Internet Authentication Service

Internet Authentication Service (IAS) is a RADIUS server. IAS enables you to centrally manage user authentication, authorization, and accounting, and you can use it to authenticate users in databases on your Windows NT 4.0 or Windows 2000 domain controller. It supports a variety of network access servers (NAS), including Routing and Remote Access. For more detailed information, see Features of IAS.

  • Checklists
  • Best practices
  • How to
  • Concepts
  • Troubleshooting


Checklists

  • Checklist: Configuring IAS for dial-up and VPN access
  • Checklist: Configuring IAS to outsource dial-up access


Checklist: Configuring IAS for dial-up and VPN access

Step | Reference
Review key concepts. | Concepts
Establish an authentication and accounting plan. | Best practices
Install IAS on the servers to be used for primary and backup IAS servers. | Install IAS
Configure the properties of the primary IAS server, including how realms are handled, the ports to be used, and how event logging is to be handled. | Configure IAS properties
Add the network access servers (NASs) and, if applicable, the Point-to-Point Tunneling Protocol (PPTP) servers as clients on the primary IAS server. | Configure clients
Set up the remote access policies for the primary IAS server, including the authentication methods to be used. Configure remote access policies;
Authentication methods
Configure logging methods for user authentication and accounting requests. Configure logging for user authentication and accounting
Copy the IAS configuration from the primary IAS server to the backup IAS server. | Copy the IAS configuration to another server
Register the primary and backup IAS servers in Active Directory as members of the RAS and IAS Servers group. | Enable the IAS server to read user objects in Active Directory
Verify the configuration of RADIUS accounting and authentication on the NASs and, if applicable, PPTP servers, ensuring that IAS is configured on all NASs as the authenticator and accounting provider and that the authentication methods specified on the NASs match those configured on the IAS servers. To use RADIUS authentication;
Remote access;
Manufacturer's documentation
Verify that the NASs are properly configured for dial-up and, if applicable, VPN connections. Routing and Remote Access;
Manufacturer's documentation

Note

  • For more information on how to deploy IAS with Routing and Remote Access, see the Dial-up corporate access deployment scenario.


Checklist: Configuring IAS to outsource dial-up access

Step | Reference
Review key concepts. | Concepts
Establish an authentication and accounting plan. | Best practices
Make sure the firewall is appropriately set up to support IAS. | IAS and firewalls
Install IAS on the servers to be used for primary and backup IAS servers. | Install IAS
Configure the properties of the primary IAS server, including how realms and event logging are handled and the ports to be used. | Configure IAS properties
Add the Internet service provider's (ISP's) RADIUS proxy servers and the Point-to-Point Tunneling Protocol (PPTP) servers as clients on the primary IAS server. Configure clients;
Contact ISP
Set up the remote access policies for the primary IAS server, including the authentication methods to be used. Configure remote access policies;
Authentication methods
Configure logging methods for user authentication and accounting requests. Configure logging for user authentication and accounting;
Copy the IAS configuration from the primary IAS server to the backup and remote IAS servers. | Copy the IAS configuration to another server
Register the primary and backup IAS servers in Active Directory as members of the RAS and IAS Servers group. | Enable the IAS server to read user objects in Active Directory
Verify the configuration of RADIUS accounting and authentication on the PPTP servers, ensuring that IAS is configured on all PPTP servers as the authenticator and accounting provider and that the authentication methods specified on the PPTP servers match those configured on the IAS servers. To use RADIUS authentication;
Remote Access;
Manufacturer's documentation
Verify that the PPTP servers are properly configured for VPN connections. Virtual private networks;
Routing and Remote Access or other
Manufacturer's documentation
Verify the RADIUS proxy server configuration at each ISP. | Contact ISP
Verify that Connection Manager service profiles have been appropriately configured to support access to the corporate network, and that they work correctly (with Connection Point Services support, as appropriate). | Connection Manager Administration Kit

Note

  • For information on how to deploy IAS in environment using outsourced dial-up access, see the Outsourced corporate access through service providers deployment scenario.


Best practices

The following items are recommended for your IAS system.

Installation suggestions

  • Install and test each of your network access servers(through local use) before making them RADIUS clients.
  • After you install and configure IAS, back up the IAS database file Ias.mdb before you run IAS for the first time. The Ias.mdb file is stored in the systemroot\System32\ias folder, where systemroot is the folder in which Windows 2000 system files are located, typically C:\Winnt.

Important

  • You should back up the IAS database whenever there's a change to your IAS configuration. If you do not back up the database and then you inadvertently delete one file in the IAS folder or your system experiences a system-wide corruption, you can lose all of your configuration data.

Security measures

Your IAS server handles private data communications for your organization. This type of information is a popular target for "hacking," so you must make sure the data is safe from unwanted internal and external influences. The following safety measures are essential:

  • Install IAS on a computer dedicated solely as a Remote Authentication Dial-In User Service (RADIUS) server, to eliminate the possibility of unauthorized users gaining access to the system.
  • The IAS computer should also be physically secured. To avoid tampering, install a key switch on the power switch and restrict physical access to the computer.
  • You should protect your IAS server with a firewall. When you configure your firewall, make sure that the ports you are using for RADIUS authentication and accounting are open and allow UDP packet transmission.
  • Use long shared secrets. The longer the secret, the more secure it will be.
  • Turn on the account lockout feature. For more information, see Account lockout.
  • You can also set up your network access servers to try to negotiate a connection using the most secure protocol first, and then the next less secure, and so on to the least secure. For example, a NAS might try to negotiate a connection using EAP, then MS-CHAP, and then finally CHAP.
  • Disable all authentication protocols that your users will not be using.

Important

  • Microsoft strongly recommends that you do not use PAP or LAN Manager protocols for authentication, unless you absolutely have to support clients running legacy software and there is absolutely no way your users can authenticate with other protocols.

Logging

To make the most effective use of IAS logging capabilities:

  • Initially, turn on logging of both authentication and accounting records. Modify these selections after you have determined what is appropriate for your environment.
  • Ensure that event logging is configured with sufficient capacity to maintain your logs. The default is 512KB and, depending on your configuration, should be at least double this size.
  • Back up all log files on a regular basis, as logs cannot be recreated if they are damaged or deleted.
  • Use the class attribute to track usage and simplify identification of which department or user to charge for usage. Although the class attribute is unique for each request, duplicate records may exist in cases where a response to the NAS is lost and the NAS re-sends the request. Depending on how you implement your tracking process, you may need to delete the duplicate requests from your logs to accurately track usage.

Performance-tuning IAS for use in large organizations

  • IAS uses the global catalog in Windows 2000 domains to authenticate users. To minimize latency, install IAS on a server near your global catalog server. For more information on global catalog servers, see Global catalog.
  • If you are using remote access policies to restrict access for all but certain groups, create a Universal Group for all the users to whom you want to allow access, and create a remote access policy that grants access for that universal group. Do not put all your users directly in the Universal Group, especially if you have a large number of users on your network. Create groups within the Universal Group, and add the users in those groups. For more information on universal groups, see Universal, global, and domain local groups. For more information on restricting or granting access to a Windows 2000 group, see Allow connection through group membership.
  • Use a user principal name to refer to users whenever possible. A user can have the same user principal name regardless of what domain the user belongs to. This indirection provides scalability that may be required in organizations with large number of domains.
  • If the IAS server is receiving a very large number of authentication requests per second, you can improve throughput by increasing the number of concurrent authentication calls in progress at one time between the IAS server and the domain controller.

    To do this, edit the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters. Add a new value called MaxConcurrentApi and assign it a value between 2 and 5. For more information on adding values to registry keys, see Add a value.

    • Important

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Notes

  • If you assign too high a value to MaxConcurrentAPI, your IAS server could place an excessive load on your domain controller.
  • If you have a computer running Windows 2000 Advanced Server, you can use the Network Load Balancing component (previously known as WLBS) of Windows 2000 Advanced Server to distribute incoming access requests among multiple IAS servers. This helps them perform better when traffic is high.


How to...

  • Install IAS
  • Copy the IAS configuration to another server
  • Enable reversibly encrypted passwords in a domain
  • Enable the IAS server to read user objects in Active Directory
  • Start or stop IAS
  • Configure IAS properties
  • Configure clients
  • Configure remote access policies
  • Configure logging for user authentication and accounting


Install IAS

To install IAS

  1. Insert the Windows 2000 Server compact disc and start the Setup program.
  2. Click Install Add-On Components, and then click Add/Remove Windows Components.
  3. In Components, click Networking Services (but do not select or clear its check box), and then click Details.
  4. Select the Internet Authentication Service check box, and then click OK.
  5. Click Next.


Copy the IAS configuration to another server

To copy the IAS configuration to another server

  1. At a command prompt, type netsh aaaa show config <path>\file.txt. This stores the configuration settings, including registry settings, in a text file. The path can be relative, absolute, or a UNC path.
  2. Copy the file you created to the destination computer, and at a command prompt on the destination computer, type netsh exec <path>\file.txt. A message appears indicating whether the update was successful.

Notes

  • You do not need to stop IAS on the destination computer to run the netsh exec command. When the command is run, IAS is automatically refreshed with the updated configuration settings.
  • This procedure will not work if the source and destination computer are running different versions of Windows 2000.
  • This procedure replicates all IAS, remote access policy, registry, and logging configuration.

Related Topics


Enable the IAS server to view user objects in Active Directory

To enable the IAS server to read user objects in Active Directory

  1. Log on to the IAS server with an account that has domain administrator credentials.
  2. Open Internet Authentication Service.
  3. Right-click Internet Authentication Service, and then click Register Service in Active Directory. When the Register Internet Authentication Service in Active Directory dialog box appears, click OK.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • This procedure only adds the IAS server to the default domain. To add the IAS server to other domains, you must add the servers manually. To do this:
    1. Log on the server using domain administrator credentials.
    2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
    3. In the console tree, select Users.
    4. In the details pane, right-click RAS and IAS Servers, and then click Properties.
    5. In the RAS and IAS Servers Properties dialog box, on the Members tab, add each of the IAS servers.
  • After you register the service in Active Directory, it is a good idea to verify the security settings. For more information, see Related Topics.
  • For more detailed information on how IAS or Routing and Remote Access servers work as stand-alone Windows 2000 servers, member servers in Windows NT 4.0 domains, or member servers in mixed-mode or native-mode Windows 2000 domains, see Related Topics.

Related Topics


Start or stop IAS

To start or stop IAS

  1. Open Internet Authentication Service.
  2. In the console tree, right-click Internet Authentication Service, and then click Start Service.

    Or, to stop the service, click Stop Service.

Note

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure IAS properties

  • Configure IAS port information
  • Configure realm replacement in IAS
  • Configure event logging for IAS


Configure IAS port information

To configure IAS port information

  1. Open Internet Authentication Service.
  2. Right-click Internet Authentication Service, and then click Properties.
  3. Click the RADIUS tab, and then examine the settings for ports. If your RADIUS authentication and RADIUS accounting UDP ports differ from the default values provided (1812,1645 for authentication and 1813,1646 for accounting), in Authentication and Accounting, type your port settings.

    To use multiple port settings for authentication or accounting requests, separate the ports by using commas.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • To configure a remote IAS server, you must have administrative privileges on the remote server.
  • The values of 1812 for authentication and 1813 for accounting are the RADIUS standards at this time. However, many network access servers use port 1645 for authentication requests and 1646 for accounting requests by default. Whichever port you choose to use, make sure that IAS and your NAS are configured to use the same port.

Related Topics


Configure realm replacement in IAS

To configure realm replacement in IAS

  1. Open Internet Authentication Service.
  2. Right-click Internet Authentication Service, and then click Properties.
  3. Click the Realms tab.
  4. To change realm information, do one of the following:
    • To remove a realm substitution from the list on the Realms tab, click the substitution and then click Remove.
    • To change a realm substitution in the list on the Realms tab, click the substitution, click Edit, and then make the changes you want.
    • To add a realm to the list, click Add; in Find, type the pattern you want to replace (including any separator characters), and then, in Replace, type the string you want to replace it with.
    • To delete the realm from the user name, leave Replace blank.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • IAS will execute each realm replacement rule, so make sure the realm substitutions are in the proper order. For example, if someone logs on using the user name someone@electronic and the first rule calls for the realm @electronic to be replaced with @electronic.co.uk, and the second rule calls for the realm @electronic.co.uk to be replaced with @electronic.com, IAS will forward the authentication request as someone@electronic.com.
  • The original string in the realm name must not be blank. The replacement string can be blank. Both strings can contain any printable character.

Related Topics


Configure event logging for IAS

To configure event logging for IAS

  1. Open Internet Authentication Service.
  2. Right-click Internet Authentication Service (IAS), and then click Properties.
  3. On the Service tab, select each option that is appropriate, and then click OK.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • Selecting Log successful authentication requests can result in extremely large amounts of data being logged. Before selecting this option, verify that the Event Viewer is configured with a maximum log size that will accommodate this type of event logging.

Related Topics


Configure clients

  • Register RADIUS clients


Register RADIUS clients

To register RADIUS clients

  1. Open Internet Authentication Service.
  2. Right-click Clients, and then click New Client.
  3. In Friendly name, type a descriptive name.
  4. In Protocol, click RADIUS, and then click Next.
  5. In Client address (IP or DNS), type the DNS or IP address for the client. If you are using a DNS name, click Verify. In the Resolve DNS Name dialog box, click Resolve, and then select the IP address you want to associate with that name from Search Results.
  6. If the client is a NAS and you are planning to use NAS-specific remote access policies for configuration purposes (for example, a remote access policy that contains vendor-specific attributes), click Client Vendor, and select the manufacturer's name. If you do not know the manufacturer or it is not in the list, click RADIUS Standard.
  7. In Shared secret, type the shared secret for the client, and then type it again in Confirm shared secret.
  8. If your NAS supports using digital signatures for verification (with PAP, CHAP, or MS-CHAP), click Client must always send the signature attribute in the request. If the NAS does not support digital signatures for PAP, CHAP, or MS-CHAP, do not click this option.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • If IAS receives an access request from a RADIUS proxy server, IAS cannot detect the manufacturer of the NAS that originated the request. This can cause problems if you plan to use authorization conditions based on the client vendor and have at least one client defined as a RADIUS proxy server.
  • Passwords (shared secrets) are case-sensitive. Be sure that the client's shared secret and the shared secret you enter in this field are identical to each other and conform with the password rules. For more information, see Related Topics.
  • If the client address cannot be resolved when you click Verify, make sure the DNS name you entered is correct.
  • The friendly name that you provide for your RADIUS clients can be used in remote access policies to restrict access.

Related Topics


Configure remote access policies

  • Add a remote access policy
  • Configure a remote access policy to grant or deny access
  • Configure a condition of a remote access policy
  • Configure a profile for a remote access policy
  • Change the policy evaluation order
  • Rename a remote access policy
  • Delete a remote access policy


Add a remote access policy

To add a remote access policy

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, right-click Remote Access Policies, and then click New Remote Access Policy.
  3. In the policy Properties dialog box, under Policy friendly name, type the name of the policy.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.

Related Topics


Configure a remote access policy to grant or deny access

To configure a remote access policy to grant or deny access

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to configure, and then click Properties.
  4. Under If a user matches the conditions:
    • To grant dial-up permission to these users, click Grant remote access permission.
    • To deny dial-up permission to these users, click Deny remote access permission.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • The setting of Remote Access Permission on the user object will override this setting if set to either Grant remote access permission or Deny remote access permission.


Configure a condition of a remote access policy

To configure a condition of a remote access policy

  1. Do one of the following:
    • Open Routing and Remote Access, double-click Routing and Remote Access, and then double-click the server name to expand the console tree.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to configure, and then click Properties.
  4. To configure a new condition, click Add, and then do the following:
    • In the Select Attribute dialog box, click the attribute to add, and then click OK.
    • In the attribute dialog box, configure the attribute, and then click OK.
  5. To change the configuration of an existing condition:
    • Click the condition, and then click Edit.
    • In the attribute dialog box, specify the settings you want, and then click OK.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure a profile for a remote access policy

  • Configure dial-in constraints
  • Configure IP options
  • Configure multilink options
  • Configure authentication
  • Configure encryption
  • Configure attributes for a profile


Configure dial-in constraints

To configure dial-in constraints

  1. Do one of the following:
    • Open Routing and Remote Access, double-click Routing and Remote Access, and then double-click the server name to expand the console tree.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the remote access policy you want to configure, and then click Properties.
  4. Click Edit Profile.
  5. On the Dial-in Constraints tab, specify settings, as needed.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • Dial-in constraints should work with most network access servers, but some network access servers may not support RADIUS attributes necessary to enable dial-in constraints. For more information, see your NAS documentation.


Configure IP options

To configure IP options

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the remote access policy you want to configure, and then click Properties.
  4. Click Edit Profile.
  5. On the IP tab, specify settings, as needed.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure multilink options

To configure multilink options

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the remote access policy you want to configure, and then click Properties.
  4. Click Edit Profile.
  5. On the Multilink tab, specify settings, as needed.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure authentication

To configure authentication

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to configure, and then click Properties.
  4. Click Edit Profile.
  5. On the Authentication tab, specify settings, as needed.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • For information on configuring specific authentication protocols, see Related Topics.

Related Topics


Configure encryption

To configure encryption

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the remote access policy you want to configure, and then click Properties.
  4. Click Edit Profile.
  5. On the Encryption tab, specify settings, as needed.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure attributes for a profile

  • Add RADIUS attributes to a remote access policy
  • Configure vendor-specific attributes for a remote access policy


Add RADIUS attributes to a remote access policy

To add RADIUS attributes to a remote access policy

  1. In IAS, click Remote Access Policies.
  2. Right-click the policy for which you want to configure a RADIUS attribute, and then click Properties.
  3. Click Edit Profile, click the Advanced tab, and then click Add.
  4. In the list of available RADIUS attributes, double-click the attribute you want to add to the profile. If the Multivalued Attribute Information dialog box appears, click Add.
  5. In Attribute value, supply the value as indicated in the following table, and then click OK. If you need to add another value to the attribute, click Add again, and then configure the attribute.
If the attribute format is | In Attribute value | Attributes in this format include
Integer | Type the value specified in your NAS documentation. | Acct-Interim-Interval.
Enumerator | Select the value from the list. | Framed-Protocol.
InetAddr | Type the IP address to be specified in the attribute. | Framed-IP-Netmask.
Octet String | Type the string or the hexadecimal value you need to provide. | Tunnel-Password.
String | Type the string you need to provide. | Reply-Message.

Related Topics


Configure vendor-specific attributes for a remote access policy

To configure vendor-specific attributes for a remote access policy

  1. Open Internet Authentication Service.
  2. In IAS, click Remote Access Policies.
  3. Right-click the policy for which you want to configure a vendor-specific attribute (VSA), and then click Properties.
  4. Click Edit Profile, click the Advanced tab, and then click Add.
  5. Look at the list to see whether your vendor-specific attribute is already in the list of available RADIUS attributes. If it is, double-click it, and then configure it as specified in your NAS documentation. If the vendor-specific attribute is not in the list of available RADIUS attributes:
    1. Double-click Vendor-Specific, and then click Add.
    2. Specify the vendor for your network access server.

      To specify the NAS vendor by selecting the name from the list, click Select from list, and then select the vendor of the NAS for which you are configuring the VSA. If you are using Routing and Remote Access as your NAS, click Microsoft. If the vendor is not listed, specify the vendor by typing the vendor code.

      To specify the NAS vendor by typing the vendor code, click Enter Vendor Code and then type the vendor code in the space provided. (If you do not know the vendor code for your NAS, see IETF RFC 1007 for a list of SMI Network Management Private Enterprise Codes.)

