Copyright: Saturday, January 04, 2003 15:51:03


Specifies whether accounting requests are logged in the configured SQL Server database.


Specifies whether authentication requests are logged in the configured SQL Server database.


Specifies whether periodic status is logged in the configured SQL Server database.


Provides a space for you to type the number of sessions with the SQL Server database that IAS can create at the same time.


Displays the name of the currently configured data source. If no name is displayed, the data source is not configured.


Click to configure the SQL Server database to which you want to log accounting requests, authentication requests, or periodic status.


Deletes the configuration information typed in Data Link Properties.


Specifies whether IAS deletes the oldest log file if the disk is full. The oldest log file is determined by file name, and the file name format is determined by the selection in Create a new log file.  For example, if you select Daily, the log file name format is inyymmdd.log.


Lists the IP address, after a successful query of the computer name typed in Client.


Click to resolve the RADIUS client name to an IP address.


Provides a space for you to type the name of the RADIUS client computer that you want to resolve to an IP address.


Click to add a condition to the list.


Click to change the settings of the selected condition.


Click to remove the selected condition from the list.


Click to edit the profile for connections that are granted access by the conditions in this remote access policy. If the connection matches the conditions associated with this policy, the profile specifies connection parameters such as maximum session time, idle timeout time, and encryption settings.

A profile is a set of properties that are applied to a connection when the connection is granted remote access permission either through the user account permission setting or the policy permission setting.

For more information, see Elements of a remote access policy in Help.


Click to add the selected type in Available types to Selected types.


Click to remove the selected type from Selected types.


Grants remote access permission to users who match the conditions associated with this policy. For more information, see Elements of a remote access policy in Help.


Provides a space for you to type the value associated with the attribute. When a user tries to connect to the network, the value of this attribute must match what is typed here for this remote access policy to take effect.

For more information about wildcard syntax, see Pattern matching syntax in Help.

If the attribute is not present in the authentication request, then the policy is not applied. For more information about the attributes sent by your network access server (NAS), consult your NAS documentation.


Provides a space for you to type a friendly name for the policy you are creating.


Displays the list of conditions you have already set up for this remote access policy. Remote access policy conditions are one or more attributes that are compared to the settings of the connection attempt. If there are multiple conditions, then all of the conditions must match the settings of the connection attempt in order for the connection attempt to match the policy.

To add a list of conditions, click Add. This profile will be used only to control access if all of these conditions are matched.

For more information, see Elements of a remote access policy in Help.


Displays the list of attributes that conditions can be based on.

For example, you can use Windows-Groups to create a policy specific to the members of a certain group, or you can use NAS-Port-Type to create a policy specific to wireless or VPN connections.


Displays the list of options that you can choose. To add one to the list, select it, and then click Add.

For information about the types in the list, see RFC 2865, "Remote Authentication Dial In User Service (RADIUS)."


Displays the list of options that you have already chosen.

For information about the types in the list, see RFC 2865, "Remote Authentication Dial In User Service (RADIUS)."


Stores the policy in Active Directory.


Stores the policy on the local computer.


Specifies that the vendor-specific attribute that you are configuring conforms to RFC 2865, "Remote Authentication Dial In User Service (RADIUS)." For more information, see Configure vendor-specific attributes for a remote access policy in Help.


Click to edit the selected value in the Attribute Values list.


Displays the name of the multivalued attribute you are adding to the profile.


Moves the selected value higher in the Attribute Values list.


Denies remote access permission to users who match the conditions associated with this policy. For more information, see Elements of a remote access policy in Help.


Displays the format you need to use for entries to this attribute. For more information, see Add RADIUS attributes to a remote access policy in Help.


Click to add an attribute to the remote access policy.


Displays network access server (NAS) vendors. Select the vendor of the NAS for which you are configuring this attribute.


Displays attribute values. Select the value that you want to assign to this attribute.


Displays the attribute number for the multivalued attribute you are adding to the policy.


Click to configure the vendor-specific attribute.


Displays the list of attribute values that you have added to this multivalued attribute.


Click to add an attribute value to this multivalued attribute.


Specifies that you will provide the attribute value as a text string.


Provides a space for you to type the value that you want to assign to this attribute.


Provides a space for you to type the value that is assigned to the vendor-specific attribute. For more information, see Configure vendor-specific attributes for a remote access policy in Help.


Displays the format for the attribute that you are adding to the profile. For more information, see Add RADIUS attributes to a remote access policy in Help.


Displays the name of the attribute that you are adding to the profile.


