Copyright: Saturday, January 04, 2003 15:51:17


Manages Extensible Authentication Protocol (EAP), allowing the addition, removal and ordering of EAP authentication methods.


Adds an EAP authentication method to the list.


Moves an EAP authentication method to a position of lower priority; methods higher in the list are attempted first in negotiations.


Moves an EAP authentication method to a position of higher priority; methods higher in the list are attempted first in negotiations.


Removes an EAP authentication method from the list.


Modifies the smart card or other certificate used as the proof of identity for the server.


Adds an EAP authentication method to the list.


Lists, in priority order, the EAP authentication methods allowed by this server. The first method in the list will be attempted first.


Click to configure settings for the EAP type you selected, such as specifying the use of a smart card or certificate.


Click to permit or deny inbound traffic from remote access clients to the server running Routing and Remote Access based on destination address, destination mask, and protocol.


Click to permit or deny outbound traffic to remote access clients from the server running Routing and Remote Access based on source address, source mask, and protocol.


Click to add a new static route to the list of predefined routes.


Removes a static route from the list of predefined routes.


Click to modify the days and times that connections can be made.


Click to define the destination address, the network mask, and the metric (number of hops) for a static route.


Specifies whether to restrict access based on the type of media used. For example, if you only want to allow connections that use modems, select this check box, and then select the Async check box.


Specifies whether to configure predefined routes for one-way initiated demand-dial routed connections. By selecting this option and defining one or more static routes, the answering router adds the configured routes to its routing table when the demand-dial connection is made. For example, users on a small office LAN may need to communicate with users on a larger main office LAN. By properly defining the static route that corresponds to the small office LAN, the answering router properly delivers packets to the entire range of addresses that exist on the small office LAN. For more information on one-way initiated demand-dial connections, see One-way initiated demand-dial connections in Help. This option is not available for user accounts in a Windows 2000 mixed domain.


Specifies whether this user is required to dial in from a particular number. This option is not available for user accounts in a Windows 2000 mixed domain.


Specifies whether to restrict dial-up access to a single number.


Specifies whether to use the Extensible Authentication Protocol (EAP) for authentication. EAP provides support for a wide range of authentication methods, including token cards, one-time passwords, and public key authentication using smart cards.


Specifies whether to disconnect a connection after no activity occurs for a specific period of time.


Specifies whether to use the Challenge Handshake Authentication Protocol (CHAP). CHAP uses a challenge-response exchange of credentials with Message Digest 5 (MD5) hashing on the response. In this way, the connecting client sends proof of the client password without actually sending the password.

CHAP is widely supported by both access clients and network access servers. Enable CHAP if your access clients require CHAP authentication. CHAP requires the storage of reversibly encrypted passwords for user accounts in the domain. For more information, see CHAP in Help.


Specifies whether to use the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP). MS-CHAP uses a challenge-response exchange of credentials utilizing a Message Digest 4 (MD4) hash of the password on the response. In this way, the connecting client sends proof of the client password without actually sending the password.

MS-CHAP is supported by certain Microsoft Windows access clients and access servers. Enable MS-CHAP if your access clients require MS-CHAP authentication. For more information, see MS-CHAP in Help.


Specifies whether to use version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2). This protocol provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 drops support for the MS-CHAP password change and does not transmit the encoded password. MS-CHAP v2 uses a two-way challenge-response exchange of credentials utilizing encryption of the password on the responses. In this way, the connecting client sends proof of the client password without actually sending the password, and the access server sends proof that it has access to the client password without actually sending the password.

MS-CHAP v2 is supported by certain Microsoft Windows access clients and access servers. For more information, see MS-CHAP version 2 in Help.


Specifies whether to allow unauthenticated connections. A connection is unauthenticated when the access client does not send any credentials during the negotiation of the connection. You can enable unauthenticated connections when you want to allow access clients to connect as a guest using no credentials or when the authentication of the connection is based on the number from which the user is calling. Known as ANI or Caller ID, this type of authentication is used with cellular phones and by some Internet service providers (ISPs).

 For more information, see Unauthenticated access in Help.


Specifies whether to use Password Authentication Protocol (PAP) or Shiva Password Authentication Protocol (SPAP). PAP sends the password over the connection in an unencrypted form. SPAP sends the password over the connection in an encrypted form. Enable PAP or SPAP only when required by your access clients. For more information, see PAP and SPAP in Help.


Specifies whether the use of the Bandwidth Allocation Protocol (BAP) is required for additional multilinked connections.


Specifies whether connections using this remote access policy are restricted to certain days and times.


Lists the days and times during which connections using this remote access policy can be used.


Specifies whether to limit the length of a connection.


Specifies whether to disregard remote access policy profile settings and assign a static TCP/IP address to this user. This option is not available for user accounts in a Windows 2000 mixed domain.


Lists the EAP authentication types that you can use for authentication. For example, if you select Smart card or other certificate, then all connections using this remote access policy that authenticate by using EAP must do so by using a smart card or other type of certificate.


Lists the sec (seconds) or min (minutes) units of time for which Bandwidth Allocation Protocol (BAP) settings are displayed.


Provides a space for you to type the number to call back to.


Provides a space for you to type the number from which this user is required to dial in.


Provides a space for you to type the dial-up number.


Provides a space for you to type the destination network IP address, in dotted decimal notation.


Provides a space for you to type the number of minutes after which an idle connection is disconnected. You can also click the arrows to select a setting.


Provides a space for you to type the static TCP/IP address for this user.