    3. Specify whether the attribute conforms to the RADIUS RFC VSA specification. If you are not sure, see your NAS documentation.
      • If your attribute conforms, click Yes. It conforms, and then click Configure Attribute.
        1. In Vendor-assigned attribute number, type the number assigned to the attribute (this should be an integer between 0 and 255, inclusive).
        2. In Attribute format, specify the format for the attribute, and then in Attribute value, type the value you are assigning to the attribute.
      • If the attribute does not conform, click No, it does not conform, and then click Configure Attribute. In Hexadecimal attribute value, type the value for the attribute.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • To see configuration examples for vendor-specific attributes that conform or do not conform to the RADIUS RFC, see Related Topics.

Related Topics


Change the policy evaluation order

To change the policy evaluation order

  1. Do one of the following:
    • Open Routing and Remote Access, and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to move, and then click either Move Up to move the policy up one level or Move Down to move the policy down one level.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Rename a remote access policy

To rename a remote access policy

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, expand Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, expand Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to rename, and then click Rename.
  4. Type a new name for the policy, and then press ENTER.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Delete a remote access policy

To delete a remote access policy

  1. Do one of the following:
    • Open Routing and Remote Access and, if necessary, double-click Routing and Remote Access and the server name.
    • Open Internet Authentication Service and, if necessary, double-click Internet Authentication Service.
  2. In the console tree, click Remote Access Policies.
  3. In the details pane, right-click the policy you want to delete, and then click Delete.

Notes

  • To open Routing and Remote Access, click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  • To open Internet Authentication Service, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.


Configure logging for user authentication and accounting

  • Select requests to be logged
  • Configure log file properties


Select requests to be logged

To select requests to be logged

  1. Open Internet Authentication Service.
  2. In the console tree, click Remote access logging.
  3. In the details pane, right-click Local File, and then click Properties.
  4. On the Settings tab, select one or more check boxes for recording authentication and accounting requests in the IAS log files:
    • To capture accounting requests and responses, select the Log accounting requests check box.
    • To capture authentication requests, access-accept packets, and access-reject packets, select the Log authentication requests check box.
    • To capture periodic status updates, such as interim accounting packets, select the Log periodic status check box.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • It is suggested that you initially select the first two options. You can change the selections if needed to fit your requirements.
  • The Log authentication requests option can help by alerting you to problems with transaction volume and of unauthorized attempts to access resources.
  • If you select Log periodic status, attributes are logged only if you have configured the Acct-Interim-Interval attribute to generate the interim accounting requests. To configure this attribute for remote access policies in IAS, do the following:
    1. In the IAS console tree, click Remote Access Policies.
    2. Right-click the policy for which interim accounting requests are to be generated, and then click Properties.
    3. On the Settings tab, click Edit profile.
    4. On the Advanced tab, click Add.
    5. In the Add Attributes dialog box, select Acct-Interim-Interval, and then click Add.
    6. In the Attribute Information dialog box, in Attribute value, type the interval for generating interim accounting requests. For instance, type 600 to generate the requests every 600 seconds. The recommended value is 600.


Configure log file properties

To configure log file properties

  1. Open Internet Authentication Service.
  2. In the console tree, click Remote access logging.
  3. In the details pane, right-click Local File, and then click Properties.
  4. On the Local File tab, click Database-import format.

    Or, to keep your log files in IAS format, click IAS format .

    Note

    • Although IAS provides two format options for log files, it is recommended that you use the database-import log format, which uses a consistent structure for all requests and can facilitate importing data into databases.
  5. To open a new log file at specific intervals, click the interval you want to use:
    • To handle heavy transaction volume and logging activity, click Daily.
    • To handle lesser transaction volumes and logging activity, click Weekly or Monthly.
    • To store all transactions in one log file, click Unlimited file size.
    • If you are unsure of the transaction volume, click When log file size reaches, and then type a log size at which a new log should be opened. The default is 10 MB.
  6. In Log file directory, enter the location where log log files are to be stored. The default location is the systemroot\system32\LogFiles folder.

    Note

    • It is possible for logs to fill an entire partition, so it is recommended that you specify a location that is not in the system partition.
  7. Note Log file name used for this log, and then click OK.

Notes

  • To open IAS, click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  • Switching log file formats does not cause a new log to start. If you change log file formats, the file active at the time of the change will contain a mixture of the two formats (records at the start of the log will have the previous format, and records at the end of the log will have the new format).
  • To prevent the log files from filling the hard drive on which you are storing them, it is strongly suggested that you keep them on a separate volume with a low quota, not on the system partition.
  • You must back up or delete the logs on a regular basis, regardless of the interval you specify in the procedure above.
  • If you are administering an IAS server other than your local computer, you cannot browse the directory structure to find a directory path. If you need to log accounting information to a remote server, specify the log file name by entering a Universal Naming Convention (UNC) name, such as \\MyLogServer\LogShare.

Related Topics


Concepts

  • IAS overview
  • Understanding IAS
  • Using IAS
  • Resources


IAS overview

  • Features of IAS
  • How IAS works
  • RADIUS
  • Behavior differences between Windows 2000 IAS and Windows NT 4.0 IAS


Features of IAS

The Internet Authentication Service (IAS) component of Microsoft Windows 2000 Server performs centralized authentication, authorization, auditing, and accounting of users who connect to a network using virtual private network (VPN) and dial-up functionality.

IAS implements the IETF standard Remote Authentication Dial-In User Service (RADIUS) protocol, which enables use of a homogeneous or heterogeneous network of dial-up or VPN equipment.

The IAS features include:

  • Centralized user authentication. The authentication of users is an important security concern. IAS supports a variety of authentication protocols and allows you to plug in arbitrary authentication methods to meet your authentication requirements. The supported authentication methods are:
    • Authentication protocols within PPP, such as Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), and Extensible Authentication Protocol (EAP).
    • Extensible Authentication Protocol (EAP). An infrastructure that allows the addition of arbitrary authentication methods such as Smart Cards, certificates, one-time passwords, and Token Cards.
    • Dialed Number Identification Service (DNIS). This method is based on the number called by the user.
    • Automatic Number Identification Service (ANI). This method is based on the number the user called from. ANI is also known as Caller ID.
    • Guest Authentication.
  • Outsourcing remote access, and getting worldwide remote access. Outsourced dialing (also referred to as wholesale dialing) involves a contract between an organization or private company (the customer) and an Internet service provider (ISP) in which the ISP allows the company's employees to connect to the ISP's network before establishing the VPN tunnel to the company's private network. When an employee connects to the ISP's NAS, the authentication and usage records are forwarded to the IAS server at the company. The IAS server allows the company to control user authentication, track usage, and manage which employees are allowed to access the ISP's network.

    The advantage of outsourcing is the potential savings. By using an ISP's routers, network access servers, and T1 lines instead of buying your own, you could save a great deal on hardware (infrastructure) costs. By dialing into the ISP's with worldwide connections, or roaming consortium's scattered Points of Presence (POPs) , you could significantly decrease your long-distance phone bill. And by passing off support to the provider, you could eliminate a large amount of your administrative budget.

  • Centralized user authorization. To grant the connecting user appropriate access to the network, IAS authenticates users in Microsoft Windows NT 4.0 domains and Windows 2000 Active Directory. IAS supports new features in Active Directory, such as User Principal Names (UPNs), and Universal Groups.

    Remote Access Policies provide flexibility in controlling who is allowed to connect to your network. Although it is simple to manage remote access permission for each user account, this approach can become unwieldy as your organization grows. Remote Access Policies provide a more powerful and flexible way to manage remote access permission.

    Remote Access Policies are a set of conditions that allow network administrators more flexibility in granting remote access.

    Policies allow you to control remote access based on:

    • User membership in a Windows 2000 security group. You can use existing Windows 2000 security groups to allow or deny access to users.
    • The time or day of the week.
    • The type of media through which the user is connecting (for example, ISDN, modem, or VPN tunnel)
    • The phone number the user calls. (DNIS authorization
    • The phone number the user calls from.
    • Whether the user is connecting through a partner's network in a roaming consortium.
    • The RADIUS client from which the request arrived.
  • Centralized administration of all your network access servers. Support for the RADIUS standard allows IAS to control connection parameters for any NAS that implements that standard. The RADIUS standard also allows individual remote access vendors to create proprietary extensions called vendor-specific Attributes. IAS has incorporated the extensions from a number of vendors in its multivendor dictionary.

    Remote Access Policies give network administrators more flexibility in managing varying connection parameters by providing the capability to create conditional profiles. You can use profiles to configure the user's network connection parameters.

    The conditions, under which the connection parameters (a profile) can be changed, include:

    • The time or day of the week.
    • The type of media over which the user is connecting (for example, ISDN, modem, or VPN tunnel).
    • The vendor of the NAS that the user is connecting to.
    • User membership in a Windows 2000 security group.
    Using profiles, you can control connection parameters. For example, you can:
    • Permit or deny the use of certain authentication methods.
    • Control the amount of time the connection can be idle.
    • Control the maximum time of a single session.
    • Control the number of links in a multilink session.
    • Control encryption settings.
    • Add packet filters to control what the user can access when connected to the network. For example, you can use filters to control which IP Addresses, hosts, and ports the user is allowed to send or receive packets.
    • Create a compulsory tunnel that forces all packets from that connection to be securely tunneled through the Internet and terminated in a private network.
  • Centralized auditing and usage accounting. Support for the RADIUS standard allows IAS to collect the usage (accounting) records sent by the NAS at a single point. IAS logs audit information (for example, authentication success, rejects, and auto-account lockout) and usage information (for example, logon and logoff records) to log files. IAS supports a log-file format that can be directly imported into a database. The data can be analyzed by using any data-analysis package.
  • Integration with Windows 2000 Routing and Remote Access IAS is integrated with Routing and Remote Access. IAS and Routing and Remote Access share remote access policies and accounting capabilities. This integration provides consistent implementation across IAS and Routing and Remote Access. It allows you to deploy Routing and Remote Access in small sites without the need for a separate centralized IAS server, and also provides the capability to scale up to a centralized remote access management model, when you have multiple Routing and Remote Access servers in your organization. In this case IAS in conjunction with Routing and Remote Access servers implements a single point of administration for remote access to your network for outsourced-dial, demand-dial and VPN access. The policies within IAS at a central large site can be exported to the independent Routing and Remote Access server in a small site.
  • Graphical user interface. IAS provides a graphical user interface ( MMC snap-in) that enables you to configure local or remote servers.
  • Remote monitoring. You can monitor IAS through Windows 2000 tools such as Event Viewer or System Monitor, or by using Simple Network Management Protocol (SNMP).
  • Scalability. You can use IAS in a variety of network configurations of varying size, from stand-alone servers for small networks to large corporate and ISP networks.
  • Import/Export of configuration to manage multiple IAS servers. IAS configuration can be imported/exported through a command line utility. For more information see Netshell commands for Remote Access.

Adding features to IAS

The Windows 2000 Software Development Kit (SDK) contains two smaller SDKs, the IAS SDK and the EAP SDK.

IAS SDK can be used to implement the following features:

  • Return custom attributes to the NAS in addition to those returned by IAS. This enables you to build your own plug-in for assigning IP Addresses.
  • The capability to control the number of end-user network sessions.
  • Extension of the remote access authorizations currently provided by IAS.
  • The capability to import usage/audit data directly into an Open Database Connectivity (ODBC)-compliant database.
  • Custom (non-EAP) authentication methods for IAS.

The EAP SDK provides the capability to implement arbitrary authentication methods.


How IAS works

Internet Authentication Service (IAS) is a RADIUS server. IAS enables you to centrally manage user authentication, authorization, and accounting, and you can use it to authenticate users in databases on your Windows NT 4.0 or Windows 2000 domain controller. It supports a variety of network access servers (NAS), including Routing and Remote Access.

IAS centrally manages authentication for NASs in the network

In this illustration, the IAS server is acting as a central conduit through which all authentication and accounting requests flow from the network access servers. IAS is also recording information about the requests and the connections in a log.

Routing and Remote Access can authenticate directly against the domain controller, authorize users by using Remote Access Policies, and log information directly to the IAS log file. You can also centrally manage these features through IAS by configuring Routing and Remote Access to use RADIUS Authentication and RADIUS Accounting. If you have more than one Routing and Remote Access service, with IAS you can modify policies on one server instead of many, and you can collect all the auditing and accounting information at a central place. If you decide to outsource remote access to ISPs, then the IAS service can also provide authentication, authorization and logging services for the outsourced connection. For more information, see the Outsourced corporate access through service providers deployment scenario.

IAS can also be used by ISPs to manage subscribers. If you are managing an ISP and you want to maintain multiple service plans, you easily can set up remote access policies to restrict premium access methods to users who pay a surcharge. For more information, see the Internet accessdeployment scenario.

IAS authentication process

IAS is a RADIUS server and uses user data stored in a Windows 2000 domain controller (or local Security Accounts Manager (SAM)) to verify authentication requests received through the RADIUS protocol. The following steps describe a typical interaction between a NAS and the IAS server. The actual interaction may vary at your site, depending on which NAS you have and the way you have configured it.

  • When the NAS is started, an accounting-start packet is sent (and logged).
  • When a remote user dials in to a network access server, the following authentication process takes place and all requests and responses are logged:
    1. If the NAS is configured to do so, the NAS tries to negotiate a connection using the most secure protocol first, then the next less secure, and so on down to the least secure (for example, negotiate a connection using EAP, then MS-CHAP, and finally CHAP).
    2. The NAS sends the RADIUS authentication request to the IAS server. To do so, it creates an Access-Request packet containing such Attributes as the user's name, the user's password, the ID of the client and the Port ID the user is accessing. The Access-Request is submitted to the IAS server via the network. If no response is returned within a length of time, the request is re-sent a number of times.
    3. If the user is authentic, the IAS server evaluates the remote access policies and the user's dial-in properties to decide whether to accept or reject the request. If the user's attempt to connect matches conditions in at least one policy and that policy grants access to the user, IAS sends an Access-Accept packet to the user. The Access-Accept packet also contains user authorization information based on the user profile and Remote Access Policies. The NAS interprets this authorization data to determine the network privileges that the server has authorized.

      If the user's attempt to connect does not match conditions in at least one policy, or matches conditions in a policy that denies access, IAS sends an ACCESS-REJECT packet to the NAS, and the NAS disconnects the user.

  • When the remote user's connection is established, the NAS sends an accounting-start request to the IAS server (and logged).
  • During the time the connection is established, the NAS sends interim accounting requests to the IAS server (and logged)
  • When the remote user's connection is closed, the NAS sends an accounting-stop request to the IAS server (and logged).
  • When the network access server is stopped, an accounting-stop request is sent to the IAS server (and logged)
  • If the NAS does not get a response to an accounting request within its timeout period, it resends the request and then sends the accounting-request to the backup server. For example, if the IAS server cannot log the request (for example, if the log file is full), it silently discards the packet. Then the NAS or RADIUS proxy retransmits the request to the IAS server and then sends the request to the backup IAS server, which attempts to write the accounting-request to its log file.
  • If the NAS does not get a response to an authentication request within its timeout period, it resends the request and then sends the request to the backup IAS server. For example, if the IAS server cannot connect to the domain controller, or cannot find the domain controller the user belongs to, it silently discards the packet. Then the NAS or RADIUS proxy retransmits the request and then sends it to the backup IAS server, which then attempts to authenticate the user against the domain's database. If the backup IAS server does not respond, the NAS disconnects the user.

When IAS sends an Access-Accept packet to the NAS, it tells the NAS that the user is allowed to connect to the network. It also tells the NAS the privileges for which the user is authorized, based on the user profile and remote access policies. NAS equipment interprets network parameters to permit only the network privileges that the server has authorized.

Any server that can send requests to an IAS server is a client. Clients can be NAS or other RADIUS servers. A NAS is a client when IAS is receiving requests directly from the NAS. A RADIUS server is a client when it forwards an authentication request from its client NAS to your local IAS server. For more information, see To register RADIUS clients.


Behavior differences between Windows 2000 IAS and Windows NT 4.0 IAS

A previous version of IAS was released with the Windows NT 4.0 Option Pack. The following table describes the differences in behavior between the two versions.

Windows NT 4.0 IAS behavior | Windows 2000 IAS behavior
If no domain name is specified during authentication, the IAS server authenticates the user only against the local SAM database. IAS resolves a user name with no domain specified using the following sequence:
  1. IAS determines a default domain from the registry, if one is specified there.
  2. If the IAS server is a member of a domain, IAS authenticates the user against that domain.
  3. If the IAS server is not a member of a domain, IAS authenticates the user against the local SAM database.
IAS does not use the callback permissions for all user objects. | IAS uses the callback permissions for all user objects.
IAS log files are written in ASCII. | IAS log files are multi-language and are written in UTF-8.


Understanding IAS

  • RADIUS clients
  • Security
  • Vendor-specific attribute overview
  • Authentication methods
  • Remote access policies
  • Remote access logging


RADIUS clients

A RADIUS client can be a NAS or a RADIUS proxy. IAS supports all NASs that are compliant with RADIUS RFC 2138.

  • Realm names
  • Specifying an address for a RADIUS client
  • Pattern matching syntax


Realm names

In general, realm names are used for network routing and authentication. They provide the identification necessary to forward authentication requests to the server that holds the user's credentials. For example, if your corporation has a wholesale-dial partnership with an ISP, your users' user names will have to include realm information so that the authentication requests can be forwarded to the appropriate RADIUS server.

IAS does not use realm names for routing purposes, but if it receives authentication requests from servers that do, it can strip the realms from the user names before authenticating the names against the domain controller, provided the realm-stripping rules are set up correctly.

A realm name can be a prefix (such as electronic/) or suffix (such as @electronic). The realm name includes any separator characters, such as the at sign (@) or the slash (/). You can require the user to include the realm name as part of the user name at logon. Depending on the dialing program used to access the network, you can also have the dialing program automatically append a prefix or suffix. (You can use the Connection Manager Administration Kit to set up Connection Manager to do this. For more information, see Connection Manager Administration Kit.)

If your users log on using realm names, IAS must remove the realm information before forwarding the request to the domain controller.

Character substitution syntax

The realm replacement feature uses regular expression syntax. For more information about this syntax, see Pattern matching syntax.


Specifying an address for a RADIUS client

You can specify the address for RADIUS clients by IP address or DNS name.

Specifying a RADIUS client by IP address

In most cases, it is better to specify RADIUS clients by IP address because IAS won't need to resolve host names at startup. As a result, IAS will start much more quickly than if you used DNS names, especially if your network contains a large number of RADIUS clients. Also, you won't need to have a name server available when IAS starts.

Specifying a RADIUS client by DNS name

Use DNS names to specify RADIUS clients only if you want more than your usual administrative flexibility; for example, if you want to map multiple IP addresses of RADIUS clients to a single DNS name.


Pattern matching syntax

Windows 2000 supports the use of the pattern matching syntax that is widely used in UNIX environments. You can use this syntax to specify the conditions of remote access policy attributes and RADIUS realms. The following table describes the special characters that you can use and includes examples.

