> # Password Aging Notification through TACACS+ Server

> Password aging notification is initiated when the user authenticates to a Cisco MDS 9000 switch via a TACACS+ account. The user is notified when a password is about to expire or has expired. If the password has expired, user is prompted to change the password.

> Note As of Cisco MDS SAN-OS Release 3.2(1), only TACACS+ supports password aging notification. If you try to use RADIUS servers by enabling this feature, RADIUS generates a SYSLOG message and authentication falls back to the local database.

> Password aging notification facilitates the following:

> - Password change—You can change your password by entering a blank password.
> - Password aging notification—Notifies password aging. Notification happens only if the AAA server is configured and MSCHAP and MSCHAPv2 is disabled.
> - Password change after expiration—Initiates password change after the old password expires. Initiation happens from the AAA server.

> Note Password aging notification fails if you do not disable MSCHAP and MSCHAPv2 authentication.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.