Provides a space for you to type the network mask. A route consists of the combination of the network mask and destination IP address. The network mask is based on your local network subnet requirements. In the network mask, every bit that is set (a value of one) belongs to the Network ID and every bit that is off (a value of zero) belongs to the Host ID. Because of this distinction, a zero value in a network mask can only be followed by other zero values.

For example, a network mask (expressed in dotted decimal notation) of 255.255.0.0 is valid, but 255.0.255.0 is not.


Provides a space for you to type the maximum number of dial-up ports that Multilink can use. You can also click the arrows to select the number.


Provides a space for you to type the number of minutes after which a connection is disconnected. You can also click the arrows to select the number of minutes.


Provides a space for you to type the cost metric to use for this static route. The cost metric typically is the number of hops to the destination network and is displayed in the Metric column of the IP routing table when the connection for this user account is made. If there is only one router between the calling router and the destination network, type 1. If there are multiple routers between the calling router and the destination network, and you want to reflect the cost of reaching the destination network by using this static route, include the number of hops. You can also click the arrows to select the number.


Provides a space for you to type the usage capacity at which you want extra lines to be released. You can also click the arrows to select the usage capacity. The time setting must also be met before the extra line is dropped. For example, if you want a line to be dropped when total line usage is 30 percent or less for at least 40 seconds, type 30 and 40 in the text boxes.

BAP policy only affects those client connections that are configured in Network Connections to Dial devices only as needed. It does not affect those client connections that are configured to Dial all devices or Dial only first available device.

BAP policy does not disconnect the last line in a client connection that is configured in Network Connections to Dial devices only as needed. To disconnect the last line, configure the Disconnect if idle for setting on the Dial-in Constraints tab.


Provides a space for you to type the time at which you want extra lines to be released. You can also click the arrows to select a setting. The usage capacity setting must also be met before the line is dropped. For example, if you want a line to be dropped when total line usage is 30 percent or less for at least 40 seconds, type 30 and 40 in the text boxes.

BAP policy only affects those client connections that are configured in Network Connections to Dial devices only as needed. It does not affect those connections that are configured to Dial all devices or Dial only first available device.

BAP policy does not disconnect the last line in a client connection that is configured in Network Connections to Dial devices only as needed. To disconnect the last line, configure the Disconnect if idle for setting on the Dial-in Constraints tab.


Specifies that IPSec or MPPE encryption is allowed for connections using this remote access policy. For more information, see Microsoft Point-to-Point Encryption (MPPE) or Internet Protocol security (IPSec) in Help.


Specifies that data encryption is required for connections using this remote access policy.


Specifies whether connections using this remote access policy can use IPSec 56-bit DES or MPPE 56-bit data encryption.


Specifies whether connections using this remote access policy can use IPSec Triple DES (3DES) or MPPE 128-bit data encryption.


Specifies whether connections using this remote access policy can use IPSec 56-bit DES or MPPE 40-bit data encryption.


Specifies whether Microsoft 56-bit MPPE is required. This type of encryption is used internationally.


Specifies whether the Microsoft implementation of IPSec by using DES 56-bit encryption is required.


Specifies whether connections using this remote access policy can connect without using data encryption. If this is the only check box selected, then connection attempts using this remote access policy and data encryption are rejected.


Click to add a RADIUS attribute to the list for this remote access policy or connection request policy profile.


Click to modify the settings of the selected RADIUS attribute for this remote access policy or connection request policy profile.


Removes the selected RADIUS attribute from the list for this remote access policy or connection request policy profile.


Lists the RADIUS attributes that are associated with this remote access policy or connection request policy profile.


Lists the RADIUS attributes that you can add to this remote access policy or connection request policy profile. Select an attribute in the list, and then click Add.

For more information about the RADIUS attributes you want to configure, see your network access server (NAS) documentation or RFC 2865, "Remote Authentication Dial-In User Service (RADIUS)."

For more information about the attributes supported by the Routing and Remote Access service, see Remote access RADIUS attributes in Help.


Click to add the selected RADIUS attribute.


Lists the media types that you can select to restrict dial-up access.


Lists the static routes that you can enable for this user account.


Specifies that dial-up, virtual private network (VPN), authenticating switch, or wireless access is allowed for this user subject to authorization by remote access policies.


Specifies that dial-up, virtual private network (VPN), authenticating switch, or wireless access is prohibited for this user.


Specifies that remote access permission for dial-up, virtual private network (VPN), authenticating switch, or wireless access for this user is controlled by remote access policies. The user is granted access if the connection attempt matches a configured remote access policy, the matching remote access policy is configured to Grant remote access permission, and the settings of the connection are allowed by both the matching remote access policy's profile settings and the settings of the user account. Otherwise, the connection attempt is rejected. This option is not available for user accounts in a Windows 2000 mixed domain.


Specifies that a dial-up connection can use more than one line.


Specifies that the settings of the server determine the use of Multilink.


Specifies that a dial-up connection is limited to a single line.


Specifies that the dial-up client may request an IP address.


Specifies that the TCP/IP address assignment settings of the server are used. For example, the server may be configured to dynamically assign TCP/IP addresses as users connect.


Specifies that this user cannot use callback.


Specifies that this user must use callback.


Specifies that the server must supply an IP address.


Specifies that this user can set callback options.


Saves all the changes you have made without closing the dialog box.


Specifies that a configured static IP address is assigned to the connecting client.


Provides a space for you to type the IP address (in dotted decimal notation) for the connecting client.


Specifies whether connecting users are allowed to change their passwords after they expire when they connect using the MS-CHAP v2 authentication protocol.


Specifies whether connecting users are allowed to change their passwords after they expire when they connect using the MS-CHAP authentication protocol.