Displays the attribute number for the attribute that you are adding to the profile. For RADIUS standard attributes, this number is the RADIUS type (as defined in RFC 2865 "Remote Authentication Dial In User Service [RADIUS]"). For vendor-specific attributes, this number is the vendor type.


Removes the selected value from the Attribute Values list.


Moves the selected value lower in the Attribute Values list.


Specifies that you provide the attribute value as a hexadecimal value.


Specifies that the vendor-specific attribute you are configuring does not conform to RFC 2865 "Remote Authentication Dial In User Service (RADIUS)." For more information, see Configure vendor-specific attributes for a remote access policy in Help.


Provides a space for you to type the attribute number for this vendor-specific attribute. For more information, see the documentation for your network access server (NAS).


Lists attribute formats. Select the format for the attribute you are configuring. For more information, see the documentation for this network access server (NAS).


Provides a space for you to type the IP address that will be used with this attribute.


Provides a space for you to type the vendor ID code. If you do not know the vendor code for your network access server (NAS), refer to RFC 1007 for a list of SMI Network Management Private Enterprise Codes.


Specifies the network access server (NAS) vendor from the list of vendors.


Specifies that you will type the network access server vendor code. If you do not know the vendor code for your network access server (NAS), refer to RFC 1007 for a list of SMI Network Management Private Enterprise Codes.


Displays the value that is assigned to this attribute.


Removes a group from the list.


Adds a group to the list.


Displays a list of the groups that you have chosen.

It is not necessary to have a separate remote access policy for each group. Instead, use nested groups to consolidate and delegate administration of group membership. For a remote access server or IAS server in a native mode domain, use universal groups.

For more information about universal groups, see When to use groups with universal scope in Help.

For additional information, see Allow connection through group membership in Help.


Displays available network access server (NAS) vendors.

If you want to specify your NAS vendor by selecting it from the list, click Select from list, and then select the vendor from the list.

If you want to specify a NAS vendor by typing the vendor ID code, click Enter Vendor Code and then type the vendor code in the space provided. If you do not know the vendor code for your NAS, refer to RFC 1007 for a list of SMI Network Management Private Enterprise Codes.


Specifies whether accounting packets are documented in the IAS log file. This option is recommended.

Accounting requests include:

Accounting-On requests, which are sent by the NAS to indicate that the NAS is online and ready to accept connections.

Accounting-Off requests, which are sent by the NAS to indicate that the NAS is going offline.

Accounting-Start requests, which are sent by the NAS (after the user is accepted by the IAS server) to indicate the start of a user session.

Accounting-Stop requests, which are sent by the NAS to indicate the end of a user session.

For more information, see Logging user authentication and accounting requests in Help.

IAS can only log accounting requests that the RADIUS client sends. If your RADIUS client is not configured to send the information, the requests will not be logged.

If the log does not contain accounting requests, make sure that the RADIUS client is sending the information, and then check the system event log for errors.


Specifies whether authentication requests are documented in the IAS log file. This option is recommended.

For more information, see Logging user authentication and accounting requests in Help.


Specifies whether interim accounting packets are documented in the IAS log file. This option is not generally recommended, because it can quickly fill your hard drive.

For more information, see Logging user authentication and accounting requests in Help.


Specifies that IAS create a new log file daily.

Each log file will be named according to the format INyymmdd.log, in which yy is a two-digit representation of the year, mm is a two-digit representation of the month, and dd is a two-digit representation of the day. For example, a log file created on April 6, 1998 would be named IN980406.log.


Specifies that IAS create a new log file weekly.

Each log file will be named according to the format INyymmww.log, in which yy is a two-digit representation of the year, mm is a two-digit representation of the month, and ww represents a two-digit representation of the week within the month. For example, a log file created in the first week of April 1998 would be named IN980401.log.

Weeks are numbered starting with 1. A new week begins on the first day of the month and on the first day of the week as determined by the locale. For example, if the first day of the week is Sunday and the first of the month falls on a Thursday, then Thursday through Saturday is week 1, Sunday through the following Saturday is week 2, and so on.


Specifies that IAS create a new log file monthly.

Each log file will be named according to the format INyymm.log, in which yy is a two-digit representation of the year, and mm is a two-digit representation of the month. For example, a log file created for April, 1998 would be named IN9804.log.


Specifies that IAS create a new log file when the previous log file reaches a size that you specify. The default size is 10 MB.

To specify a different maximum log file size, type the size that you want IAS to use.

Each log file will be named according to the format INETSRVn.log, in which n is a number that is incremented every time a new log file is opened.


