USG Flex 700 - Password change recommendation window - cannot be disabled

Zyxel_James

Hello @n4cr2k

I would like to clarify how to reproduce the symptom.
so when the password change date arrives, and you didn't change the password, the error message "Wrong CLI command, device timeout or device logout" pops out every time even if you select Never, is that right?
May I check your device by web GUI remote access? you may provide it to me through PM, I will check on this for you, thank you.

n4cr2k

Currently when I log into the device, I get the message that there are accounts which have not had a password change in X days. There is one account in the list. If I change the drop down in the "please remind me" from the default "every time" to "never" I get a brief pop up message of "Wrong CLI command" that goes away without intervention and the login process is completed as normal. This happens every time I log in, so I just leave the prompt at "remind me" "every time" to avoid the wrong CLI pop up. I can follow up to do a remote session if you'd like.

Zyxel_USG_User

This is the case since years for me on another device USG20W, therefore when I saw this entry ⇒ I assume for all Zyxel firewall devices. It is annoying as heck, but to be honest there's more important issues which are more annoying. Anyhow, back to our thread here. I try to reformulate- everything concerning users and regular password renewals IS disabled in the boxes, still the firewall prompts unasked every 60 days for a password change. I change password on day X, day X+60 logging onto the device I have the pestering message until I change the password. The popup menu asks whether I want to be notified 'every time I login' or 'never'. I select 'never', an error message about CLI something pops up. I click that one OK/away, and I can use the GUI in all its splendor. If I log out and log in again, same story with the notification repeats again. This, until I really am so p****d off that I change the password to not see this annoyance for the next 2 months.

Zyxel_USG_User

Oh yes, and I have the latest FW installed. No worries, this 'feature' tagged along the updates for minimum an year or so AFAIR. It may be even longer around, as other annoying things disappeared this one consistenly remained and upped the annoyance ranking until it got even remembered "duh, again this one".

Zyxel_USG_User

USG20W, newest FW, probably since the beginning had the same issue:

USG_User

After a long time where this bug was not occuring, today we experience it again on our USG Flex 700 (FW 5.39 ABWD.1). We can set the dropdown box to "Never" which is leading to the same described error message as in the original starting post of this thread.

Now we will update to latest FW 5.40 and hopefully this bug is done, since the changelog of the 5.40 describes a bug fixing (eITS#240701111) for Password Expiring Page which is unavailable when accessing via a https port which is not 443. Our access port is different from 443, insofar it could match. Will see …

Zyxel_USG_User

I have the same story with every two months requests to change passwords even if the checkbox to do so is disabled, on USG20W-VPN, I guess it is the same on all models. No matter the port, no matter the settings or anything else, the admin users on firewall need to change passwords every x months.

kruess

Same here, it happens on USG's and ATP's since years and many firmware versions and Zyxel support only came up with some (silly) questions regarding the issue which were already described in detail in my ticket…

In our case, we use the standard 443/tcp port for accessing the firewall GUI - so eITS#240701111 would not apply, either.

Zyxel_USG_User

Would make more sense to label the checkbox "this checkbox does not work anyway" instead.

USG_User

Just updated to FW 5.40. Now the annoying Change Password Request is gone. But after the update to 5.40, the USG is presenting a Security Best Practices popup window, where you have to walk through before you're arriving the USG desktop. This includes also a retyping of your Admin password credentials.