Character | Description | Example
\ | Marks the next character as special. | /n/ matches the character "n". The sequence /\n/ matches a line feed or newline character.
^ | Matches the beginning of input or line. |
$ | Matches the end of input or line. |
* | Matches the preceding character zero or more times. | /zo*/ matches either "z" or "zoo."
+ | Matches the preceding character one or more times. | /zo+/ matches "zoo" but not "z."
? | Matches the preceding character zero or one time. | /a?ve?/ matches the "ve" in "never."
. | Matches any single character except a newline character. |
(pattern) | Matches pattern and remembers the match. To match parentheses characters ( ), use "\(" or "\)". |
x|y | Matches either x or y. | /z|food?/ matches "zoo" or "food."
{n} | n is a nonnegative integer. Matches exactly n times. | /o{2}/ does not match the "o" in "Bob," but matches the first two o's in "foooood."
{n,} | n is a nonnegative integer. Matches at least n times. | /o{2,}/ does not match the "o" in "Bob" but matches all the o's in "foooood." /o{1,}/ is equivalent to /o+/.
{n,m} | m and n are nonnegative integers. Matches at least n and at most m times. | /o{1,3}/ matches the first three o's in "fooooood."
[xyz] | A character set. Matches any one of the enclosed characters. | /[abc]/ matches the "a" in "plain."
[^xyz] | A negative character set. Matches any character not enclosed. | /[^abc]/ matches the "p" in "plain."
\b | Matches a word boundary, such as a space. | /ea*r\b/ matches the "er" in "never early."
\B | Matches a nonword boundary. | /ea*r\B/ matches the "ear" in "never early."
\d | Matches a digit character. Equivalent to [0-9]. |
\D | Matches a nondigit character. Equivalent to [^0-9]. |
\f | Matches a form-feed character. |
\n | Matches a line feed character. |
\r | Matches a carriage return character. |
\s | Matches any white space including space, tab, form-feed, and so on. Equivalent to [ \f\n\r\t\v]. |
\S | Matches any non-white-space character. Equivalent to [^ \f\n\r\t\v]. |
\t | Matches a tab character. |
\v | Matches a vertical tab character. |
\w | Matches any word character including underscore. Equivalent to [A-Za-z0-9_]. |
\W | Matches any nonword character excluding underscore. Equivalent to [^A-Za-z0-9_]. |
\num | ?num, where num is a positive integer. A reference back to remembered matches. \1 replaces what is stored in the first remembered match. This option can be used only in the Replace text box when configuring realms with Internet Authentication Service. See the examples. |
/n/ | ?n, where n is an octal, hexadecimal, or decimal escape value. Allows embedding of ASCII codes into regular expressions. |

Examples for remote access policy attributes

The following examples describe the use of the pattern matching syntax to specify remote access policy attributes:

  • To specify all phone numbers within a fixed area code

    • For example, to specify all numbers in the 899 area code, the syntax is:

    899.*

  • To specify a range of IP addresses

    • For example, to specify all IP addresses that begin with 192.168.1, the syntax is:

    192\.168\.1\..+

Examples for RADIUS realm name replacement

The following examples describe the use of the pattern matching syntax to replace realm names in IAS properties, on the Realms tab, in Find and Replace:

  • To remove the realm portion of the user name

    • In the outsourced dial scenario, the Internet service provider (ISP) might require a realm to route the authentication request to the Internet Authentication Service (IAS) server. Windows 2000 might not recognize the realm, which should be removed (by leaving Replace blank) before authenticating the user.

    • Find: @microsoft\.com
    • Replace:
  • To replace user@domain.com with domain.com\user
    • Find: (.*)@(.*)
    • Replace: $2\$1
  • To replace domain\user with specific_domain\user
    • Find: (.*)@(.*)
    • Replace: specific_domain\$2
  • To replace user with user@specific domain
    • Find: $
    • Replace: @specific_domain

For more information, see To configure realm replacement in IAS.


Security

  • IAS and firewalls
  • Shared secrets
  • IAS and tunnels
  • Account lockout


IAS and firewalls

Before you begin, make sure the firewall is set up between your IAS server and the Internet connection.

When you set up the firewall conditions, you should explicitly permit access to packets that meet all of the following conditions:

  • The packet is sent with the UDP protocol.
  • The packet is coming from or going to the IP address of the IAS server.
  • The packet is coming from or going to the RADIUS port of the IAS server.

For added security, if you know the IP address of the RADIUS client sending the packets through the firewall, you can also restrict incoming access to packets received from only that IP address.


Shared secrets

A shared secret is a text string that serves as a special password between an IAS RADIUS server and the servers connected to it.

Each IAS server must have a shared secret for each NAS or other RADIUS server that forwards RADIUS requests to it.

There are a few rules you must follow to successfully set up a shared secret. Shared secrets:

  • Must be exactly the same on both servers.
  • Are case-sensitive.
  • Can use any standard alphanumeric and special characters. Using combinations of uppercase and lowercase letters, numbers, and special characters will make the shared secret more secure.
  • Can be up to 255 characters long. Long shared secrets are more secure than shorter ones.


IAS and tunnels

Tunneling (encapsulation) results in the original packet being hidden or encapsulated inside a new packet. This new packet provides the necessary routing information, enabling the packet to travel through transit internetworks without revealing the final destination stored in the original packet header. The transit internetwork could be any internetwork: a private intranet, or the Internet. Once the encapsulated packets reach their destination, the encapsulation header is removed and the original packet header is used to route the packet to its final destination. The entire process of encapsulation, routing, and de-encapsulation is called tunneling.

There are two types of tunnels: voluntary and compulsory. IAS can be used to control access to compulsory tunnels, and IAS can tell the NAS to initiate the tunnels on behalf of the user.

IAS and the Remote Access Policies feature can be used to control access to tunnels based on the Windows 2000 group users belong to. This provides more granularity and power than static tunneling (which requires a dedicated NAS)or realm-based tunneling (which requires that all users in a given realm are given the same access privileges).

Tunnel types

Tunnels can be created in different ways. The following sections describe the two main tunnel types.

Voluntary tunneling

A user or client computer can issue a VPN request to configure and create a voluntary tunnel. In this case, the user's computer is a tunnel endpoint and acts as the tunnel client. Voluntary tunneling occurs when a workstation or routing server uses tunneling client software to create a virtual connection to the target tunnel server. In order to accomplish this, the appropriate tunneling protocol must be installed on the client computer.

IAS can be used to authenticate users and to control access to voluntary tunnels.

Compulsory tunneling

In the compulsory tunneling case, the network access server sends the authentication requests to IAS. IAS returns attributes that tell the NAS to initiate a tunnel to a destination VPN server. The tunnel-endpoint, in other words the VPN server at which the tunnel is terminated, could be changed based on conditions in a remote access policy. For example, the tunnel-endpoint can be changed based on user credentials, groups the user belongs to, DNIS, or ANI.

RADIUS attributes used with compulsory tunneling

The following is a list of RADIUS Attributes used to carry the tunneling information from the IAS server to the NAS.

Attributes used in authorization only:
  • Tunnel-Private-Group-Id
  • Tunnel-Assignment-Id
  • Tunnel-Preference
  • Tunnel-Password (Not for use with proxies!)
Used in authorization and accounting:
  • Tunnel-Type (PPTP, L2TP, and so on)
  • Tunnel-Medium-Type (X.25, ATM, Frame Relay, IP, and so on)
  • Tunnel-Client-Endpoint
  • Tunnel-Server-Endpoint
Used for accounting only:
  • Acct-Tunnel-Connection

Tunnel example

This is an example of the RADIUS attributes for a remote access profile that enables compulsory tunneling. The attributes in this profile are sent to the NAS initiating the tunnel (L2TP Access Concentrator (LAC)).
Attribute | Value
Framed-Protocol | PPP
Service-Type | Outbound-User
Tunnel-Medium-Type | IP (IP version 4)
Tunnel-Password | 1234
Tunnel-Server-Endpt | 10.10.10.10
Tunnel-Type | Layer Two Tunneling Protocol (L2TP)

The tunnel password should be configured at the VPN server terminating the tunnel (L2TP Network server (LNS)).

Note

  • You can use a RADIUS Access-Accept packet to send tunnel attributes describing multiple tunnels. However, the current implementation returns information only for a single tunnel.
  • IAS only supports one compulsory tunnel per dial-in profile.


Vendor-specific attribute overview

IAS provides administrators with the ability to associate specific RADIUS attributes with each remote access policy. In addition to the standard RADIUS attributes, which are described in IETF RFCs 2138 and 2139, you might also need to associate vendor-specific attributes with remote access protocols so that your NAS will forward authentication requests properly. For more information about the attributes you need to configure, consult your network access server (NAS) documentation.

  • Vendor-specific attributes
  • Sample VSA for a Cisco NAS
  • Sample VSA for a US Robotics NAS


Vendor-specific attributes

Some NAS manufacturers use Vendor-specific Attributes (VSAs) to provide functionality that is not supported in standard attributes. IAS enables you to create or edit Vendor-specific Attributes to take advantage of proprietary functionality supported by some NAS vendors. For information about vendor-specific functionality, see your NAS documentation. If you need to set up VSAs for your NAS, you will need to know whether the attribute conforms to the RADIUS RFC specification. If the attribute does not conform, you must enter the value in hexadecimal format.

Format for RFC-compliant VSAs

This table lists fields in a vendor-specific attribute packet that complies with the recommendations in RADIUS RFC 2138. The fields are in the order that they appear in the packet. For more detailed information, see RFC 2138.

Field | Length (in octets) | Description
Type | 1 | The type of RADIUS attribute. The vendor-specific attribute is always type 26.
Length | 1 | 7 or more.
Vendor ID | 4 | The high-order octet contains a 0, and the low-order 3 octets are the Structure for Management Information (SMI) network management private enterprise code of the vendor in network byte order, as defined in the IETF RFC 1007 "Vendor SMI Network Management Private Enterprise Codes".
String | 1 or more | The actual format of the information is specific to the NAS vendor. To be compliant with RADIUS RFC 2138, the string should be implemented as undistinguished octets, and encoded as a sequence of vendor type / vendor length / value fields. For more information on adding a RADIUS-compliant vendor specific attribute to a remote access policy, see Configure vendor-specific attributes for a remote access policy.

Ordering and merit

If you need to configure more than one VSA, you should arrange them in the appropriate order. For example, if you are using a filtering attribute that will automatically disconnect users who do not satisfy specific criteria, you should make sure that attribute appears at the top of the list. To do this, use the Move Up and Move Down buttons to rearrange the attributes.


Sample VSA for a Cisco NAS

Cisco vendor-specific attributes conform to the recommended format for vendor-specific attributes (type 26) in the RADIUS RFC 2138.

The following information is for a Cisco attribute to specify a primary DNS server:

Vendor ID: 9. This is the unique ID for Cisco. When you specify that vendor, this ID is automatically supplied.

Vendor Type: 1. This is the vendor-type number for vendor-specific attributes that take the attribute-value pair form, referred to in Cisco documentation as "cisco-avpair."

Data Type: String.

Format: If the attribute is mandatory, the syntax is: protocol: attribute = value

If the attribute is optional, the attribute-value pair is separated by an asterisk (*) instead of an equal sign (=). In this example, protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value represent an appropriate attribute/value (AV) pair defined in the Cisco TACACS+ specification. This allows the full set of features available for TACACS+ authorization to also be used for RADIUS.

The Cisco attribute to specify a primary DNS server looks like this:

ip:dns-servers=10.10.10.10

To specify the primary DNS server:

  1. In IAS, click Remote Access Policies.
  2. Right-click the policy for which you want to configure a vendor-specific attribute, and then click Properties.
  3. Click Edit Profile, click the Advanced tab, and then click Add.
  4. In the list of available RADIUS attributes, double-click Vendor-Specific, and then click Add.
  5. Click Select from list, and then click Cisco.
  6. Click Yes. It conforms, and then click Configure Attribute.
  7. In Vendor-assigned attribute number, type 1.
  8. In Attribute format, click String.
  9. In Attribute value, type: ip:dns-servers=10.10.10.10
For more information on Cisco proprietary attributes, see your Cisco documentation.


Sample VSA for a US Robotics NAS

US Robotics vendor-specific attributes do not conform to the recommended format for Vendor-Specific Attributes (type 26) in RADIUS RFC 2138. Therefore, all US Robotics VSAs must be entered in hexadecimal format.

The following information is for a US Robotics attribute to specify a primary DNS/NBNS server:

Vendor ID: 429. This is the unique ID for US Robotics. When you specify that vendor, this ID is automatically supplied.

Indicator: 0x900F

Data Type: String.

Format: The VSA must be entered in hexadecimal format.

To specify an IP address of 10.10.10.10 for a primary DNS/NBNS server:

  1. In IAS, click Remote Access Policies.
  2. Right-click the policy for which you want to configure a vendor-specific attribute, and then click Properties.
  3. Click Edit Profile, click the Advanced tab, and then click Add.
  4. In the list of available RADIUS attributes, double-click Vendor-Specific, and then click Add.
  5. Click Select from list, and then click US Robotics.
  6. Click No. It does not conform, and then click Configure Attribute.
  7. In Hexadecimal attribute value, type: 0x900f31302e31302e31302e31302e
For more information on US Robotics proprietary attributes, see your US Robotics documentation.


Authentication methods

The authentication of remote access clients is an important security concern. Authentication methods typically use an authentication protocol that is negotiated during the connection establishment process. Windows 2000 also supports unauthenticated access.

For information about using authentication methods, see the following:

  • EAP
  • MS-CHAP
  • MS-CHAP version 2
  • CHAP
  • PAP
  • Unauthenticated access

Each protocol has advantages and disadvantages in terms of security, usability, and breadth of support. The protocol used will be determined by the configuration of the NAS device. Consult your NAS documentation if you are configuring a dial-up network, or consult your Internet service provider if you are using an ISP for dial-up access to your LAN.

You can configure IAS to accept multiple authentication protocols. You can also set up your network access servers to try to negotiate a connection using the most secure protocol first, and then the next less secure, and so on down to the least secure (for example, a NAS might try to negotiate a connection using EAP, then CHAP, and then finally PAP).


Remote access policies

This section covers:

  • Introduction to remote access policies
  • Dial-in properties of a user account
  • Elements of a remote access policy
  • Accepting a connection attempt
  • Remote access policy administrative models


Remote access logging

This section contains information on the event logging, used for debugging and troubleshooting, and IAS log files, used primarily for analysis and billing:

  • Event logging for IAS
  • Logging user authentication and accounting requests


Event logging for IAS

IAS events, such as errors, are automatically recorded in event logs. You can also customize IAS properties to select other types of events to be logged in event logs:

  • If you select the Log rejected or discarded authentication requests option, rejected and ignored requests are logged. These messages are useful for understanding why a particular request was rejected or ignored. Requests can be rejected or ignored for several reasons. Following are some of the reasons why a request might be ignored:
    • The request is not formatted according to RFC 2138 or 2139 for RADIUS.
    • The RADIUS client, such as the network access server (NAS) or RADIUS proxy server, is unknown.
    • The client has multiple IP addresses and sent the request on an address other than the one defined in IAS.
    • The shared secret is invalid.
    • The digital signature sent by the client is invalid.
    • Support for the digital signature is not implemented on the client correctly (as specified in the RADIUS RFC).
    • IAS could not find the user's domain.
    • IAS could not connect to the user's domain.
    • IAS cannot get permission to access the user's account in the domain.
  • If you select Log successful authentication requests, this data is logged.

You can view IAS events by using the Event Viewer.

Notes

  • For the procedure for setting up event logging options in IAS, see Configure event logging for IAS.
  • For more information on how to set up and use event logs in Windows 2000, see Event Viewer.
    • For information on identifying and resolving errors, see Troubleshooting.


Logging user authentication and accounting requests

IAS can create log files based on the authentication and accounting requests received from the network access servers (NASs), collecting these packets in a centralized location. Setting up and using such log files to track authentication information, such as each accept, reject, and automatic account lockout, can help simplify administration of your service. You can set up and use logs to track accounting information, such as logon and logoff records, to help maintain records for billing purposes.

What is logged

When you set up logging, you can specify:

  • The requests to be logged.
  • The file format for the logs.
  • The frequency with which new logs are started.
  • The location where the logs are to be maintained.

Which requests are logged

You can select the types of requests received by the IAS server that are to be logged:

  • Accounting requests, including the following:
    • Accounting-on requests, which are sent by the NAS to indicate that the NAS is online and ready to accept connections.
    • Accounting-off requests, which are sent by the NAS to indicate that the NAS is going offline.
    • Accounting-start requests, which are sent by the NAS (after the user is accepted by the IAS server) to indicate the start of a user session.
    • Accounting-stop requests, which are sent by the NAS to indicate the end of a user session.
  • Authentication requests, including the following:
    • Authentication requests, which are sent by the NAS on behalf of the connecting user. These entries in the log contain only incoming attributes.
    • Authentication accepts and rejects, which are sent by IAS to the NAS to indicate whether the user should be accepted or rejected. These entries contain only outgoing attributes.
  • Periodic status, to obtain interim accounting requests sent by some NASs during sessions.
    • Accounting-interim requests, which are sent periodically by the NAS during a user session (if the acct-interim-interval attribute is configured in the remote access profile on the IAS server to support periodic requests).

Notes

  • Initially, it is recommended that you select the first two options, and refine your logging methods after you determine which data best matches your needs.
  • For more information on accounting and authentication requests and how they are processed in IAS, see How IAS works.

The log-file format

You can set up your IAS servers to log the data using either the database-import log format or IAS format:

  • If you select the IAS format, attributes are logged in the form of attribute-value pairs. This format has the following characteristics:
    • The sequence of the attributes is dependent on the NAS sending a request.
    • The logged attributes include RADIUS-standard, IAS-specific, and vendor-specific attributes.
    • All attributes containing unprintable characters or any delimiter (such as | and , ) will be printed in hexadecimal format (for example, 0x026).
  • If you select the database-import log format, attributes are logged in a format that supports importing the log into databases. This format has the following characteristics:
    • The attributes of all records are recorded in the same sequence (pre-defined by IAS), regardless of which NAS sent the request. This sequence includes a set specific set of attributes and, although limited in number, are the attributes that are generally most useful for tracking and analysis of requests.
    • If the attribute is not present in the request or reply (for example, if an attribute is not received from the NAS), then the field is empty in the log.
    • A specific set of attributes is logged in a sequence that is pre-defined in IAS. The attributes included in this set are pre-defined in IAS and, although limited in number, are those that generally are the most useful for tracking and analysis of requests.

    Note

    • Database-import log file formats are recommended for most environments because you can then more easily import the log files into databases. The consistent structure of this format facilitates the tracking and analysis of the data.

    How often new logs can be started

    When you set up your servers, specify whether new logs are started daily, weekly, monthly, or when the log reaches a specific size. You can also specify that a single log is maintained continually (regardless of file size), but this is not recommended. The file naming convention for logs is determined by the log period you select. Because changing this option can result in overwriting of existing logs, you should copy logs to a separate file before changing the log period.

    Note

    • For more information on how to effectively implement log files, see Best practices.

Where logs are recorded

By default, the log files are located in the % systemroot %\system32\LogFiles folder, but you have the option of specifying a different location.

What is in each log file record

Attributes are recorded in UTF-8 encoding in a comma-delimited format. The format of the records in a log file depends on the file format:

  • In IAS-formatted log files, each record starts with a fixed-format header, which consists of the NAS-IP-address, user name, record date, record time, service name, and computer name, followed by attribute-value pairs

    • For more information on the attributes and other data logged in the database-import log format, see Database-import log files.

  • In database-import log files, each record contains attribute values in a consistent sequence, starting with the computer name, service name, record date, and record time. A NAS may not use all of the attributes specified in the database-import log format, but the comma-delimited location for each of these pre-defined attributes is maintained, even for attributes that have no value specified in a record.

    • For more information on the attributes and other data logged by in the IAS format, see IAS-formatted log files.

Notes

  • This documentation contains logging information specific to IAS. The kinds of data your NAS sends can differ depending on its manufacturer. For information on which data your NAS sends and how to configure accounting packets (and for testing and production information), see your NAS documentation. For more information on the format and definitions of RADIUS attributes, see the appropriate RADIUS RFCs.
  • For procedures on how to set up the authentication and accounting logging service on an IAS server, see Configure logging for user authentication and accounting.
  • For information on how to use log data, see Using logs.