Specifies the maximum size for the log file if IAS is configured to create a new one whenever the log file reaches its maximum size.


Specifies the directory path for the log file and provides a space for you to type a new directory path.


Click to change the directory path in which the log files are stored.

If you are administering an IAS server other than your local computer, you cannot browse the directory structure to find a directory path. If you need to log accounting information to a remote server, specify the log file name by entering a Universal Naming Convention (UNC) name, such as: \\MyLogServer\LogShare.


Specifies that IAS store logged information in IAS format. IAS format is an ID-value paired format. For more information, see Interpreting IAS-formatted log files in Help.


Specifies that IAS store logged information in a database-compatible format useful for importing into databases. For more information, see Interpreting database-import log files in Help.


Displays the format for the name of the log file.


Specifies that IAS create a log file of unlimited size. This file is named IASlog.log.


Provides a space for you to type the name of this connection request policy.


Lists the conditions that you have set up for this connection request policy. Connection request policy conditions are one or more attributes that are compared to the settings of the connection request. If there are multiple conditions, then all of the conditions must match the settings of the connection request in order for the connection request to match the policy.

To add a condition, click Add. To modify the settings of an existing condition, click the condition in the list, and then click Edit. To remove a condition, click the condition in the list, and then click Remove.

The profile for this connection request policy is used only to determine how the connection request is processed if all conditions are matched. To modify the profile for this connection request policy, click Edit Profile.


Adds a condition to the list.


Changes the settings for the condition selected in the list.


Removes a condition selected in the list.


Click to edit the connection request profile for connection requests that match the conditions in this connection request policy. A connection request policy profile is a set of properties that are applied to a connection request when it matches all of the conditions of the connection request policy.


Specifies that connection requests are authenticated and authorized by this IAS server using either the local Security Accounts Manager (if the IAS server is a standalone server) or a domain controller (if the IAS server is a member of a domain). By selecting this option, the IAS server acts as a RADIUS server.


Specifies that connection requests are forwarded to a server in the selected remote RADIUS server group for authentication and authorization. By selecting this option, the IAS server acts as a RADIUS proxy. This option is only available if at least one remote RADIUS server group is configured.


Lists the remote RADIUS server groups configured on this IAS server. Select the appropriate remote RADIUS server group to which connection requests are forwarded. This option is only available if you select Forward requests to the following remote RADIUS server group for authentication.


Specifies that connection requests are immediately accepted without authentication or authorization. This authentication option cannot be used when the authentication protocol used by the access client is MS-CHAP v2 or EAP-TLS, both of which provide mutual authentication. With mutual authentication, the access client proves that it is a valid access client to the authenticating server, and the authenticating server proves that it is a valid authenticating server to the access client. When this authentication option is used, the Access-Accept message is returned. However, the authenticating server does not provide validation to the access client and mutual authentication fails.


Specifies whether accounting messages are forwarded to the selected remote RADIUS server group in addition to being recorded on this IAS server. This option is only available if at least one remote RADIUS server group is configured.


Lists the remote RADIUS server groups configured on this IAS server. You can select the appropriate remote RADIUS server group to which accounting messages are forwarded. This option is only available if you select Record accounting information on the servers in the following remote RADIUS server group.


Lists the RADIUS attributes available for find and replace rule processing. Select the appropriate attribute and then create a list of find and replace rules that define how the attribute value is processed prior to being authenticated on this server or forwarded to a remote RADIUS server group. The find and replace rules apply only to the selected attribute. You cannot configure find and replace rules for each attribute and the list of available attributes is not extensible.

If you are using the MS-CHAP v2 authentication protocol, you cannot manipulate the User Name attribute if the connection request policy is used to forward (proxy) the RADIUS message. The only exception occurs when a backslash character (\) is used and the manipulation only affects the information to the left of it. A backslash character is typically used to indicate a domain name (the information to the left of it) and a user account name within the domain (the information to the right of it). In this case, attribute manipulation rules that only modify or replace the domain name are allowed.


Lists the find and replace rules you have set up.

To add a rule, click Add. To modify the settings of an existing rule, click the rule in the list, and then click Edit. To remove a rule, click the rule in the list, and then click Remove. To change the order of the rules, select a rule to move and click Move Up to move the rule up in the list of rules or click Move Down to move the rule down in the list of rules.


Moves the selected rule higher in the list. This is only available if there are at least two find and replace rules and a rule that can be moved up is selected.


Moves the selected rule lower in the list. This is only available if there are at least two find and replace rules and a rule that can be moved down is selected.


