An administrator is deciding which authentication protocol should be implemented for their upcoming Cisco AnyConnect deployment. A list of the security requirements from upper management are: the abil

LDAPS can enforce password complexity through the directory, but it does not natively support in-session password changes for AnyConnect VPN users the way RADIUS with MS-CHAPv2 does.

RADIUS integrates with Cisco ASA and AnyConnect to deliver full password lifecycle management by leveraging MS-CHAPv2 and backend directory integration. It enforces complex password policies, delivers expiration warnings to users before their passwords expire, and allows users to change their passwords during an active AnyConnect session. No other protocol in this list provides all three capabilities within a Cisco AnyConnect VPN deployment.

Kerberos is a ticket-based single sign-on protocol that does not provide password expiration warnings or support in-session password changes for AnyConnect remote access sessions.

TACACS+ is designed for device administration AAA and lacks the VPN user password management capabilities - including expiration warnings and in-session password changes - required for an AnyConnect deployment.