Using IAS

This topic provides information that you can use to implement IAS:

  • IAS deployment scenarios
  • Remote access policies scenarios
  • Using logs


IAS deployment scenarios

This section covers four of the most common scenarios and how to set up and manage IAS to support each:

  • Dial-up corporate access
  • Extranet access for business partners
  • Internet access
  • Outsourced corporate access through service providers


Dial-up corporate access

This topic covers how IAS can be set up to support remote authenticated dial-up connections to the corporation. This scenario shows a typical setup and configuration for a corporation with clients requiring access to the corporate network.

This section covers:

  • Corporate characteristics and requirements for authentication.
  • Network components installed to support this corporate environment.
  • The remote user authentication process to be implemented using this scenario.
  • The setup of the network components required to support this authentication process.
  • Implementation and administration considerations.

Characteristics and requirements

The corporation used in this scenario has a large corporate location with multiple sales locations, all of which require secure access to the corporate network. The corporation needs a reliable method to authenticate remote users in an environment that has the following characteristics:

  • The corporate network uses Active Directory to control user access.
  • Sales locations have demand-dial connections to the corporate network.
  • Remote management of network servers is required.
  • Access capabilities are not identical for all employees, and access is given to specific employees based on the group to which they belong. (For example, corporate employees are granted remote access, but contract employees are not).
  • Users must be able to access the network by dialing up from home and while traveling.

Note

  • This scenario covers only how to set up IAS and some basic steps for configuring Windows 2000 Routing and Remote Access. For more information, see Remote access scenarios.

Network components

In this scenario, IAS servers are set up on the corporate network to authenticate remote users. The following components are installed to support this scenario:

  • In the corporate network:
    • A primary IAS server and a backup IAS server, each running Windows 2000 Server and connected to the local area network (LAN). The IAS server serves as the RADIUS server, performing authentication, authorization, accounting, and auditing of the remote access users.
    • Active Directory domain controllers, each running Windows 2000 Server and connected to the LAN. Active Directory contains the user accounts and groups used to set up remote access policies for remote users.
    • Network access servers (NASs), each running the Routing and Remote Access service component of Windows 2000 Server and connected to the LAN. The NAS operates as a RADIUS client and is responsible for passing user information to the appropriate RADIUS servers (in this scenario, IAS), and then acting on the response.

      Note

      • This scenario uses Routing and Remote Access servers as the NASs. If you use other RADIUS-compatible NASs (such as CISCO, Ascend, or US Robotics), you would need to change the setup covered here to reflect the use of other NASs.
  • For each remote dial-up user:
    • A computer, with a modem (or other supported communications device) and connection software set up to support standard dial-up access capabilities using Point-to-Point Protocol (PPP).

Authentication process for this scenario

The network components determine the authentication process. Using the setup and configuration as specified in this scenario, accounting and authentication are accomplished as follows:

  • When the NAS is started, an accounting-on packet is sent.
  • When a remote user dials up the corporation, the following process takes place and all requests and responses are logged:
    • Diagram of authentication process for this scenario
    1. The user dials the corporate number and reaches the NAS.
    2. The NAS sends the RADIUS authentication request to the IAS server.
    3. IAS forwards the authentication request to the domain controller, where the user credentials are checked.
    4. IAS uses the remote access policies and the user attributes to determine if dial-up access is allowed.

      Note

      • IAS needs permission to read the attributes from the user object. This permission is given if the server is a member of the built-in RAS and IAS Servers security group.
    5. If a remote access policy is matched and the profile doesn't reject the user, then IAS sends an access-accept packet.
    6. The user is granted access, based on the connection settings specified in the access-accept packet. The NAS then assigns an IP address and other parameters to the client and starts routing the packets sent to and received from the client.
  • The NAS sends an accounting-start packet to the IAS server indicating that the user session has started.
  • During the session, interim accounting packets are sent.
  • When the user disconnects, the NAS sends an accounting-stop packet to the IAS server, indicating that the end of the user session.

Setup

To set up IAS to support this scenario, you need to complete the following steps:

  1. Verify that the domain controllers have been configured to support the remote users.
  2. Install and configure IAS.
  3. Copy the IAS configuration from the primary IAS server to the backup IAS server.
  4. Register the primary and backup IAS servers with Active Directory.
  5. Verify the configuration of RADIUS accounting and authentication on the NASs.
  6. Verify connection capabilities of the remote users.
The following information covers these setup steps and what is required to complete each.

Step 1: Verify that the domain controllers have been configured to support the remote users

Verify that the remote users are in the appropriate universal and nested groups, that the computer running IAS has permission to read the user objects in the domain, and then verify that the user names and passwords are valid by testing their logon capabilities on the LAN.

Notes

  • If you specify that CHAP is to be supported, you need to configure support for reversibly encrypted passwords. For more information, see CHAP.
  • For more information on:
    • Universal and nested groups, see Universal, global, and domain local groups.
    • How to add a user account in Active Directory, see To add a user to a group.
    • How to assign permissions to read user objects, see Permissions and security descriptors.

Step 2: Install and configure IAS

To set up the primary IAS server in the corporate network, do the following:

  1. Verify that the server that will run IAS is a member of the forest against which it will authenticate remote users (since a trust relationship is required and all domains in Active Directory forests automatically have trust relationships with each other.) If IAS and the user account are not in the same forest, the domain for the user account must have a trust relationship with the domain of which IAS is a member. For more information on trust relationships, see Understanding domain trusts.
  2. Log on with Local Administrative credentials.
  3. If you did not select IAS as an optional component when you installed Windows 2000 Server, install it using Add/Remove Programs in Control Panel.
  4. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  5. In the Internet Authentication Service MMC, right-click Internet Authentication Service and then click Properties to configure the properties for the primary IAS server:
    • On the Service tab, select both options for event logs. (You can later clear any options that are not useful in your environment.)
    • On the RADIUS tab, specify the RADIUS authentication and RADIUS accounting UDP ports to be used, and then click OK.

      Note

      • These ports must be the same as those used by the NASs. The most recently defined RADIUS standards at the time of this publication are 1812 for authentication and 1813 for accounting. The default values are set to the commonly used values: 1812 and 1645 for authentication and 1813 and 1646 for accounting. If you are unsure of your port settings, refer to your vendor-specific documentation for the NAS.
    • No realm names are used in this example, so no information is required on the Realms tab.
  6. Set up IAS support for the RADIUS clients. To do this, in the console tree, right-click Clients, click New Client, and then follow the directions to add and specify information about each RADIUS client (each NAS), specifying the Friendly name, Protocol (specified as Radius), Client address, Client-Vendor information (specified as RADIUS Standard), and the Shared secret.

    7. Notes

    • Ensure that the authentication and accounting shared secrets in IAS match those specified for the NASs.
    • Before enabling the option to check digital signatures, ensure that the NAS supports sending a digital signature for authentication types other than Extensible Authentication Protocol (EAP). For EAP, digital signature is always checked and you do not have to select the digital signature option.
    • For more information on how to set up new clients, see To register RADIUS clients.
  7. Set up remote access policies. Because permanent and contract employees have different access restrictions, set up separate policies for each:
    1. Set up the policy for permanent employees by doing the following:
      1. In the Internet Authentication Service console tree, right-click Remote Access Policies, and then click New Remote Access Policy.
      2. In the Add Remote Access Policy dialog box, specify a name for the policy. For this scenario, you might enter Permanent employees. After entering the name, click Next.
      3. In the next dialog box, click Add to specify a condition for this policy.
      4. In the Select Attribute dialog box, under Attribute types, select Windows-Groups, and then click Add, click Add again, and then select the name of the group(s) to which this policy is to be applied (such as Permanent employees group), click Add, and then click OK twice.

        Note

        • Remote access policies cannot include built-in groups, so they are not visible in the list of domain groups.
      5. In the Add Remote Access Policy dialog box, click Next.
      6. Click Grant remote access permission, and then click Next.
      7. Click Edit Profile.
      8. In the Edit Dial-in Profile dialog box, on the Authentication tab, select MS-CHAP and MS-CHAP v2 as the authentication methods, and then click OK (using the defaults for all other settings in the profile).
      9. Click Finish.
    2. Set up a remote access policy for contract employees that is the same as for permanent employees, except that it includes an condition that limits the hours of permitted access. To set up this policy, repeat the steps that you used to set up the policy for permanent employees, but specify the name of the policy as Contract Employees and then use the following steps to set up the additional condition to restrict access hours:
      1. In the details pane of the Internet Authentication Service console window, double click Contract Employees.
      2. In the Contract Employees Properties dialog box, click Add to add another condition.
      3. In the Select Attribute dialog box, select Day-And-Time-Restrictions, and then click Add.
      4. In the Time of day constraints dialog box, select the hours of access (7 AM to 7 PM on weekdays only, or other as appropriate), select Permitted, and then click OK twice.
    3. To ensure that the policies that you configured do not conflict with the default policy (Allow access if dial-up permission is enabled), delete the default policy.

      4. For more information on how to set up remote access policies, see Configure remote access policies.

  8. Configure logging for user authentication and accounting.

    9. Although you can specify the basic logging configuration in IAS, you may want to create additional programs to use the logging data for accounting and troubleshooting. For example, you might set up a program to track departmental usage of remote access capabilities. For this scenario, you should consider the following when configuring logging:

    • You should use the database-import log format for your log files to facilitate incorporation and use of the data in your own programs. If you select this format, you can use a database program, such as Microsoft Access 2000, to read the log file directly for usage, access analysis, and report generation.
    • You should specify that all types of requests received by the server (including authentication, accounting, and periodic updates) are to be logged. If you determine later that all of this logging information is not required, you can change this selection.

For more information on how to set up logging, see Configure logging for user authentication and accounting.

Step 3: Copy the IAS configuration from the primary IAS server to the backup IAS server

Copy the client configurations, remote access policies, and logging configuration to the backup IAS server.

For more information on how to copy an IAS configuration from one computer to another, see To copy the IAS configuration to another server.

Step 4: Register the primary and backup IAS servers with Active Directory

To be able to authenticate users, the primary and backup IAS servers must be registered on the domain controllers in Active Directory in the built-in groups as members of the RAS and IAS Servers security group. Add the IAS servers by doing the following:

  1. Log on the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  3. In the console tree, click Users.
  4. In the details pane, right-click RAS and IAS Servers.
  5. In the RAS and IAS Servers Properties dialog box, on the Members tab, add each of the IAS servers.

Note

  • You can also use a netsh ras register server [domain] [server] command to register the servers. For more information, see NetShell commands for remote access.

Step 5: Verify the configuration of RADIUS accounting and authentication on the NASs

To ensure that RADIUS accounting and authentication configuration has been appropriately set up on each NAS using Windows 2000 Server Routing and Remote Access and to verify that the configuration matches that of IAS (as specified in Steps 2 and 3), do the following:

  1. Log on to the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  3. For each NAS on which you have installed Routing and Remote Access, right-click the server name, click Properties, and then check the following information:
    • On the General tab, verify the following:
      • Remote access server is selected
        • .
    • On the Security tab, verify the following:
      • RADIUS Authentication is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, and, under Authentication Methods, that MS-CHAP v2 and MS-CHAP are selected.
      • RADIUS Accounting is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, and with the Send RADIUS accounting On and Accounting Off messages option selected.
    • On the IP tab, verify that the following are selected:
      • Allow remote systems running IP
      • Access entire network
      • Use DHCP to assign remote IP addresses

For more information on how to check properties of the NAS, see To view properties of the NAS.

Step 6: Verify connection capabilities of the remote users

The final step in setting up IAS is to verify that the remote dial-up users can use Network and Dial-up Connections to access the corporate network.

For more information on remote dial-up connections, see About Network and Dial-up Connections.

Implementation and administration considerations

Depending on the size of your corporation, a single IAS server is probably sufficient. In many cases, the IAS server can be installed on the same computer as the domain controller. Monitor traffic and adjust the IAS server installation as necessary to meet your requirements.

Note

  • This scenario provides a basic implementation plan for a corporate environment. Tailor the number of servers and other implementation decisions to support the needs of your environment.

All IAS administration can be managed remotely.

If remote access policies need to be updated, update the policies on the primary IAS server, and then copy the IAS configuration to the other IAS servers.

Note

  • For additional implementation information for corporate remote access, see:
    • Deploying Remote Access, for additional configuration information.
    • The Remote access for Electronic, Inc. scenario, which contains an example that shows hardware and software considerations for a corporate remote access implementation of VPN connections.


Extranet access for business partners

This topic covers how IAS can be set up to support a corporate extranet environment that has one or more business partners, each of which need access to only a specific area within the corporation's network.

This section covers:

  • Corporate characteristics and requirements for authentication of remote partners using dial-up access.
  • Network components installed to support corporate extranet access for business partners.
  • The remote user authentication process to be implemented using this scenario.
  • The setup of the network components required to support this authentication process.
  • Implementation and administration considerations.

Note

  • In this scenario, references to the corporation, the corporate network or the corporate environment are related only to a single corporation that is granting access to its business partners.

Characteristics and requirements

The corporation in this scenario has a corporate network and has established business partnerships with suppliers who require secure access to the specific areas (servers) within the corporate network. The extension of a corporate intranet to facilitate communication with suppliers and/or customers is referred to as an extranet. An extranet allows customers and/or suppliers to gain limited access to a company's intranet in order to enhance the speed and efficiency of their business relationship. The corporation needs a reliable method to authenticate business partner users in an environment that has the following characteristics:

  • The corporation uses Active Directory to control user access and use.
  • Access capabilities are not identical for all business partners, and access to the corporation is given to specific partners based on specific business requirements which determine which areas of the corporation are accessible by each partner. (For example, one business partner may be co-developing a technology with the corporation and requires access to a server supporting development efforts for a specific component, while another business partner may be providing parts for a hardware component and requires access to a server supporting manufacturing and production efforts). In this scenario, the NAS controls access at the IP level using IP filters for that specific connection. The filters that are applied to the connection can be varied by using remote access policies.
  • The corporation's business partners each have a large number of users at multiple locations who need a secure method of accessing specific areas of the corporate network.
  • The users at each of the business partner locations have access to the Internet.
  • The VPN connection uses smart card and Extensible Authentication Protocol (EAP), with 128-bit encryption.
  • Users at each business partner require unique users names with their own corporation.

Note

  • This scenario covers only how to set up IAS. It does not cover complete configuration of all remote access and VPN components. For more information on how the deployment requirements for the other remote access and VPN components, see:
    • Remote access scenarios
    • Routing scenarios, especially the scenario for Dial-up branch office network
    • Virtual private network scenarios

Network components

In this scenario, a primary IAS server and a backup IAS server are set up in the corporate network to authenticate remote business partner users. The following components are installed to support this scenario:

  • In the corporate network:
    • A primary IAS server and a backup IAS server, each running Windows 2000 Server and connected to the corporate local area network (LAN) and to the Internet. The IAS server serves as the RADIUS server, performing authentication, authorization, accounting, and auditing of the remote access users.
    • Active Directory domain controllers, each running Windows 2000 Server and connected to the LAN. Active Directory contains the user accounts and groups used to set up remote access policies for remote users. User principal names have been created for all business partner users to limit their exposure to the corporate domain.
    • PPTP servers, each running Windows 2000 Server with Routing and Remote Access service enabled, configured to accept PPTP connections, and connected to the LAN and through a leased line to the Internet. The PPTP server has a network address on the Internet and on the private LAN and is used to provide business partner users with VPN connections to the specific areas of the corporate network.

      Notes

      • PPTP is a protocol for creating a VPN connection. PPTP can encapsulate Point-to-Point Protocol (PPP) packets, such as from a network access server (NAS), within Internet Protocol (IP) packets and forward them over any IP network, including the Internet.
      • For more information on setting up the PPTP server, see Checklist: Installing and configuring a PPTP server.
  • For each business partner user:
    • A computer with a modem (or other supported communications device) and Internet access and connection software set up to support standard access using PPP and PPTP connections. Each authorized user must have a user principal name to access the corporate network.
    • Smart card access capabilities.

Authentication process for this scenario

The network components determine the authentication process. Using the setup and configuration as specified in this scenario, accounting and authentication are accomplished as follows:

  • When the PPTP server is started, an accounting-on packet is sent.
  • When a business partner user connects to the corporation, the following process takes place and all requests and responses are logged:
    • Diagram of authentication process for this scenario
    1. Using smart card access, the user connects to the corporate PPTP server.
    2. The PPTP server sends the RADIUS authentication request to the IAS server.

      Note

      • When the User principal name is received from the business partner user, IAS queries the global catalog and maps the user principal name suffix to a fully-qualified domain name (FQDN).
    3. IAS forwards the authentication request to the domain controller, where user credentials are checked.
    4. IAS evaluates the remote access policies and the user attributes to determine if dial-up access is allowed.

      Note

      • IAS needs permission to read the attributes from the user object. This permission is given if the server is a member of the built-in RAS and IAS Servers security group.
    5. If a remote access policy is matched and the profile doesn't reject the user, then IAS sends an access-accept packet.

      Note

      • For more information on how policies are evaluated, see
        • Deploying Remote Access, for additional configuration information.
        • Accepting a connection attempt.
    6. The user is granted VPN access, based on the connection settings specified in the access-accept packet. The connection settings contain a filter appropriate to the business partner's allowed access, and the PPTP applies the filter for all packets at the connection.
    7. The PPTP server then assigns an IP address and other parameters to the client and starts routing the packets sent to and received from the client.
  • The PPTP server sends an accounting-start packet to the IAS server indicating that the user session has started.
  • During the session, interim accounting packets are sent.
  • When the user disconnects, the NAS sends an accounting-stop packet to the IAS server, indicating that the end of the user session.

For more information on the authentication process for business partner extranet access, see the Apply packet filters for business partner extranet deployment scenario.

Setup

To set up IAS to support this scenario, you need to complete the following steps:

  1. Verify that the firewall is appropriately set up to support IAS.
  2. Verify that the domain controllers have been configured to support the remote users.
  3. Install and configure IAS.
  4. Copy the IAS configuration from the primary IAS server to the backup IAS server.
  5. Register the primary and backup IAS servers with Active Directory.
  6. Verify that the PPTP servers are appropriately set up to support RADIUS accounting and authentication and are properly configured for VPN connections.
  7. Verify connection capabilities of the business partner users.
The following information covers these setup steps and what is required to complete each.

Step 1: Verify that the firewall is appropriately set up to support IAS

For information on how to set up the firewall, see IAS and firewalls.

Step 2: Verify that the domain controllers have been configured to support the remote users

Verify that the business partners users are in the appropriate universal and nested groups, that the computer running IAS has permission to read the user objects in the domain, and then verify that the user names and passwords are valid by testing their logon capabilities on the LAN. Because you are using groups, verify that in the user account that the Remote Access Permission option is set to Control access through Remote Access Policy. Create a group for each business partner and set up user principal names for users at each business partner. For example, for a user (Bob) at one business partner (Company), create a group (Company) and create a UPN of @Company.com and assign the UPN to the user belonging to the company.

Notes

  • If you specify that CHAP is to be supported, you need to configure support for reversibly encrypted passwords. For more information, see CHAP.
  • For more information on:
    • Universal and nested groups, see Universal, global, and domain local groups.
    • How to add a user account in Active Directory, see To add a user to a group.
    • How to assign permissions to read user objects, see Permissions and security descriptors
    • How to set up group membership, see Allow connection through group membership.

Step 3: Install and configure IAS

To set up the primary IAS server, do the following:

  1. Verify that the server that will run IAS is a member of the forest against which it will authenticate remote users (since a trust relationship is required and all domains in Active Directory forests automatically have trust relationships with each other.) If IAS and the user account are not in the same forest, the domain for the user account must have a trust relationship with the domain of which IAS is a member. For more information on trust relationships, see Understanding domain trusts.
  2. Log on with administrative credentials.
  3. If you did not select IAS as an optional component when you installed Windows 2000 Server, install it using Add/Remove Programs in Control Panel.
  4. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  5. in the Internet Authentication Service MMC, right-click Internet Authentication Service and then click Properties to configure the properties for the primary IAS server:
    • On the Service tab, select both options for event logs. (You can later clear any options that are not useful in your environment.)
    • On the RADIUS tab, specify the RADIUS authentication and RADIUS accounting UDP ports to be used, and then click OK.

