Panorama - Administrators user - Required Password Change Period (days) - Pan-OS 9.1.14

Good afternoon,Thank you for your collaboration and your time

I am doing some tests in relation to Minimum Password Complexity -Enabled, mainly to force the password change in X days. When I set Required Password Change Period (days) with value of 3 days, I wait 3 days and I never get any password change request, moreover when I login with any of the setup/administrators users, with fully operational password and working properly before applying the Required Password Change Period (days) of 3 days, I wait the 3 days and it does not suggest me any password change neither for admin, admin01, admin02, admin03, in fact after this, none of the known passwords work anymore and I have to go back to a previous configuration entering in maintenance mode,

Why is this happening? This is critical because we want to implement this, but we lose access after X days and the idea is not to lose access, but to force the password change after X days.

Please send me your suggestions regarding the above.

I remain attentive

Best regards

3 comments

Comments (3)

Reaper

Oct 15, 2022

The initial counter will start when you add the profile. Any password changes thereafter resets the 90 day counter

Reaper

Oct 14, 2022

How many days did you set the "expire warning period" to? This should be anything but 0

MetgatzGR

Oct 14, 2022

Replying to

Thank you for your prompt response.

I have already found the problem and therefore the solution.

Yes, I had already set the "expire warning period" I was testing in a test environment, in a virtual Panorama, but I tried 3 times, changing the date and time to simulate the passage of x days, but it did not work and lost access to the VM with valid credentials.

So what I did was to load the license trial to that VM Panorama Trial scenario, once loaded it worked perfectly, the warning appeared, indicates the grace period and the number of times the admin can enter, set the maximum of 3 and 1 day of thanks for the test.

-Now I have the following doubt, example:

If I have the admin04 and I have configured Required Password Change Period (days) with value "90", those 90 days start since the user changed the password or since this setting was configured ? For example, I have the Change Period at 90 days, but what happens if the admin04 at day "30" makes the voluntary modification of his password, the counter of 90 goes back to 0 or anyway at 90 days it will ask for the change?

As always thank you very much for your help and collaboration.

I remain attentive to your comments

Best regards

Forum: Forum