Filter
Top Products
69-108
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter 69 General VPN Setup
Mapping Certificates to IPsec or SSL VPN Connection Profiles
• Strip the group from the username before passing it on to the AAA server—Enables or disables
stripping the group name from the username before passing the username on to the AAA server.
Check Strip Group to remove the group name from the username during authentication. This option
is meaningful only when you have also checked the Enable Group Lookup box. When you append
a group name to a username using a delimiter, and enable Group Lookup, the ASA interprets all
characters to the left of the delimiter as the username, and those to the right as the group name. Valid
group delimiters are the @, #, and ! characters, with the @ character as the default for Group
Lookup. You append the group to the username in the format username<delimiter>group, the
possibilities being, for example, JaneDoe@VPNGroup, JaneDoe#VPNGroup, and
JaneDoe!VPNGroup.
• Password Management—Lets you configure parameters relevant to overriding an account-disabled
indication from a AAA server and to notifying users about password expiration.
–
Override account-disabled indication from AAA server—Overrides an account-disabled
indication from a AAA server.
Note Allowing override account-disabled is a potential security risk.
–
Enable notification upon password expiration to allow user to change password—Checking this
check box makes the following two parameters available. You can select either to notify the user
at login a specific number of days before the password expires or to notify the user only on the
day that the password expires. The default is to notify the user 14 days prior to password
expiration and every day thereafter until the user changes the password. The range is 1 through
180 days.
Note This does not change the number of days before the password expires, but rather, it enables
the notification. If you select this option, you must also specify the number of days.
In either case, and, if the password expires without being changed, the ASA offers the user the
opportunity to change the password. If the current password has not yet expired, the user can
still log in using that password.
This parameter is valid for AAA servers that support such notification; that is, RADIUS,
RADIUS with an NT server, and LDAP servers. The ASA ignores this command if RADIUS or
LDAP authentication has not been configured.
Modes
The following table shows the modes in which this feature is available:
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
• — • ——