      Note

      • These ports must be the same as those used by the PPTP servers. The most recently defined RADIUS standards at the time of this publication are 1812 for authentication and 1813 for accounting. The default values are set to the commonly used values: 1812 and 1645 for authentication and 1813 and 1646 for accounting. If you are unsure of your port settings, refer to your vendor-specific documentation for the NAS.
  6. Set up IAS support for the RADIUS clients. To do this, in the console tree, right-click Clients, click New Client, and then follow the directions to add and specify information about each RADIUS client (each of the corporate PPTP servers), specifying the Friendly name, Protocol (specified as Radius), Client address, Client-Vendor information (specified as RADIUS Standard), and the Shared secret.

    7. Notes

    • Ensure that the authentication and accounting shared secrets in IAS match those specified for the NASs.
    • For more information on how to set up new clients, see To register RADIUS clients.
  7. Set up a remote access policy for smart card access for a business partner (in this scenario, a fictitious company with the name of Awesome Computers) that uses 128-bit encryption. To set up this policy, do the following:
    1. In Internet Authentication Service console tree, right-click Remote Access Policies, and then click New Remote Access Policy to configure a remote access policy for the users of one of the business partners.
    2. In the first dialog box of the Add Remote Access Policy wizard, specify the Policy friendly name. (For this scenario, you might enter Awesome Computers Smart Card Access.) After entering the name, click Next.
    3. In the next dialog box, click Add, select Windows-Groups, click Add, click Add again, select the appropriate group(s) to which this policy is to be applied (such as, Awesome Computers), click Add, and then click OK twice.

      Note

      • Remote access policies cannot include built-in groups, so they are not visible in the list of domain groups.
    4. To add another condition, click Add again, select NAS-Port-Type, select Virtual (VPN), click Add, click OK, and then click Next.
    5. Click Grant remote access permission, and then click Next.
    6. Click Edit Profile.
    7. On the Authentication tab, select Extensible Authentication Protocol, select Smart card or other certificate (TLS), click Configure, select the machine certificate you want to use.
    8. On the IP tab, in the IP Packet Filters box, click From client and add the destination network information for the filter, and then click OK three times.
    9. Click Finish.
    10. To ensure that the policies that you configured do not conflict with the default policy (Allow access if dial-up permission is enabled), delete the default policy.

    Notes

    • Define a separate policy for each business partner.
    • For information on smart cards and how to implement them, see Overview of smart cards.
    • For more information on how to set up remote access policies, see Configure remote access policies.
  8. Configure logging for user authentication and accounting.

    9. Although you can specify the basic logging configuration in IAS, you may want to create additional programs to use the logging data for accounting and troubleshooting. For example, you might set up a program to track departmental usage of remote access capabilities. For this scenario, you should consider the following when configuring logging:

    • You should use the database-import log format for your log files to facilitate incorporation and use of the data in your own programs. If you select this format, you can use a database program to read your log files directly for usage, access analysis, and report generation.
    • You should specify that all three types of authentication and accounting requests received by the server are to be logged. If you determine later that all of this logging information is not required, you can change this selection.

For more information on how to set up logging, see Configure logging for user authentication and accounting.

Step 4: Copy the IAS configuration from the primary IAS server to the backup IAS server

Copy the IAS configuration (including IAS properties, client configurations, remote access policies, and logging configuration) to the backup IAS server.

For more information on how to copy an IAS configuration from one computer to another, see To copy the IAS configuration to another server.

Step 5: Register the primary and backup IAS servers with Active Directory

To be able to authenticate users, the primary and backup IAS servers must be registered on the domain controllers in Active Directory in the built-in groups as members of the RAS and IAS Servers security group. Add the IAS servers by doing the following:

  1. Log on to the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  3. In the console tree, click Users.
  4. In the details pane, right-click RAS and IAS Servers.
  5. In the RAS and IAS Servers Properties dialog box, on the Members tab, add each of the IAS servers.

Note

  • You can also use a netsh ras register server [domain] [server] command to register the servers. For more information, see NetShell commands for remote access.

Step 6: Verify that the PPTP servers are appropriately set up to support RADIUS accounting and authentication and are properly configured for VPN connections

To ensure that RADIUS accounting and authentication configuration has been appropriately set up on each PPTP server using the appropriate remote access software and to verify that the configuration matches that of IAS, ensuring that IAS is configured as the authenticator and accounting provider, do the following:

  1. Log on to the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  3. For each PPTP server on which you have installed Routing and Remote Access, right-click the server name, click Properties, and then check the following information:
    • On the General tab, verify the following:
      • Remote access server is selected
        • .
    • On the Security tab, verify the following:
      • RADIUS Authentication is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, with the Always use digital signatures option selected and, under Authentication Methods, that EAP is selected.
      • RADIUS Accounting is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, and with the Send RADIUS accounting On and Accounting Off messages option selected.
    • On the IP tab, verify that the following are selected:
      • Allow remote systems running IP
      • Access this computer only
      • Use DHCP to assign remote IP addresses
  4. Verify that the PPTP servers are properly configured for VPN connections. For information on setting up PPTP servers, see Virtual private networks.

Step 7: Verify connection capabilities of the business partner users

The final step in setting up IAS is to verify that the business partners VPN users can access the corporate network. To do this verify smart card access.

Implementation and administration considerations

Take special care to specify policies (with filters) that appropriately restrict the access granted to the partner's users.

Implementation Considerations

This scenario shows only one example of how extranet access might be configured. The size and access requirements of your corporation affect your implementation. Tailor this example as needed to match your requirements.

Note

  • For additional implementation information for remote access using VPNs (including the use of smart cards, strong encryption, and filters), see VPN scenarios.


Internet access

This topic covers how IAS can be set up to support customer authenticated dial-up connections to an Internet service provider (ISP). This scenario shows a typical setup and configuration for an ISP with customers requiring access to the internet via the ISP.

This section covers:

  • ISP characteristics and requirements for authentication.
  • Network components installed to support this ISP environment.
  • The customer authentication process to be implemented using this scenario.
  • The setup of the network components required to support this authentication process.
  • Implementation and administration considerations.

Characteristics and requirements

The ISP in this scenario has a single data center that support a large number of users and NASs are distributed with multiple Points of Presence (POPs). The ISP needs a reliable method to authenticate users in an environment that has the following characteristics:

  • The ISP uses Active Directory to control user access.
  • The ISP offers two service plans, a basic unlimited access plan for users with dial-up modems, and a premium plan that provides support for ISDN connections. Access is given to users based on the plan for which they sign up, which determines to which group they belong.
  • Users must be able to access the network using local access numbers for each of the ISP's POPs.

Note

  • This scenario covers only how to set up IAS and some basic steps for configuring Windows 2000 Routing and Remote Access. For more information, see Remote access scenarios.

Network components

In this scenario, IAS servers are set up on the corporate network to authenticate users connecting through any POP that has been set up on any of the ISP's network access servers (NASs). The following components are installed to support this scenario:

  • At the ISP:
    • A primary IAS server and a backup IAS server, each running Windows 2000 Server. The IAS servers serve as the RADIUS servers, performing authentication, authorization, accounting, and auditing of all users of the ISP's service.
    • Active Directory domain controllers, each running Windows 2000 Server. Active Directory contains the user accounts and groups used to set up remote access policies for all users.
    • NASs, each running the Routing and Remote Access service component of Windows 2000 Server and connected to the LAN. The NAS operates as a RADIUS client and is responsible for passing user information to the appropriate RADIUS servers (in this scenario, IAS), and then acting on the response.

      Note

      • This scenario uses Routing and Remote Access servers as the NASs. If you use other RADIUS-compatible NASs (such as CISCO, Ascend, or US Robotics), you would need to change the setup covered here to reflect the use of the other NASs.
  • For each individual user of the basic plan (no ISDN support):
    • A computer configured to support standard dial-up capabilities using Point-to-Point Protocol (PPP). In this scenario, a Connection Manager service profile is used to enable access to the Internet through the ISPs POPs.
  • For each individual user of the premium plan (with ISDN support):
    • A computer configured to support standard dial-up capabilities as well as ISDN direct access capabilities using PPP. The same Connection Manager service profile as used for the basic plan is used to enable access using ISDN, because the service profile contains both dial-up and ISDN POPs. (Connection Manager makes the appropriate POPs available based on the type of connection device the user selects.)

    Note

    • To use Connection Manager, the service profile must be delivered, installed, and set up on all computers requiring remote access. Connection Manager service profiles are created using the Connection Manager Administration Kit (CMAK) wizard. For more information on how to create, deliver, and set up Connection Manager service profiles, see the Connection Manager Administration Kit Guide.

Authentication process for this scenario

The network components determine the authentication process. Using the setup and configuration as specified in this scenario, accounting and authentication are accomplished as follows:

  • When the NAS is started, an accounting-on packet is sent.
  • When a remote user dials up one of the ISPs POPs, the following process takes place and all requests and responses are logged:
    • Diagram of authentication process for this scenario
    1. The user selects the location from which he is dialing and then selects an appropriate phone number (POP) for the ISP from the phone book in the Connection Manager service profile.
    2. The NAS sends the RADIUS authentication request to the IAS server.
    3. IAS forwards the authentication request to the domain controller at that location, where the user credentials are checked.
    4. IAS evaluates the remote access policies and the user attributes to determine if dial-up access is allowed.

      Note

      • IAS needs permission to read the attributes from the user object. This permission is given if the server is a member of the built-in RAS and IAS Servers security group.
    5. If a remote access policy is matched and the profile doesn't reject the user, then IAS sends an access-accept packet.
    6. The user is granted access, based on the connection settings specified in the access-accept packet. The NAS then assigns an IP address and other parameters to the client and starts routing the packets sent to and received from the client.
  • The NAS sends an accounting-start packet to the IAS server indicating that the user session has started.
  • During the session, interim accounting packets are sent.
  • When the user disconnects, the NAS sends an accounting-stop packet to the IAS server, indicating that the end of the user session.

Setup

To set up IAS to support this scenario, you need to complete the following steps:

  1. Verify that the domain controllers have been configured to support the remote users.
  2. Install and configure IAS.
  3. Copy the IAS configuration from the primary IAS server to the backup IAS server.
  4. Register the primary and backup IAS servers with Active Directory.
  5. Verify the configuration of RADIUS accounting and authentication on the NASs.
  6. Verify connection capabilities of the remote users.
The following information covers these setup steps and what is required to complete each.

Step 1: Verify that the domain controllers have been configured to support the remote users

Verify that the users are set up with user principal names and are in the appropriate universal and nested groups, that the computer running IAS has permission to read the user objects in the domain. In this scenario, you can set up two universal groups (one for users of the basic plan and one for users of the premium ISDN plan. Because of the large number of potential users, create global groups, nested in the universal groups, and put users in the sub-groups (not directly in the universal groups). Verify that the user names and passwords are valid by testing their logon capabilities on the LAN.

Verify that CHAP and MS-CHAP are supported on the domain controllers.

Notes

  • The user principal names created for the users should contain the @ sign followed by the ISP's name (for example, ISPName@Username.
  • When CHAP is to be supported, you need to configure support for reversibly encrypted passwords and enable clear-text passwords. For more information, see CHAP.
  • For more information on:
    • Universal and nested groups, see Universal, global, and domain local groups.
    • How to add a user account in Active Directory, see To add a user to a group.
    • How to assign permissions to read user objects, see Permissions and security descriptors.

Step 2: Install and configure IAS

To set up the primary IAS server, do the following:

  1. Verify that the server that will run IAS is a member of the forest against which it will authenticate remote users (since a trust relationship is required and all domains in Active Directory forests automatically have trust relationships with each other.) If IAS and the user account are not in the same forest, the domain for the user account must have a trust relationship with the domain of which IAS is a member. For more information on trust relationships, see Understanding domain trusts.
  2. Log on with Local Administrative credentials.
  3. If you did not select IAS as an optional component when you installed Windows 2000 Server, install it using Add/Remove Programs in Control Panel.
  4. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  5. in the Internet Authentication Service MMC, right-click Internet Authentication Service and then click Properties to configure the properties for the primary IAS server:
    • On the Service tab, select both options for event logs. (You can later clear any options that are not useful in your environment.)
    • On the RADIUS tab, specify the RADIUS authentication and RADIUS accounting UDP ports to be used, and then click OK.

      Note

      • These ports must be the same as those used by the NASs. The most recently defined RADIUS standards at the time of this publication are 1812 for authentication and 1813 for accounting. The default values are set to the commonly used values: 1812 and 1645 for authentication and 1813 and 1646 for accounting. If you are unsure of your port settings, refer to your vendor-specific documentation for the NAS.
    • No realm names are used in this example, so no information is required on the Realms tab.
  6. Set up IAS support for the RADIUS clients. To do this, in the Internet Authentication Service console tree, right-click Clients, click New Client, and then follow the directions to add and specify information about each RADIUS client (each NAS), specifying the Friendly name, Protocol (specified as Radius), Client address, Client-Vendor information (specified as RADIUS Standard), and the Shared secret.

    7. Notes

    • Ensure that the authentication and accounting shared secrets in IAS match those specified for the NASs.
    • Before enabling the option to check digital signatures, ensure that the NAS supports sending a digital signature for authentication types other than Extensible Authentication Protocol (EAP).
    • For EAP, digital signature is always checked and you do not have to select the digital signature option.

      • For more information on how to set up new clients, see To register RADIUS clients.

  7. Set up the remote access policies. Most basic plans for ISPs do not include ISDN access, so you should set up two groups, one that supports multi-link connections (for premium plans) and one that doesn't (for the basic plan).
    1. Set up a remote access policy for the basic plan for non-ISDN users by doing the following:
      1. In Internet Authentication Service MMC, in the console tree, right-click Remote Access Policies, and then click New Remote Access Policy.
      2. Using the Add Remote Access Policy wizard, specify a Policy friendly name for the policy. (For this scenario, you might enter Basic Plan.) After entering the name, click Next.
      3. In the next dialog box, click Add, select Windows-Groups, click Add, click Add again, select the group(s) to which this policy is to be applied (such as, Basic plan users), click Add, click OK twice, and then click Next.

        4. Note

        • Remote access policies cannot include built-in groups, so they are not visible in the list of domain groups.
      4. Click Grant remote access permission, and then click Next.
      5. Click Edit Profile.
      6. On the Authentication tab, select CHAP, MS-CHAP, and MS-CHAP v2 as the authentication methods.
      7. On the Dial-in Constraints tab, select Async and Sync, and then click OK.
      8. Click Finish.
    2. Set up a remote access policy for the premium plan that is the same as for the basic plan, except that it needs to support ISDN access. To set up this policy, repeat the steps that you used to set up the policy for the basic plan, but specify the name of the policy as Premium Plan, select the Windows-Groups that contain the users who are to be granted ISDN access, and on the Dial-in Constraints tab, check all of the ISDN options (in addition to the options selected for the basic plan).
    3. To ensure that the policies that you configured do not conflict with the default policy (Allow access if dial-up permission is enabled), delete the default policy.

      4. Note

      • For more information on how to set up remote access policies, see Configure remote access policies.
  8. Configure logging for user authentication and accounting.

    9. Although you can specify the basic logging configuration in IAS, you may want to create additional programs to use the logging data for accounting and troubleshooting. For example, you might set up a program to track departmental usage of remote access capabilities. For this scenario, you should consider the following when configuring logging:

    • You should use the database-import log format for your log files to facilitate incorporation and use of the data in your own programs. If you select this format, you can use a database program to read the log file directly for usage, access analysis, and report generation.
    • You should specify that all types of requests received by the server (including authentication, accounting, and periodic updates) are to be logged. If you determine later that all of this logging information is not required, you can change this selection.

For more information on how to set up logging, see Configure logging for user authentication and accounting.

Step 3: Copy the IAS configuration from the primary IAS server to the backup IAS server

Copy the client configurations, remote access policies, and logging configuration to the backup IAS server.

For more information on how to copy an IAS configuration from one computer to another, see To copy the IAS configuration to another server.

Step 4:Register the primary and backup IAS servers with Active Directory

To be able to authenticate users, the primary and backup IAS servers must be registered on the domain controllers in Active Directory in the built-in groups as members of the RAS and IAS Servers security group. Add the IAS servers by doing the following:

  1. Log on the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  3. In the console tree, click Users.
  4. In the details pane, right-click RAS and IAS Servers.
  5. In the RAS and IAS Servers Properties dialog box, on the Members tab, add each of the IAS servers.

Note

  • You can also use a netsh ras register server [domain] [server] command to register the servers. For more information, see NetShell commands for remote access.

Step 5:Verify the configuration of RADIUS accounting and authentication on the NASs

To ensure that RADIUS accounting and authentication configuration has been appropriately set up on each NAS using Windows 2000 Server Routing and Remote Access and to verify that the configuration matches that of IAS (as specified in Steps 2 and 3), do the following:

  1. Log on to the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  3. For each NAS on which you have installed Routing and Remote Access, right-click the server name, click Properties, and then check the following information:
    • On the General tab, verify the following:
      • Remote access server is selected
        • .
    • On the Security tab, verify the following:
      • RADIUS Authentication is selected and is configured with the names of the primary and backup IAS servers, each of which is configured with the appropriate shared secret and port, and, under Authentication Methods, that CHAP, MS-CHAP v2 and MS-CHAP are selected.
      • RADIUS Accounting is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, and with the Send RADIUS accounting On and Accounting Off messages option selected.
    • On the IP tab, verify that the following are selected:
      • Allow remote systems running IP
      • Access entire network
      • Use DHCP to assign remote IP addresses

For more information on how to check properties of the NAS, see To view properties of the NAS.

Step 6:Verify connection capabilities of the remote users

The final step in setting up IAS is to verify that the remote dial-up users can use Network and Dial-up Connections to access the ISP.

For more information on Network and Dial-up Connections, see About Network and Dial-up Connections.

Implementation and administration considerations

Depending on the size of your corporation, a single IAS server is probably sufficient. In many cases, the IAS server can be installed on the same computer as the domain controller. Monitor traffic and adjust the IAS server installation as necessary to meet your requirements.

For information on performance tuning when using IAS to support a large number of users, see Best practices.

Note

  • This scenario provides a basic implementation plan for a corporate environment. Tailor the number of servers and other implementation decisions to support the needs of your environment.

If remote access policies need to be updated, update the policies on the primary IAS server, and then copy the IAS configuration to the other IAS servers.


Outsourced corporate access through service providers

This topic covers how IAS can be set up to support a corporation that has outsourced its remote dial-up access to an Internet service provider (ISP). In this outsourced relationship, the corporation has implemented a wholesale access agreement with the ISP and has set it up so that the corporation's employees can access the corporate network by connecting to the ISP's worldwide Points of Presence (POPs).

This section covers:

  • Corporate characteristics and requirements for authentication using outsourced dial-up access.
  • Network components installed to support outsourced dial-up access in this corporate environment.
  • The remote user authentication process to be implemented using this scenario.
  • The setup of the network components required to support this authentication process.
  • Implementation and administration considerations, including considerations for initiating ISP support for dial-up access.

