Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

• Configure an interface type and enter interface configuration mode by using the interface command.

• Configure the interface for PPP encapsulation by using the encapsulation command.

• Be sure that the client operating system supports all MSCHAP V2 capabilities.

• For Cisco IOS Release 12.4(6)T, the Password Aging feature only supports RADIUS authentication for crypto-based clients.

• To ensure that the MSCHAP Version 2 features correctly interpret the authentication failure attributes sent by the RADIUS server, you must configure the ppp max-bad-auth command and set the number of authentication retries at two or more.

In addition, the radius server vsa send authentication command must be configured, allowing the RADIUS client to send a vendor-specific attribute to the RADIUS server. The Change Password feature is supported only for RADIUS authentication.

• The Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows NT operating systems have a known caveat that prevents the Change Password feature from working. You must download a patch from Microsoft at the following URL:

http:/​/​support.microsoft.com/​default.aspx?scid=kb;en-us;Q326770

For more information on completing these tasks, see the section “PPP Configuration ” in the Cisco IOS Dial Technologies Configuration Guide , Release 12.4T. The RADIUS server must be configured for authentication. Refer to vendor-specific documentation for information on configuring RADIUS authentication on the RADIUS server.

• MSCHAP V2 authentication is not compatible with MSCHAP V1 authentication.

• The change password option is supported only for RADIUS authentication and is not available for local authentication.

MSCHAP V2 authentication is the default authentication method used by the Microsoft Windows 2000 operating system. Cisco routers that support this authentication method enable Microsoft Windows 2000 operating system users to establish remote PPP sessions without configuring an authentication method on the client.

MSCHAP V2 authentication introduced an additional feature not available with MSCHAP V1 or standard CHAP authentication: the Change Password feature. This features allows the client to change the account password if the RADIUS server reports that the password has expired.

Note	MSCHAP V2 authentication is an updated version of MSCHAP that is similar to but incompatible with MSCHAP Version 1 (V1). MSCHAP V2 introduces mutual authentication between peers and a Change Password feature.

• Configuring MSCHAP V2 Authentication
• Verifying MSCHAP V2 Configuration
• Configuring Password Aging for Crypto-Based Clients

Device> enable

Device# configure terminal

Device(config)# radius-server vsa send authentication

Device(config)# interface Gigabitethernet 1/0/1

Device(config-if)# ppp max-bad-auth 2

Device(config-if)# ppp authentication ms-chap-v2

Device(config-if)#
 end

Device# show running-config interface Asynch65

Device# debug ppp negotiation

Device# debug ppp authentication

Configuring Password Aging for Crypto-Based Clients

The AAA security services facilitate a variety of login authentication methods. Use the aaa authentication logincommand to enable AAA authentication no matter which of the supported login authentication methods you decide to use. With the aaa authentication logincommand, you create one or more lists of authentication methods that are tried at login. These lists are applied using the login authentication line configuration command.

After the RADIUS server requests a new password, AAA queries the crypto client, which in turn prompts the user to enter a new password.

To configure login authentication and password aging for crypto-based clients, use the following commands beginning in global configuration mode.

Note	The AAA Password Expiry infrastructure notifies the Easy VPN client that the password has expired and provides a generic way for the user to change the password. Please use RADIUS-server domain-stripping feature wisely in combination with AAA password expiry support.

SUMMARY STEPS

1.    enable


2.    configure terminal


3.    aaa new-model


4.    aaa authentication login {default | list-name} passwd-expiry method1 [method2...]


5.    crypto map map-name client authentication list list-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	aaa new-model Example: Device(config)# aaa new-model	Enables AAA globally.
Step 4	aaa authentication login {default | list-name} passwd-expiry method1 [method2...] Example: Device(config)# aaa authentication login userauthen passwd-expiry group radius	Enables password aging for crypto-based clients on a local authentication list.
Step 5	crypto map map-name client authentication list list-name Example: Example: Device(config)# crypto map clientmap client authentication list userauthen	Configures user authentication (a list of authentication methods) on an existing crypto map.