Step 1. Launch the Cisco VPN Client (Figure 8).
Figure 8. Cisco VPN Client
Step 2. Type your username and password to log in. Then click OK (Figure 9).
Figure 9. User Authentication
Step 3. When the Windows password expires, you will be prompted to change the password. Type a new password. Type again to confirm it, and click OK (Figure 10).
Figure 10. Change Password
Troubleshoot
Before examining the debug messages, consider the Microsoft vendor-specific attributes needed for understanding this feature. The following Microsoft attributes are generated or processed by AAA, for providing the password expiry support.
• MS-CHAP-Error-The MS-CHAP-Error attribute contains error data related to the preceding MS-CHAP exchange. This attribute can be used in MS-CHAP2; it is used only in Access-Reject packets.
• MS-CHAP2-CPW-This attribute allows users to change their password if it has expired. It is used only in conjunction with the MS-CHAP-NT-Enc-PW attribute in Access-Request packets, and should be included only if an MS-CHAP-Error attribute was included in the immediately preceding Access-Reject packet, the String field of the MS-CHAP-Error attribute indicated that the user password had expired, and the MS-CHAP version is 3.
• MS-CHAP-NT-Enc-PW-This attribute contains the new Windows NT password encrypted with the old Windows NT password hash. The encrypted Windows NT password is 516 octets long. Because this is longer than the maximum length of a RADIUS attribute, the password must be split into several attributes for transmission. A 2-octet sequence number is included in the attribute to help preserve ordering of the password fragments. This attribute is used only in Access-Request packets, in conjunction with MS-CHAP-CPW-2 and MS-CHAP2-CPW attributes. It should be included only if an MS-CHAP-Error attribute was included in the immediately preceding Access-Reject packet, the String field of the MS-CHAP-Error attribute indicated that the user password had expired, and the MS-CHAP version is 2 or greater.
• MS-CHAP2-Response-This attribute contains the response value provided by an MS-CHAP2 peer in response to the challenge. It is used only in Access-Request packets.
• MS-CHAP2-Success-This attribute contains a 42-octet authenticator response string, which must be included in the message field of the MS-CHAP2 Success packet sent from the network access server to the peer. This attribute is used only in Access-Accept packets.
The following section shows the debug messages captured on the Cisco 2821 Integrated Services Router with Cisco IOS Software during a tunnel negotiation. Refer to the bold portions to see how AAA attributes are passed between the Cisco Secure ACS and the Cisco IOS Easy VPN Server to inform the VPN user that the password has expired, and take the new Windows password back from the VPN user to the Window user database.
Turn on the following debug commands on the Cisco 2821 Integrated Services Router:
• · debug aaa authentication
• · debug ppp authentication
• · debug aaa attributes
*Mar 10 03:19:14.570: AAA/ATTR(000015C7): new list: 0x451A04E8