Characteristics and requirements

The corporation in this scenario has a large corporate location with remote users, all of whom require secure access to the corporate network. The corporation has determined that it is more cost-effective to provide remote access by outsourcing the remote corporate access. The corporation needs a reliable method to authenticate remote users in an environment that has the following characteristics:

  • The corporate network uses Active Directory to control user access.
  • Access capabilities are not identical for all employees, and access is given to specific employees based on the group to which they belong. (For example, corporate employees are granted access, but contract employees are not).
  • The corporation has a large number of remote users who need a secure method of accessing the corporate network.
  • Members of the marketing and sales team travel worldwide and need global access using local dial-up connections to minimize long distance charges.
  • The encryption and authentication requirements for the Internet connection are less stringent than those for the VPN connection. For example, in this scenario, the Internet connection uses CHAP and no encryption, but the VPN connection uses smart card and Extensible Authentication Protocol (EAP), with 128-bit encryption.
  • Users must be able to access the network by dialing in from home and while traveling.
  • The ISP providing outsourced support for remote access has a large number of POPs worldwide, all of which need to be able to provide corporate users with secure access to the corporate network.

Note

  • This scenario covers only how to set up IAS. It does not cover complete configuration of all remote access and VPN components. For more information on how the deployment requirements for the other remote access and VPN components, see:
    • Remote access scenarios
    • Routing scenarios, especially the scenario for Dial-up branch office network
    • Virtual private network scenarios

Network components

In this scenario, a primary IAS server and a backup IAS server are set up on the corporate network to authenticate remote users. The following components are installed to support this scenario:

  • In the corporate network:
    • A primary IAS server and a backup IAS server, each running Windows 2000 Server and connected to the corporate local area network (LAN) and to the Internet. The IAS server serves as the RADIUS server, performing authentication, authorization, accounting, and auditing of the remote access users.
    • Active Directory domain controllers, each running Windows 2000 Server and connected to the LAN. Active Directory contains the user accounts and groups used to set up remote access policies for remote users.
    • PPTP servers, each running Windows 2000 Server with Routing and Remote Access service enabled, configured to accept PPTP connections, and connected to the LAN and through a leased line to the Internet. The PPTP server has a network address on the Internet and on the private LAN and is used to provide users with VPN connections to the corporate network.

      Notes

      • PPTP is a protocol for creating a secure connection. PPTP can encapsulate Point-to-Point Protocol (PPP) packets within Internet Protocol (IP) packets and forward them over any IP network, including the Internet.
      • For more information on setting up the PPTP server, see Checklist: Installing and configuring a PPTP server.
  • At the ISP:
    • Network access servers (NASs), each running Windows 2000 Server. The NAS operates as a RADIUS client. (In this scenario, requests come to IAS through the radius proxy server at the ISP and are routed to the corporate server.) In this scenario, you can use any RADIUS-compatible NAS (such as the Routing and Remote Access feature of Windows 2000, Cisco, U.S. Robotics, Ascend, or others).
    • RADIUS proxy server at the ISP location, which acts as a RADIUS client to other servers.
  • For each remote dial-up user:
    • A computer, with a modem (or other supported communications device) and connection software set up to support standard dial-up access capabilities using PPP and VPN connections. In this scenario, Connection Manager service profiles are used to enable single-logon access through the ISP using dial-up and VPN connections.

      Note

      • To use Connection Manager, the service profile must be delivered, installed, and set up on all computers requiring remote access. Connection Manager service profiles are created using the Connection Manager Administration Kit (CMAK) wizard. For more information on how to create, deliver, and set up Connection Manager service profiles, see the Connection Manager Administration Kit Guide.
    • Smart card access capabilities.

Authentication process for this scenario

The network components determine the authentication process. Using the setup and configuration as specified in this scenario, accounting and authentication are accomplished as follows:

  • When the NAS is started, an accounting-on packet is sent. If the RADIUS proxy server is appropriately configured to forward accounting-on packets, the packet is forwarded to IAS at the corporation, where it is logged. (Some ISPs may not send this packet to the corporate RADIUS server.)
  • When a remote user dials in to the ISP, the following process takes place and all requests and responses are logged:
    • Diagram of authentication process for this scenario
    1. The user selects the location from which he is dialing and then selects a local or other appropriate phone number (POP) for the ISP from the phone book in the Connection Manager service profile. Using CHAP authentication, the user connects to the ISP's NAS. Appended to the user name is a realm name, either specified by the user or automatically appended by Connection Manager, which is used by the NAS to route the authentication and accounting requests to the IAS server in the corporate network.
    2. The NAS sends the RADIUS authentication request to the RADIUS proxy server.
    3. The RADIUS proxy server uses the realm name to route the request to the corporation's IAS server. This request may be routed through multiple RADIUS proxies (belonging to another ISP or a roaming consortium of ISPs) before reaching the corporate IAS server. IAS applies all realm-stripping rules for the user name.

      Note

      • When the User principal name is received from the user, IAS queries the global catalog and maps the user principal name suffix to a fully-qualified domain name (FQDN).
    4. IAS forwards the authentication request to the domain controller, where the user credentials are checked.
    5. IAS evaluates the remote access policies and the user attributes to determine if dial-up access is allowed.

      Note

      • IAS needs permission to read the attributes from the user object. This permission is given if the server is a member of the built-in RAS and IAS Servers security group.
    6. If a remote access policy is matched and the profile doesn't reject the user, then IAS sends an access-accept packet.
    7. The RADIUS proxy server forwards the access-accept packet.
    8. The user is granted access, based on the connection settings specified in the access-accept packet.
    9. The NAS then assigns an IP address and other parameters to the client to start routing the packets sent to and received from the client.
    10. Connection Manager then initiates a tunnel to the PPTP server in the corporate network.
    11. The PPTP server sends an authentication request for this user to the IAS server, to verify VPN access capabilities.
    12. The IAS server receives the request and forwards the packet to the domain controller. Again the user credentials are checked, the remote access policies and user attributes are evaluated, and the user is granted VPN access based on the connection settings specified in the access-accept packet.
    13. The PPTP server sends an accounting start message to the RADIUS server.
  • During the session, interim accounting packets are sent by both the NAS and PPTP server.
  • When the user disconnects, the PPTP server sends an accounting-stop packet to the IAS server, indicating that the end of the user session. (Some ISPs may not send this packet to the corporate RADIUS server.)

Setup

To set up IAS to support this scenario, you need to complete the following steps:

  1. Verify that the firewall is appropriately set up to support IAS.
  2. Verify that the domain controllers have been configured to support the remote users.
  3. Install and configure IAS.
  4. Copy the IAS configuration from the primary IAS server to the backup IAS server.
  5. Register the primary and backup IAS servers with Active Directory.
  6. Verify that the PPTP servers are appropriately set up to support RADIUS accounting and authentication and are properly configured for VPN connections.
  7. Verify the configuration of RADIUS accounting and authentication on the ISP's RADIUS proxy server.
  8. Verify connection capabilities of the remote users.

The following information covers these setup steps and what is required to complete each.

Step 1: Verify that the firewall is appropriately set up to support IAS

For information on how to set up the firewall, see IAS and firewalls

Step 2: Verify that the domain controllers have been configured to support the remote users

Verify that groups have been created for the users (in this scenario, with permanent and contract employees in separate groups), that the remote users are in the appropriate universal and nested groups, that the computer running IAS has permission to read the user objects in the domain, and then verify that the user names and passwords are valid by testing their logon capabilities on the LAN. Because you are using groups, verify that in the user account that the Remote Access Permission option is set to Control access through Remote Access Policy. Also verify that Active Directory is in native mode and, for permanent employees to use CHAP authentication, that reversibly encrypted password storage has been enabled.

Notes

  • If you specify that CHAP is to be supported, you need to configure support for reversibly encrypted passwords. For more information, see CHAP.
  • For more information on:
    • Universal and nested groups, see Universal, global, and domain local groups.
    • How to add a user account in Active Directory, see To add a user to a group.
    • How to assign permissions to read user objects, see Permissions and security descriptors
    • How to set up group membership, see Allow connection through group membership.

Step 3: Install and configure IAS

To set up the primary IAS server, do the following:

  1. Verify that the server that will run IAS is a member of the forest against which it will authenticate remote users (since a trust relationship is required and all domains in Active Directory forests automatically have trust relationships with each other.) If IAS and the user account are not in the same forest, the domain for the user account must have a trust relationship with the domain of which IAS is a member. For more information on trust relationships, see Understanding domain trusts.
  2. Log on with administrative credentials.
  3. If you did not select IAS as an optional component when you installed Windows 2000 Server, install it using Add/Remove Programs in Control Panel.
  4. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Service.
  5. in the Internet Authentication Service MMC, right-click Internet Authentication Service and then click Properties to configure the properties for the primary IAS server:
    • On the Service tab, select both options for event logs. (You can later clear any options that are not useful in your environment.)
    • On the RADIUS tab, specify the RADIUS authentication and RADIUS accounting UDP ports to be used, and then click OK.

      Note

      • These ports must be the same as those used by your the servers. The most recently defined RADIUS standards at the time of this publication are 1812 for authentication and 1813 for accounting. The default values are set to the commonly used values: 1812 and 1645 for authentication and 1813 and 1646 for accounting. If you are unsure of your port settings, refer to your vendor-specific documentation for the NAS.
    • If the realm names used at the ISPs to access the corporate network are different than those required to access the corporate domains, specify rules for manipulating the realm names on the Realms tab.
  6. Set up IAS support for the RADIUS clients. To do this, in the Internet Authentication Service console tree, right-click Clients, click New Client, and then follow the directions to add and specify information about each RADIUS client (including the corporate network's PPTP and ISP's RADIUS proxy servers), specifying the Friendly name, Protocol (specified as Radius), Client address, Client-Vendor information (specified as RADIUS Standard), and the Shared secret.

    7. Notes

    • Ensure that the authentication and accounting shared secrets in IAS match those specified for the NASs.
    • Before enabling the option to check digital signatures, ensure that the NAS supports sending a digital signature for authentication types other than Extensible Authentication Protocol (EAP). For EAP, digital signature is always checked and you do not have to select the digital signature option.
    • For more information on how to set up new clients, see To register RADIUS clients.
  7. Set up remote access policies to support permanent employees access using outsourced dial-up connection. To set up these policies, do the following:
    1. Set up a remote access policy for smart card access that uses 128-bit encryption. To set up this policy, in Internet Authentication Service console tree, right-click Remote Access Policies, click New Remote Access Policy. Using the wizard, do the following:
      • Specify a Policy friendly name of Smart Card Access (or other, as preferred), and then click Next.
      • To add a condition, click Add, select Windows-Groups, click Add, click Add again, select the name of the group (such as Permanent corporate employees), click Add, click OK twice.

        Note

        • Remote access policies cannot include built-in groups, so they are not visible in the list of domain groups.
      • To add a second condition, again click Add, select NAS-Port-Type, click Add, select Virtual (VPN), click Add, click OK, and then click Next
      • Select Grant remote access permission, and then click Next.
      • Click Edit profile and then, on the Authentication tab, select Extensible Authentication Protocol, select Smart card or other certificate (TLS), and then click Configure.
      • In the Smart card or Other Certificate (TLS) Properties dialog box, select the machine certificate you want to use, and then click OK.
      • Click Finish to save the settings for this policy.

      Note

      • For more information on smart cards and how to implement them, see Overview of smart cards.
      • For more information on how to set up remote access policies, see Configure remote access policies.
    2. Set up a remote access policy for permanent employees. To set up this policy, again in Internet Authentication Service console tree, right-click Remote Access Policies, click New Remote Access Policy. Using the wizard, do the following:
      • Specify a Policy friendly name of Permanent employees (or other, as preferred), and then click Next.
      • To add a condition, click Add, select Windows-Groups, click Add, select the name of the group (such as Permanent corporate employees), click Add, click OK twice, and then click Next.
      • Click Grant remote access permission, and then click Next.
      • Click Edit Profile and then, on the Authentication tab, select CHAP as the authentication method, and then click OK.
      • Click Finish to save the settings for this policy.

        • Note

        • Because an access policy granting access is only defined for permanent employees, contract employees (who are in a different group) are denied access.
    3. To ensure that the policies that you configured do not conflict with the default policy (Allow access if dial-up permission is enabled), delete the default policy.
  8. Configure logging for user authentication and accounting.

    9. Although you can specify the basic logging configuration in IAS, you may want to create additional programs to use the logging data for accounting and troubleshooting. For example, you might set up a program to track departmental usage of remote access capabilities. For this scenario, you should consider the following when configuring logging:

    • You should use the database-import log format for your log files to facilitate incorporation and use of the data in your own programs. If you select this format, you can use a database program to read your log files directly for usage, access analysis, and report generation.
    • You should specify that all three types of authentication and accounting requests received by the server are to be logged. If you determine later that all of this logging information is not required, you can change this selection.

For more information on how to set up logging, see Configure logging for user authentication and accounting.

Step 4: Copy the IAS configuration from the primary IAS server to the backup IAS server

Copy the IAS configuration (including IAS properties, client configurations, remote access policies, and logging configuration) to the backup IAS server.

For more information on how to copy an IAS configuration from one computer to another, see To copy the IAS configuration to another server.

Step 5: Register the primary and backup IAS servers with Active Directory

To be able to authenticate users, the primary and backup IAS servers must be registered on the domain controllers in Active Directory in the built-in groups as members of the RAS and IAS Servers security group. Add the IAS servers by doing the following:

  1. Log on the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  3. In the console tree, click Users.
  4. In the details pane, right-click RAS and IAS Servers.
  5. In the RAS and IAS Servers Properties dialog box, on the Members tab, add each of the IAS servers.

Note

  • You can also use a netsh ras register server [domain] [server] command to register the servers. For more information, see NetShell commands for remote access.

Step 6: Verify that the PPTP servers are appropriately set up to support RADIUS accounting and authentication and are properly configured for VPN connections

To ensure that RADIUS accounting and authentication configuration has been appropriately set up on each PPTP server using the appropriate remote access software and to verify that the configuration matches that of IAS, ensuring that IAS is configured as the authenticator and accounting provider, do the following:

  1. Log on to the server using domain Administrator credentials.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
  3. For each PPTP server on which you have installed Routing and Remote Access, right-click the server name, click Properties, and then check the following information:
    • On the General tab, verify the following:
      • Remote access server is selected
        • .
    • On the Security tab, verify the following:
      • RADIUS Authentication is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, with the Always use digital signatures option selected and, under Authentication Methods, that EAP is selected.
      • RADIUS Accounting is selected and is configured with the names of the primary and backup IAS servers, each with the appropriate shared secret and port, and with the Send accounting on/off messages option selected.
    • On the IP tab, verify that the following are selected:
      • Allow remote systems running IP
      • Access entire network
      • Use DHCP to assign remote IP addresses
    • On the PPP tab, verify that all options are selected.
  4. Verify that the PPTP servers are properly configured for VPN connections. For information on setting up PPTP servers, see Virtual private networks.

Step 7. Verify the configuration of RADIUS accounting and authentication on the ISP's RADIUS proxy server

  1. Provide realm information to the ISP and verify that realm handling is appropriately configured on the RADIUS proxy server.
  2. Provide the shared secret to the ISP for configuration of the RADIUS proxy server and verify that the server is appropriately configured to handle the shared secret.
  3. Ask the ISP which attributes are sent in requests and what they expect to be returned in the response.
  4. Ask if the ISPs RADIUS proxy server supports digital signature. (If so, ensure that the profile is set up to require it.)
  5. Ask the ISP to identify the hardware (technology) that they use.

Step 8: Verify connection capabilities of the remote users

The final step in setting up IAS is to verify that the remote VPN users can use Connection Manager to access the corporate network.

  1. Verify that Connection Manager service profiles have been provided to users.
  2. Verify smart card access.
  3. Once the service profiles are installed, verify that the phone numbers used to connect to the NASs are set up correctly and realm name is handled appropriately.

Implementation and administration considerations

All IAS administration can be managed remotely.

  • If remote access policies need to be updated, update the policies on the primary IAS server, and then copy the IAS configuration to the other IAS servers.
  • Network access servers can be updated remotely.
  • Remote usage can be tracked on the corporate network.

This scenario provides a basic implementation plan for outsourced dial-up access for a corporate environment. When implementing IAS, tailor this scenario to support the needs of your environment. Depending on the size of your corporation, a single IAS server is probably sufficient. In many cases, the IAS server can be installed on the same computer as the domain controller. Monitor traffic and tailor the IAS server installation as necessary to meet your requirements.

Note

  • For additional implementation information for corporate remote access (including outsourcing), see:
    • Deploying Remote Access, for additional configuration information.
    • The Remote access for Electronic, Inc. scenario, which contains an example that shows hardware and software considerations for a corporate remote access implementation of VPN connections.


Using logs

This section contains information to help you make use of the log files created by IAS:

  • Log capture for other processes
  • Database-import log files
  • IAS-formatted log files


Log capture for other processes

To collect the data directly into another process, you can configure IAS to write a named pipe, in the instead of a file. To use named pipes, set the log file folder to \\.\pipe or \\computername\pipe. The named pipe server program should create a named pipe called \\.\pipe\iaslog.log to accept the data.

Notes

  • For procedures on how to set up the authentication and accounting logging service on an IAS server, see Configure logging for user authentication and accounting.
  • For information on how to import a log file into a database, see Importing IAS log files into a database.


Database-import log files

This section contains information to help you make use of the database-import log files created by IAS:

  • Importing IAS log files into a database
  • Interpreting database-import log files


Importing IAS log files into a database

You can review logs in their original format, but the raw format is not very useful because of the complexity of the data. One of the most effective ways to use log-file data is to select the Database-import format for log files. The consistent structure of this format makes it possible to use a database program, such as Microsoft Access, to import a log into a table where the data is presented in a way that it can be easily read and interpreted. And after importing the log, you can use other programs to filter and analyze the data in a way that is useful for your accounting and auditing processes.

The following example shows how to use Microsoft Access 97 to import a database-import log into a table.

Example: importing IAS log files into a table using Microsoft Access 97

The table that you create using Microsoft Access 97 will be formatted according to the type of data contained in each field. This example shows you how to create a new table, but you could also import a log into an existing table.

Before creating the table, add the two lines in the next paragraph to your log file. The first line contains the attribute names of each field in the log. If you copy it into your log file, Access can use it to create the field names. Having the attribute names in the table facilitates interpreting the logs. The second line contains content that will set up the appropriate data type for each column of the table. After you import the log file, you should delete this line from the table.

ComputerName,ServiceName,Record-Date,Record-Time,Packet-Type,User-Name,Fully-Qualified-User-Name,Called-Station-Id,Calling-Station-ID,Callback-Number,Framed-IP-Address,NAS-Identifier,NAS-IP-Address,NAS-Port,Client-Vendor,Client-IP-Address,Client-Friendly-Name,Event-Timestamp,Port-Limit,NAS-Port-Type,Connect-Info,Framed-Protocol,Service-Type,Authentication-Type,NP-Policy-Name,Reason-Code,Class,Session-Timeout,Idle-Timeout,Termination-Action,EAP-Friendly-Name,Acct-Status-Type,Acct-Delay-Time,Acct-Input-Octets,Acct-Output-Octets,Acct-Session-Id,Acct-Authentic,Acct-Session-Time,Acct-Input-Packets,Acct-Output-Packets,Acct-Terminate-Cause,Acct-Multi-Ssn-Id,Acct-Link-Count,Acct-Interim-Interval,Tunnel-Type,Tunnel-Medium-Type,Tunnel-Client-Endpt,Tunnel-Server-Endpt,Acct-Tunnel-Conn,Tunnel-Pvt-Group-ID,Tunnel-Assignment-ID,Tunnel-Preference,MS-Acct-Auth-Type,MS-Acct-EAP-Type,MS-RAS-Version,MS-RAS-Vendor,MS-CHAP-Error,MS-CHAP-Domain,MS-PPE-Encryption-Types,MS-MPPE-Encryption-Policy
x,x,01/01/1999,12:00:00,0,x,x,x,x,x,x,x,x,0,0,x,x,01/01/1999 12:00:00,0,0,x,0,0,0,x,0,x,0,0,0,x,0,0,0,0,x,0,0,0,0,0,x,0,0,0,0,x,x,x,x,x,0,0,0,x,0,x,x,0,0

To create the table

  1. Rename log files to give them a file name extension of .txt
  2. In Access 97, click File, and then click New Database.
  3. In the New dialog box, click Blank Database, and then click OK.
  4. In the File New Database dialog box, specify a File name, and then click Create.
  5. In the filename:Database dialog box, click New.
  6. In the New Table dialog box, select Import Table, and then click OK.
  7. In the Import dialog box, in the Files of type drop-down box, select Text Files, and then locate the IAS log file, select it, and then click Import.
  8. In the Import Text Wizard dialog box, select Advanced.
  9. In the Advanced dialog box:
    • For File Format
      • , select Delimited.
    • In the Field Delimiter drop-down box, select the , (comma).
    • In the Text Qualifier drop-down box, select " (quotation marks).
    • In File Origin drop-down box, select Windows (ANSI).
    • In the Dates, Times, and Numbers box, select Four Digit Years and Leading Zeros in Dates, and then enter the appropriate Date Order (such as MDY), Date Delimiter (such as /), Time Delimiter (such as a colon, and Decimal Symbol (such as a period), and then click OK.
  10. In the Import Text Wizard dialog box, click Next, select First Row Contains Field Names, and then click Next again.
  11. Select the option to store your data In a New Table, and then click Next.
  12. Keep the defaults in the Field Options box and click Next
  13. Select Let Access add primary key, and then click Next.
  14. In Import to Table, enter the name of the new table, click Finish, and then click OK.
  15. In the filename:Database dialog box, select the name of your database, and then click Open to look at your table.