Adds a find and replace rule.


Click to modify the selected find and replace rule.


Removes the selected find and replace rule.


Provides a space for you to type the text that you want to find. You can use pattern matching syntax to find specific text. For more information, see Pattern matching syntax in Help.


Provides a space for you to type the text that you want to replace. You can use pattern matching syntax to replace specific text. For more information, see Pattern matching syntax in Help.


Displays the list of additional connection attributes that you have set up. These additional attributes are returned in the response to the connection request sent by the RADIUS client.

To add an attribute, click Add. To modify the settings of an existing attribute, click the attribute in the list, and then click Edit. To remove an attribute, click the attribute in the list, and then click Remove.


Adds an attribute.


Click to modify the selected attribute.


Removes the selected attribute.


Provides a space for you to type the name of this remote RADIUS server group.


Displays a list of RADIUS servers that are members of this remote RADIUS server group.

To add a RADIUS server to this group, click Add. To modify the settings of an existing member of this group, click the RADIUS server in the list, and then click Properties. To remove a RADIUS server from this group, click the RADIUS server in the list, and then click Remove.


Adds a RADIUS server to this remote RADIUS server group.


Removes the selected RADIUS server.


 Click to modify the properties of the selected RADIUS server.


Provides a space for you to type the name of this RADIUS server.


Click to verify that the name of RADIUS server you typed in Server can be resolved to its IP address.


Provides a space for you to type the name of the server.


Resolves the name of the RADIUS server that you typed in Server name to its IP addresses.


Lists the IP addresses that were resolved from the name that you typed in Server name.


Provides a space for you to specify the port you want IAS to use when forwarding authentication requests to this RADIUS server. By default IAS uses 1812, which is the port recommended in RFC 2865, "Remote Authentication Dial In User Service (RADIUS)." Many RADIUS servers use port 1645 by default for authentication requests. Ensure that IAS and this RADIUS server are configured to use the same port.


Provides a space for you to type the shared secret that you want to use when forwarding authentication requests to this RADIUS server.

The shared secret is a text string that is used as a special password between the IAS server and this RADIUS server. There are rules you must follow to successfully set up a shared secret:

The shared secret must be exactly the same at both the IAS server and this RADIUS server.

Shared secrets are case-sensitive.

Shared secrets can use any standard alphanumeric and special characters.

Shared secrets should be at least 16 characters long and use a mixture of upper and lowercase letters, numbers, and special characters.

For more information about shared secrets, see Shared secrets in Help.


Provides a space for you to type the shared secret to confirm its use.


Provides a space for you to specify the port that you want IAS to use when forwarding accounting messages to this remote RADIUS server. By default IAS uses 1813, which is the port recommended in RFC 2866, "RADIUS Accounting." Many RADIUS servers use port 1646 by default for accounting messages. Ensure that IAS and this RADIUS server are configured to use the same port.


Specifies whether the shared secret configured for authentication requests forwarded to this RADIUS server is also used for accounting messages forwarded to this RADIUS server.


Provides a space for you to type the shared secret that you want to use when forwarding accounting messages to this RADIUS server.

The shared secret is a text string that is used as a special password between the IAS server and this RADIUS server. There are rules you must follow to successfully set up a shared secret:

The shared secret must be exactly the same at both the IAS server and this RADIUS server.

Shared secrets are case-sensitive.

Shared secrets can use any standard alphanumeric and special characters.

Shared secrets should be at least 16 characters long and use a mixture of upper and lowercase letters, numbers, and special characters.

For more information about shared secrets, see Shared secrets in Help.

This option is only available if Use the same shared secret for authentication and accounting is not selected.


Provides a space for you to type the shared secret to confirm its use. This option is only available if Use the same shared secret for authentication and accounting is not selected.


Specifies that IAS will forward to this RADIUS server the Accounting-On message that is sent when a RADIUS client starts up and the Accounting-Off message that is sent when the RADIUS client stops.


Provides a space for you to type the priority of this RADIUS server in the remote RADIUS server group.


Provides a space for you to type the weight of this RADIUS server in the remote RADIUS server group.


Provides a space for you to type the number of seconds after which a response is not received that IAS can consider the request dropped.


Provides a space for you to type the maximum number of dropped requests after which the server is considered unavailable.


Provides a space for you to type the number of seconds after which an authentication request is sent when the server is considered unavailable.


Specifies the value of the Boolean data type for this attribute.


Specifies that the value is true (1).


Specifies that the value is false (0).