Well, i know Microsoft IAS can do that for a MS VPN Client, i'm not sure of the SSL VPN by Cisco does that. Radius has an attribute that directs the client to prompt for a new password when it encounters a password expiring attribute.
If you use Microsoft IAG 2007, it can help you do this. ;-)