Interpreting database-import log files

The database-import log format for log files is available starting in Windows 2000. Unlike the IAS-formatted log files, the database-import log files present the data in a standard sequence and using a structure that is identical, regardless of the network access server (NAS) sending the data. This consistent sequence and structure helps simplify accounting and authentication record-keeping. Data can be easily exported to a data base, which supports filtering and analysis by a variety of programs.

Note

  • Although IAS supports both IAS-formatted and database-import log files, the database-import log format should be used for most situations, as it supports the use of ODBC-compliant tools, which facilitates the analysis and reporting of your data.

Entries recorded in database-import log files

The following are sample entries (access-request and access-accept) from a database-import log file.

"CLIENTCOMP","IAS",06/17/1999,13:04:33,1,"client",,,,,,,,,9,"10.10.10.10","iasclient",,,,,,,1,,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
"CLIENTCOMP","IAS",06/17/1999,13:04:33,2,,"iasclientdc/Users/client",,,,,,,,9,"10.10.10.10","iasclient",,,,,,2,1,"Allow access if dial-in permission is enabled",0,"311 1 10.10.10.11 06/17/1999 20:04:30 1",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

The following table shows the attributes that can be contained in a record in the database-import log file, the sequence in which they are recorded, and how the above sample access-request packet would be interpreted.

Notes

  • A blank field in the first column indicates that the NAS did not include the attribute in the packet (in the sample entry).
  • The Data type column identifies the data type (text, number, or time) for each attribute. When creating a data base into which log files are to be imported, be sure each field is defined appropriately for the data type of the attribute value to be imported into the field. In database-import log files, text values (such as strings, octet strings, and IP addresses) are always qualified by double quotes. If the text qualifier appears within the string, then it is replaced with a double qualifier.
  • This table shows the appropriate values for the IAS-internal attribute. For definitions of the values of RADIUS attributes, see RADIUS RFCs.
  • See the NAS documentation for information on how to configure accounting packets, as well as for testing and production information for the NAS.
  • To help read and interpret the log files, a tool (iasparse) is included in the Windows 2000 Resource Kit that can be used to parse the log files and provide output in a readable format. For more information, see the Windows 2000 Resource Kit.
Value shown in example | Attribute | Data type | Represents
"CLIENTCOMP" ComputerName Text Name of the server where the packet was received.
(This is an IAS-internal attribute.)
"IAS" ServiceName Text Name of the service that generated the record, IAS or Windows 2000 remote access.
(This is an IAS-internal attribute.)
06/14/2000 Record-Date Time Date at the IAS or remote access server.
(This is an IAS-internal attribute.)
17:58:39 Record-Time Time Time at the IAS or remote access server.
(This is an IAS-internal attribute.)
1 Packet-Type Number Type of packet. Can be:
  • 1 = Accept-Request
  • 2 = Access-Accept
  • 3 = Access-Reject
  • 4 = Accounting-Request
(This is an IAS-internal attribute.)
"client" | User-Name | Text | User's claimed identity.
Fully-Qualified-User-Name Text User name in canonical format.
(This is an IAS-internal attribute.)
Called-Station-Id | Text | Phone number dialed by user.
Calling-Station-Id | Text | Phone number from which call originated.
Callback-Number | Text | Callback phone number.
Framed-IP-Address | Text | Framed address to be configured for user.
NAS-Identifier | Text | Text identifying the NAS originating the request.
NAS-IP-Address | Text | The IP address of the NAS originating the request.
NAS-Port | Number | Physical port number of the NAS originating the request.
9 Client-Vendor Number Manufacturer of NAS.
(This is an IAS-internal attribute.)
"10.10.10.10" Client-IP-Address Text The IP address of RADIUS client.
(This is an IAS-internal attribute.)
"iasclient" Client-Friendly-Name Text Friendly name for the RADIUS client.
(This is an IAS-internal attribute.)
Event-Timestamp | Time | The date and time that this event occurred on the NAS.
Port-Limit | Number | Maximum number of ports that NAS provides to the user.
NAS-Port-Type | Number | Type of physical port used by the NAS originating the request.
Connect-Info | Text | Indicates the nature of user's connection.
Framed-Protocol | Number | The protocol to be used.
Service-Type | Number | Type of service user has requested.
1 Authentication-Type Number Authentication scheme use to verify user. Can be:
  • 1 = PAP
  • 2 = CHAP
  • 3 = MS-CHAP v1
  • 4 = MS-CHAP v2
  • 5 = EAP
  • 7 = None
  • 8 =Custom

(This is an IAS-internal attribute.)
NP-Policy-Name | Text | Friendly name of the remote access policy that granted or denied access. This attribute is logged in authentication accept and reject requests. If a user is rejected because none of the remote access policies matched, then this attribute is blank.
0 Reason-Code Number Reason for rejecting a user. Can be:
  • 0 = IAS_SUCCESS
  • 1 = IAS_INTERNAL_ERROR
  • 2 = IAS_ACCESS_DENIED
  • 3 = IAS_MALFORMED_REQUEST
  • 4 = IAS_GLOBAL_CATALOG_UNAVAILABLE
  • 5 = IAS_DOMAIN_UNAVAILABLE
  • 6 = IAS_SERVER_UNAVAILABLE
  • 7 = IAS_NO_SUCH_DOMAIN
  • 8 = IAS_NO_SUCH_USER
  • 16 = IAS_AUTH_FAILURE
  • 17 = IAS_CHANGE_PASSWORD_FAILURE
  • 18 = IAS_UNSUPPORTED_AUTH_TYPE
  • 32 = IAS_LOCAL_USERS_ONLY
  • 33 = IAS_PASSWORD_MUST_CHANGE
  • 34 = IAS_ACCOUNT_DISABLED
  • 35 = IAS_ACCOUNT_EXPIRED
  • 36 = IAS_ACCOUNT_LOCKED_OUT
  • 37 = IAS_INVALID_LOGON_HOURS
  • 38 = IAS_ACCOUNT_RESTRICTION
  • 48 = IAS_NO_POLICY_MATCH
  • 64 = IAS_DIALIN_LOCKED_OUT
  • 65 = IAS_DIALIN_DISABLED
  • 66 = IAS_INVALID_AUTH_TYPE
  • 67 = IAS_INVALID_CALLING_STATION
  • 68 = IAS_INVALID_DIALIN_HOURS
  • 69 = IAS_INVALID_CALLED_STATION
  • 70 = IAS_INVALID_PORT_TYPE
  • 71 = IAS_INVALID_RESTRICTION
  • 80 = IAS_NO_RECORD
  • 96 = IAS_SESSION_TIMEOUT
  • 97 = IAS_UNEXPECTED_REQUEST

(This is an IAS-internal attribute.)
Class Text Attribute sent to client in an access-accept packet. The format is:
  • Type Always contains the value 25. 1 octet.
  • Length Always 20 or more. 1 octet.
  • Checksum Contains an Adler-32 checksum computed over the remainder of the Class attribute. 4 octets.
  • Vendor-Id The high-order octet is 0 and the low-order 3 octets are the SMI Network Management Private Enterprise Code of the Vendor in network byte order, as defined in the IETF RFC 1007 "Vendor SMI Network Management Private Enterprise Codes". 4 octets.
  • Version Always contains the value of 1. 2 octets.
  • Server-Address This field contains the IP address of the RADIUS server that issued the Access-Challenge. For multihomed servers,this will be the address of the network interface that received the original Access-Request. 2 octets.
  • Service-Reboot-Time Specifies the time at which the first serial number was returned. 8 octets.
  • Unique-Serial-Number 8 octets.
  • String Can be used to classify the accounting records so that this information can be used for further analysis. In IAS, the Class attribute from the profile should be copied into this String. 0 or more octets.
The combination of Serial-Number, Service-Reboot-Time, and Server-Address should be a unique identification for each authentication that the server accepted. This combination is used for correlating accounting records with the authentications.
Session-Timeout | Number | Length of time (in seconds) before session is terminated.
Idle-Timeout | Number | Length of idle time (in seconds) before session is terminated.
Termination-Action | Number | Action NAS should take when service is completed.
EAP-Friendly-Name | Text | EAP friendly name.
Acct-Status-Type | Number | Specifies whether accounting packet starts or stops a bridging, routing, or terminal server session.
Acct-Delay-Time | Number | Length of time (in seconds) for which the NAS has been sending the same accounting packet.
Acct-Input-Octets | Number | Number of octets received during the session.
Acct-Output-Octets | Number | Number of octets sent during the session.
Acct-Session-Id | Text | Unique numeric string identifying the server session.
Acct-Authentic | Number | Specifies which server authenticated an incoming call.
Acct-Session-Time | Number | Length of time (in seconds) for which the session has been logged in.
Acct-Input-Packets | Number | Number of packets received during the session.
Acct-Output-Packets | Number | Number of packets sent during the session.
Acct-Terminate-Cause | Number | Reason a connection was terminated.
Acct-Multi-Ssn-Id | Text | Unique numeric string identifying the multilink session.
Acct-Link-Count | Number | Number of links in a multilink session.
Acct-Interim-Interval | Number | Length of interval (in seconds) between each interim update the NAS sends.
Tunnel-Type | Number | Tunneling protocols to be used.
Tunnel-Medium-Type | Number | Transport medium to use when creating a tunnel for protocols (such as L2TP) that can operate over multiple transports.
Tunnel-Client-Endpt | Text | The IP address of the initiator end of the tunnel.
Tunnel-Server-Endpt | Text | The IP address of the server end of the tunnel.
Acct-Tunnel-Conn | Text
Tunnel-Pvt-Group-ID | Text | Group ID for a particular tunneled session.
Tunnel-Assignment-ID | Text | Tunnel to which a session is to be assigned.
Tunnel-Preference | Number
MS-Acct-Auth-Type | Number | Routing and Remote Access service attribute. See RFC 2548.
MS-Acct-EAP-Type | Number | Routing and Remote Access service attribute. See RFC 2548.
MS-RAS-Version | Text | Routing and Remote Access service attribute. See RFC 2548.
MS-RAS-Vendor | Number | Routing and Remote Access service attribute. See RFC 2548.
MS-CHAP-Error | Text | Routing and Remote Access service attribute. See RFC 2548.
MS-CHAP-Domain | Text | Routing and Remote Access service attribute. See RFC 2548.
MS-MPPE-Encryption-Types | Number | Routing and Remote Access service attribute. See RFC 2548.
MS-MPPE-Encryption-Policy | Number | Routing and Remote Access service attribute. See RFC 2548.


IAS-formatted log files

This section contains information to help you make use of the IAS-formatted log files created by IAS:

  • Interpreting IAS-formatted log files
  • Interpreting IAS IDs for vendor-specific attributes


Interpreting IAS-formatted log files

In the Windows NT 4 version of IAS, the log was formatted using a method by which attributes were logged as attribute-value pairs. This formatting is supported in IAS in Windows 2000, and the logs that use this format are referred to as IAS-formatted log files. However, in Windows 2000, this format supports the inclusion of additional information in the log file:

  • In addition to accounting packets (accounting on, accounting off, accounting start, accounting stop, and accounting interim), the IAS server in Windows 2000 also logs authentication (access requests, access accepts, access rejects) information.
  • All string attributes containing unprintable characters or any delimiter (such as | and , ) will be printed in hexadecimal format (for example, 0x026).
  • If IAS receives an attribute (RADIUS-standard or vendor-specific) that is not defined in the IAS dictionary, then it logs it as a string.

Although most of the attributes sent by a network access server (NAS) that are supported in Windows 2000 are logged when you specify the use of IAS-formatted log files, some attributes are not logged because they contain sensitive information, such as password information, that is not appropriate in log files.The list at the end of this section shows the attributes that that are not logged.

Note

  • Unless you have migration, compatibility, or other issues that require you to use the IAS format, you should use the database-import log format. Although a database-import log file contains a smaller subset of attributes, it contains the attributes required to support most tracking and accounting activities. And the database-import log format supports easier integration of the data into data bases, which can significantly simplify development and implementation of software to support data analysis and accounting.

Entries recorded in IAS-formatted log files

The following is a sample entry (access-request) from an IAS-formatted log file.

10.10.10.10,client,06/04/1999,14:42:19,IAS,CLIENTCOMP,6,2,7,1,5,9,61,5,64,1,65,1,31,1

The format of this record, and of each record in your log file, includes a header followed by the attribute-value pairs for all attributes contained in the packet being recorded.

The first seven positions of the record are the header, which includes:

Value shown in example | Attribute | ID | Data type | Represents
10.10.10.10 | NAS-IP-Address | IAS Header | Text | The IP address of the NAS sending the request
client | User-Name | IAS Header | Text | The user name requesting access.
06/04/1999 | Record-Date | IAS Header | Time | The date that the log is written
14:42:19 | Record-Time | IAS Header | Time | The time that the log is written
IAS | Service-Name | IAS Header | Text | The name of the service running on the RADIUS server
CLIENTCOMP | Computer-Name | IAS Header | Text | The name of the RADIUS server

After the header, the RADIUS attributes and values are in pairs in the format

<attribute_number 1>,<value_for_attribute_number1>,<attribute_number2>,<value_for_attribute_number2>,

and so on. For example, the two fields after the header contain a 6 and a 2, which can be interpreted as follows:

  • 6 is the RADIUS ID for the Service-Type.
  • 2 is the attribute value for the Service-Type attribute. The RADIUS protocol specifies the following values for the Service-Type attribute:
    • 1 = Login
    • 2 = Framed
    • 3 = Callback Login
    • 4 = Callback Framed
    • 5 = Outbound
    • 6 = Administrative
    • 7 = NAS Prompt
    • 8 = Authenticate Only
    • 9 = Callback NAS Prompt
    • The value of this attribute is "Framed".
This attribute-value pair can then be interpreted as Service-Type = Framed, which indicates to the IAS server to start a framed protocol, such as Point-to-Point Protocol (PPP) or SLIP, for the user.

Note

  • The above example shows how one attribute-value pair is interpreted. It does not define all attributes and values.

The following table describes the RADIUS attributes that can be found in a record of an IAS-formatted log file. Attributes are listed in numerical order in the following table. The order does not reflect the order in which attributes are presented in the log files. Unlike the database-import log files, which uses a fixed sequence of attributes, the sequence of the attributes in IAS-formatted log files depends on the format used by the NAS. For additional information on the format of these records, see the documentation for the NAS.

