This example specifies that a password must include at least one uppercase character, two numerals, and one special character; that a character cannot be repeated consecutively; and that the password must be changed five times before it can be used again. It also specifies that the password must be different from the username, that non-admin users must enter their current passwords to change their passwords, that admin users cannot use hashed passwords when they create new users, and that the LCD password must be at least eight characters.
The following commands are entered at CLI configuration mode:
aaa authentication password local character-type upper-case minimum 1 aaa authentication password local character-type numeral minimum 2 aaa authentication password local character-type special minimum 1 aaa authentication password local character max-char-repeats 1 aaa authentication password local history compare 5 aaa authentication password local no-userid aaa authentication password local change require-current non-admin no aaa authentication password local change allow-encrypted aaa authentication password lcd length minimum 10
show aaa authentication password
Local password requirements:
Minimum length: 8
Maximum length: 32
Maximum character repeats: 1
Minimum lower case characters: 0
Minimum upper case characters: 1
Minimum special characters: 1
Minimum numeric characters: 2
Recent passwords to check against: 5
Allowed to match userid: no
Require current password on change: yes
(non-admin users only)
Allow set of encrypted password: no
(admin users only)
Require password change on local accounts:
Require password change for new account: no
Maximum password age before change required: none
Warn user before password expires: 7 days ahead
LCD password requirements:
Minimum length: 10