Network authentication and password policy

Hello, I am new to this list and planning to deploy a radius-server. Sole purpose will be to authenticate against network equipment. Mainly Juniper and cisco and Sonicwall. I am looking for best practice solutions for password policy. Is there any way to force network engineers to change their passwords after either first login or expiry date? Having everybody manually submit passwords on the server and/or having them change it every x weeks seems a bad plan. Anyone any ideas? Thx Rgds, Jeffrey