Notes

  • This table does not cover vendor-specific attributes (VSAs). For information on interpreting VSAs, see interpreting IAS IDs for vendor-specific attributes
  • The entries under the ID column that start with "IAS" are IAS-specific attributes that are not found in the RADIUS protocol.
  • For additional information on these attributes and their values, see the RADIUS RFCs and your NAS documentation.
  • To help read and interpret the log files, a tool (iasparse) is included in the Windows 2000 Resource Kit that can be used to parse the log files and provide output in a readable format. For more information, see the Windows 2000 Resource Kit.
Attribute | ID | Data type | Represents
User-Name | 1 | Text | User's claimed identity.
NAS-IP-Address | 4 | Text | The IP address of the NAS originating the request.
NAS-Port | 5 | Number | Physical port number of the NAS originating the request.
Service-Type | 6 | Number | Type of service user has requested.
Framed-Protocol | 7 | Number | The protocol to be used.
Framed-IP-Address | 8 | Text | Framed address to be configured for user.
Framed-IP-Netmask | 9 | Text | IP netmask to be configured for user.
Framed-IP-Netmask | 9 | Text | IP netmask to be configured for user.
Framed-Routing | 10 | Number | Routing method to be used by user.
Filter-Id | 11 | Text | Name of filter list for user requesting authentication.
Framed-MTU | 12 | Number | Maximum transmission unit to be configured for user.
Framed-Compression | 13 | Number | Compression protocol to be used.
Login-IP-Host | 14 | Number | The IP address of host to which user should be connected.
Login-Service | 15 | Number | Service connecting user to login host.
Login-TCP-Port | 16 | Number | TCP port to which user should be connected.
Reply-Message | 18 | Text | Message to be displayed to user when authentication request is accepted.
Callback-Number | 19 | Text | Callback phone number.
Callback-Id | 20 | Text | Name of a place to be called by the NAS.
Framed-Route | 22 | Text | Name of a place to be called by the NAS.
Framed-IPX-Network | 23 | Number | IPX network number to be configured on the NAS for user.
Class 25 Text Attribute sent to client in an access-accept packet. The format is:
  • Type Always contains the value 25. 1 octet.
  • Length Always 20 or more. 1 octet.
  • Checksum Contains an Adler-32 checksum computed over the remainder of the Class attribute. 4 octets.
  • Vendor-Id The high-order octet is 0 and the low-order 3 octets are the SMI Network Management Private Enterprise Code of the Vendor in network byte order, as defined in the IETF RFC 1007 "Vendor SMI Network Management Private Enterprise Codes". 4 octets.
  • Version Always contains the value of 1. 2 octets.
  • Server-Address Contains the IP address of the RADIUS server that issued the Access-Challenge. For multihomed servers,this will be the address of the network interface that received the original Access-Request. 2 octets.
  • Service-Reboot-Time Specifies the time at which the first serial number was returned. 8 octets.
  • Unique-Serial-Number 8 octets.
  • String Can be used to classify the accounting records so that this information can be used for further analysis. In IAS, the Class attribute from the profile should be copied into this String. 0 or more octets.
The combination of Serial-Number, Service-Reboot-Time, and Server-Address should be a unique identification for each authentication that the server accepted. This combination is used for correlating accounting records with the authentications.
Vendor-Specific | 26 | Text | Used to support proprietary NAS features
Session-Timeout | 27 | Number | Length of time (in seconds) before session is terminated.
Idle-Timeout | 28 | Number | Length of idle time (in seconds) before session is terminated.
Termination-Action | 29 | Number | Action NAS should take when service is completed.
Called-Station-Id | 30 | Text | Phone number dialed by user.
Calling-Station-Id | 31 | Text | Phone number from which call originated.
NAS-Identifier | 32 | Text | String identifying the NAS originating the request.
Login-LAT-Service | 34 | Text | Host with which user is to be connected by LAT.
Login-LAT-Node | 35 | Text | Node with which user is to be connected by LAT.
Login-LAT-Group | 36 | Text | LAT group codes for which user is authorized.
Framed-AppleTalk-Link | 37 | Number | AppleTalk network number for the serial link to user (only when user is router).
Framed-AppleTalk-Network | 38 | Number | AppleTalk network number the NAS must probe to allocate user's AppleTalk node.
Framed-AppleTalk-Zone | 39 | Text | AppleTalk default zone for user.
Acct-Status-Type | 40 | Number | Specifies whether accounting packet starts or stops a bridging, routing, or terminal server session.
Acct-Delay-Time | 41 | Number | Length of time (in seconds) for which the NAS has been sending the same accounting packet.
Acct-Input-Octets | 42 | Number | Number of octets received during the session.
Acct-Output-Octets | 43 | Number | Number of octets sent during the session.
Acct-Session-Id | 44 | Text | Unique numeric string identifying the server session.
Acct-Authentic | 45 | Number | Specifies which server authenticated an incoming call.
Acct-Session-Time | 46 | Number | Length of time (in seconds) for which the session has been logged in.
Acct-Input-Packets | 47 | Number | Number of packets received during the session.
Acct-Output-Packets | 48 | Number | Number of packets sent during the session.
Acct-Terminate-Clause | 49 | Number | Reason a connection was terminated.
Acct-Multi-Ssn-Id | 50 | Text | Unique numeric string identifying the multilink session.
Acct-Link-Count | 51 | Number | Number of links in a multilink session.
Event-Timestamp | 55 | Time | The date and time that this event occurred on the NAS.
NAS-Port-Type | 61 | Number | Type of physical port used by the NAS originating the request.
Port-Limit | 62 | Number | Maximum number of ports that NAS provides to the user.
Login-LAT-Port | 63 | Number | Maximum number of ports that NAS provides to the user.
Tunnel-Type | 64 | Number | Tunneling protocols to be used.
Tunnel-Medium-Type | 65 | Number | Transport medium to use when creating a tunnel for protocols (such as L2TP) that can operate over multiple transports.
Tunnel-Client-Endpt | 66 | Text | The IP address of the initiator end of the tunnel.
Tunnel-Server-Endpt | 67 | Text | The IP address of the server end of the tunnel.
Acct-Tunnel-Conn | 68 | Text
Password-Retry | 75 | Number | Number of times user can try to be authenticated before NAS terminates connection.
Prompt | 76 | Number | Specifies to the NAS whether or not it should echo user's response as it is entered.
Connect-Info | 77 | Text | Indicates the nature of user's connection.
Configuration-Token | 78 | Text | Indicate a type of user profile to be used (sent from a RADIUS proxy server to a RADIUS proxy client in an access-accept packet.
Tunnel-Pvt-Group-ID | 81 | Text | Group ID for a particular tunneled session.
Tunnel-Assignment-ID | 82 | Text | Tunnel to which a session is to be assigned.
Tunnel-Preference | 83 | Number
Acct-Interim-Interval | 85 | Number | Length of interval (in seconds) between each interim update the NAS sends.
Ascend | 107 to 255 | Text | See Ascend documentation for these vendor-specific attributes.
Saved-RADIUS-Framed-Route | IAS 4100 | Text | Routing information to be configured on the NAS for user (for IAS internal use only).
Saved-RADIUS-Framed-Route | IAS 4100 | Text | Routing information to be configured on the NAS for user (for IAS internal use only).
Client-IP-Address | IAS 4108 | Text | The IP address of RADIUS client.
NAS-Manufacturer | IAS 4116 | Number | Manufacturer of NAS.
MS-CHAP-Error | IAS 4121 | Number | Error data describing an MS-CHAP transaction.
Authentication-Type | IAS 4127 | Number | Authentication scheme use to verify user.
Client-Friendly-Name | IAS 4128 | Text | Friendly name for the RADIUS client.
SAM-Account-Name | IAS 4129 | Text | User account name in Security Accounts Manager (SAM).
Fully-Qualified-User-Name | IAS 4130 | Text | User name in canonical format.
EAP-Friendly-Name | IAS 4132 | Text | Extensible Authentication Protocol (EAP) friendly name.
Packet-Type IAS 4136 Number Type of packet. Can be:
  • 1=Accept-Request
  • 2=Access-Accept
  • 3=Access-Reject
  • 4=Accounting-Request
Reason-Code IAS 4142 Number Reason for rejecting a user. Can be:
  • 00 = IAS_SUCCESS
  • 01 = IAS_INTERNAL_ERROR
  • 02 = IAS_ACCESS_DENIED
  • 03 = IAS_MALFORMED_REQUEST
  • 04 = IAS_GLOBAL_CATALOG_UNAVAILABLE
  • 05 = IAS_DOMAIN_UNAVAILABLE
  • 06 = IAS_SERVER_UNAVAILABLE
  • 07 = IAS_NO_SUCH_DOMAIN
  • 08 = IAS_NO_SUCH_USER
  • 16 = IAS_AUTH_FAILURE
  • 17 = IAS_CHANGE_PASSWORD_FAILURE
  • 18 = IAS_UNSUPPORTED_AUTH_TYPE
  • 32 = IAS_LOCAL_USERS_ONLY
  • 33 = IAS_PASSWORD_MUST_CHANGE
  • 34 = IAS_ACCOUNT_DISABLED
  • 35 = IAS_ACCOUNT_EXPIRED
  • 36 = IAS_ACCOUNT_LOCKED_OUT
  • 37 = IAS_INVALID_LOGON_HOURS
  • 38 = IAS_ACCOUNT_RESTRICTION
  • 48 = IAS_NO_POLICY_MATCH
  • 64 = IAS_DIALIN_LOCKED_OUT
  • 65 = IAS_DIALIN_DISABLED
  • 66 = IAS_INVALID_AUTH_TYPE
  • 67 = IAS_INVALID_CALLING_STATION
  • 68 = IAS_INVALID_DIALIN_HOURS
  • 69 = IAS_INVALID_CALLED_STATION
  • 70 = IAS_INVALID_PORT_TYPE
  • 71 = IAS_INVALID_RESTRICTION
  • 80 = IAS_NO_RECORD
  • 96 = IAS_SESSION_TIMEOUT
  • 97 = IAS_UNEXPECTED_REQUEST
NP-Policy-Name | IAS 4149 | Text | Friendly name of remote access policy.

Attributes not recorded in IAS-formatted log files

The following attributes contain sensitive information so they are not logged:

Attribute name | ID
User-Name | 1
User-Password | 2
CHAP-Password | 3
State | 24
Proxy-State | 33
CHAP-Challenge | 60
Tunnel-Password | 69
EAP-Message | 79
Signature | 80
Saved-Radius-Framed-IP-Address | Microsoft vendor-specific attribute
Saved-Radius-Callback-Number | Microsoft vendor-specific attribute
NP-Calling-Station-ID | Microsoft vendor-specific attribute
Saved-NP-Calling-Station-ID | Microsoft vendor-specific attribute
Saved-Radius-Framed-Route | Microsoft vendor-specific attribute
NP-Sessions-Allowed | Microsoft vendor-specific attribute
Day-And-Time-Restrictions | Microsoft vendor-specific attribute
NP-Called-Station-ID | Microsoft vendor-specific attribute
NP-Allowed-Port-Types | Microsoft vendor-specific attribute
NP-Authentication-Type | Microsoft vendor-specific attribute
NP-Allowed-EAP-Type | Microsoft vendor-specific attribute
Saved-Radius-Framed-IP-Address | Shared-secret
Client-Packet-Header | Microsoft vendor-specific attribute
Token-Groups | Microsoft vendor-specific attribute
NP-Allow-Dial-in | Microsoft vendor-specific attribute
NP-Contraint | Microsoft vendor-specific attribute
NP-Version | Microsoft vendor-specific attribute
NP-VendorID | Microsoft vendor-specific attribute
NP-Sequence | Microsoft vendor-specific attribute
Client-UDP-Port | Microsoft vendor-specific attribute
MS-CHAP-Challenge | Microsoft vendor-specific attribute
MS-CHAP-Response | Microsoft vendor-specific attribute
MS-CHAP-CPW-1 | Microsoft vendor-specific attribute
MS-CHAP-CPW-2 | Microsoft vendor-specific attribute
MS-CHAP-LM-Enc-PW | Microsoft vendor-specific attribute
MS-CHAP-NT-Enc-PW | Microsoft vendor-specific attribute
MS-CHAP-MPPE-Keys | Microsoft vendor-specific attribute
Windows-Groups | Microsoft vendor-specific attribute
MS-MPPE-Send-Key | Microsoft vendor-specific attribute
MS-MPPE-Recv-Key | Microsoft vendor-specific attribute
MS-Filter | Microsoft vendor-specific attribute
MS-CHAP2-Response | Microsoft vendor-specific attribute
MS-CHAP2-Success | Microsoft vendor-specific attribute
MS-CHAP2-CPW | Microsoft vendor-specific attribute
  • Interpreting IAS IDs for vendor-specific attributes


Interpreting IAS IDs for vendor-specific attributes

When IAS logs any of the following vendor-specific attributes, it assigns a unique ID to the attribute to facilitate interpretation of the log files.

Notes

  • The ID (number) assigned by IAS to a vendor-specific attribute may not be the same as the ID assigned by the vendor. If using the IAS-formatted log file format, to determine the ID used by the vendor, see your network access server (NAS) documentation. If using database-import log files, the ID (number) assigned to the attribute does not appear in the log. Use the following table to determine the data type for the attributes listed in the table. The attributes are listed in numerical order.
  • For additional information on the Microsoft vendor-specific RADIUS attributes, see the RADIUS RFCs, in particular, RFC 2548.
ID | Attribute name | Vendor | Data type
107 | Ascend-Calling-Subaddress | Ascend | Text
108 | Ascend-Callback-Delay | Ascend | Number
109 | Ascend-Endpoint-Disc | Ascend | Text
110 | Ascend-Remote-FW | Ascend | Text
111 | Ascend-Multicast-G-Leave-Delay | Ascend | Number
112 | Ascend-CBCP-Enable | Ascend | Number
113 | Ascend-CBCP-Mode | Ascend | Number
114 | Ascend-CBCP-Delay | Ascend | Number
115 | Ascend-CBCP-Trunk-Group | Ascend | Number
116 | Ascend-Appletalk-Route | Ascend | Text
117 | Ascend-Appletalk-Peer-Mode | Ascend | Number
118 | Ascend-Route-Appletalk | Ascend | Number
119 | Ascend-FCP-Parameter | Ascend | Text
120 | Ascend-Modem-Port-No | Ascend | Number
121 | Ascend-Modem-Slot-No | Ascend | Number
122 | Ascend-Modem-Shelf-No | Ascend | Number
123 | Ascend-CallAttempt-Limit | Ascend | Number
124 | Ascend-CallBlock-Duration | Ascend | Number
125 | Ascend-Maximum-Call-Duration | Ascend | Number
126 | Ascend-Route-Preference | Ascend | Number
127 | Ascend-Tunneling-Protocol | Ascend | Number
128 | Ascend-Shared-Profile-Enable | Ascend | Number
129 | Ascend-Primary-Home-Agent | Ascend | Text
130 | Ascend-Secondary-Home-Agent | Ascend | Text
131 | Ascend-Dialout-Allowed | Ascend | Number
132 | Ascend-Client-Gateway | Ascend | Number
133 | Ascend-BACP-Enable | Ascend | Number
134 | Ascend-DHCP-Maximum-Leases | Ascend | Number
135 | Ascend-Client-Primary-DNS | Ascend | String
136 | Ascend-Client-Secondary-DNS | Ascend | String
137 | Ascend-Client-Assign-DNS | Ascend | Number
138 | Ascend-User-Acct-Type | Ascend | Number
139 | Ascend-User-Acct-Host | Ascend | Number
140 | Ascend-User-Acct-Port | Ascend | Number
141 | Ascend-User-Acct-Key | Ascend | Text
142 | Ascend-User-Acct-Base | Ascend | Number
143 | Ascend-User-Acct-Time | Ascend | Number
144 | Ascend-Assign-IP-Client | Ascend | Number
145 | Ascend-Assign-IP-Server | Ascend | Number
146 | Ascend-Assign-IP-Global-Pool | Ascend | Text
147 | Ascend-DHCP-Reply | Ascend | Number
148 | Ascend-DHCP-Pool-Number | Ascend | Number
149 | Ascend-Expect-Callback | Ascend | Number
150 | Ascend-Event-Type | Ascend | Number
151 | Ascend-Session-Svr-Key | Ascend | Text
152 | Ascend-Multicast-Rate-Limit | Ascend | Number
153 | Ascend-IF-Netmask | Ascend | Number
154 | Ascend-Remote-Addr | Ascend | Number
155 | Ascend-Multicast-Client | Ascend | Number
156 | Ascend-FR-Circuit-Name | Ascend | Text
157 | Ascend-FR-Link-Up | Ascend | Number
158 | Ascend-FR-Nailed-Grp | Ascend | Number
159 | Ascend-FR-Type | Ascend | Number
160 | Ascend-FR-Link-Mgt | Ascend | Number
161 | Ascend-FR-N391 | Ascend | Number
162 | Ascend-FR-DCE-N392 | Ascend | Number
163 | Ascend-FR-DTE-N392 | Ascend | Number
164 | Ascend-FR-DCE-N393 | Ascend | Number
165 | Ascend-FR-DTE-N393 | Ascend | Number
166 | Ascend-FR-T391 | Ascend | Number
167 | Ascend-FR-T392 | Ascend | Number
168 | Ascend-Bridge-Address | Ascend | Text
169 | Ascend-TS-Idle-Limit | Ascend | Number
170 | Ascend-TS-Idle-Mode | Ascend | Number
171 | Ascend-DBA-Monitor | Ascend | Number
172 | Ascend-Base-Channel-Count | Ascend | Number
173 | Ascend-Minimum-Channels | Ascend | Number
174 | Ascend-IPX-Route | Ascend | Text
175 | Ascend-FT1-Caller | Ascend | Number
176 | Ascend-Backup | Ascend | Text
177 | Ascend-Call-Type | Ascend | Number
178 | Ascend-Group | Ascend | Text
179 | Ascend-FR-DLCI | Ascend | Number
180 | Ascend-FR-Profile-Name | Ascend | Text
181 | Ascend-Ara-PW | Ascend | Text
182 | Ascend-IPX-Node-Addr | Ascend | Text
183 | Ascend-Home-Agent-IP-Addr | Ascend | Text
184 | Ascend-Home-Agent-Password | Ascend | Text
185 | Ascend-Home-Network-Name | Ascend | Text
186 | Ascend-Home-Agent-UDP-Port | Ascend | Number
187 | Ascend-Multilink-ID | Ascend | Number
188 | Ascend-Num-In-Multilink | Ascend | Number
189 | Ascend-First-Dest | Ascend | Number
190 | Ascend-Pre-Input-Octets | Ascend | Number
191 | Ascend-Pre-Output-Octets | Ascend | Number
192 | Ascend-Pre-Input-Packets | Ascend | Number
193 | Ascend-Pre-Output-Packets | Ascend | Number
194 | Ascend-Maximum-Time | Ascend | Number
195 | Ascend-Disconnect-Cause | Ascend | Number
196 | Ascend-Connect-Progress | Ascend | Number
197 | Ascend-Data-Rate | Ascend | Number
198 | Ascend-Pre-Session-Time | Ascend | Number
199 | Ascend-Token-Idle | Ascend | Number
200 | Ascend-Token-Immediate | Ascend | Number
201 | Ascend-Require-Auth | Ascend | Number
202 | Ascend-Number-Sessions | Ascend | Text
203 | Ascend-Authen-Alias | Ascend | Text
204 | Ascend-Token-Expiry | Ascend | Number
205 | Ascend-Menu-Selector | Ascend | Text
206 | Ascend-Menu-Item | Ascend | Text
207 | Ascend-PW-Warntime | Ascend | Number
208 | Ascend-PW-Lifetime | Ascend | Number
209 | Ascend-IP-Direct | Ascend | Text
210 | Ascend-PPP-VJ-Slot-Comp | Ascend | Number
211 | Ascend-PPP-VJ-1172 | Ascend | Number
212 | Ascend-PPP-Async-Map | Ascend | Number
213 | Ascend-Third-Prompt | Ascend | Text
214 | Ascend-Send-Secret | Ascend | Text
215 | Ascend-Receive-Secret | Ascend | Text
216 | Ascend-IPX-PeerMode | Ascend | Number
217 | Ascend-IP-Pool-Definition | Ascend | Text
218 | Ascend-Assign-IP-Pool | Ascend | Number
219 | Ascend-FR-Direct | Ascend | Number
220 | Ascend-FR-Direct-Profile | Ascend | Text
221 | Ascend-FR-Direct-DLCI | Ascend | Number
222 | Ascend-Handle-IPX | Ascend | Number
223 | Ascend-Netware-Timeout | Ascend | Number
224 | Ascend-IPX-Alias | Ascend | Number
225 | Ascend-Metric | Ascend | Number
226 | Ascend-PRI-Number-Type | Ascend | Number
227 | Ascend-Dial-Number | Ascend | Text
228 | Ascend-Route-IP | Ascend | Number
229 | Ascend-Route-IPX | Ascend | Number
230 | Ascend-Bridge | Ascend | Number
231 | Ascend-Send-Auth | Ascend | Number
232 | Ascend-Send-Passwd | Ascend | Text
233 | Ascend-Link-Compression | Ascend | Number
234 | Ascend-Target-Util | Ascend | Number
235 | Ascend-Maximum-Channels | Ascend | Number
236 | Ascend-Inc-Channel-Count | Ascend | Number
237 | Ascend-Dec-Channel-Count | Ascend | Number
238 | Ascend-Seconds-Of-History | Ascend | Number
239 | Ascend-History-Weigh-Type | Ascend | Number
240 | Ascend-Add-Seconds | Ascend | Number
241 | Ascend-Remove-Seconds | Ascend | Number
242 | Ascend-Data-Filter | Ascend | String
243 | Ascend-Call-Filter | Ascend | String
244 | Ascend-Idle-Limit | Ascend | Number
245 | Ascend-Preempt-Limit | Ascend | Number
246 | Ascend-Callback | Ascend | Number
247 | Ascend-Data-Svc | Ascend | Number
248 | Ascend-Force56 | Ascend | Number
249 | Ascend-Billing-Number | Ascend | Text
250 | Ascend-Call-By-Call | Ascend | Number
251 | Ascend-Transit-Number | Ascend | Text
252 | Ascend-Host-Info | Ascend | Text
253 | Ascend-PPP-Address | Ascend | Number
254 | Ascend-MPP-Idle-Percent | Ascend | Number
255 | Ascend-Xmit-Rate | Ascend | Number
4120 | MS-CHAP-Domain | Microsoft | String
4121 | MS-CHAP-Error | Microsoft | String
4134 | MS-Acct-Auth-Type | Microsoft | Number
4135 | MS-Acct-EAP-Type | Microsoft | Number
4143 | MS-Filter | Microsoft | String
4147 | MS-RAS-Vendor | Microsoft | Number
4148 | MS-RAS-Version | Microsoft | String
4150 | MS-Primary-DNS-Server | Microsoft | String
4151 | MS-Secondary-DNS-Server | Microsoft | String
4152 | MS-Primary-NBNS-Server | Microsoft | String
4153 | MS-Secondary-NBNS-Server | Microsoft | String
5000 | Cisco-AV-Pair | Cisco | Text
11000 | USR-Last-Number-Dialed-Out | US Robotics | Text
11001 | USR-Last-Number-Dialed-In-DNIS | US Robotics | Text
11002 | USR-Last-Callers-Number-ANI | US Robotics | Text
11003 | USR-Channel | US Robotics | Number
11004 | USR-Event-Id | US Robotics | Number
11005 | USR-Event-Date-Time | US Robotics | Number
11006 | USR-Call-Start-Date-Time | US Robotics | Number
11007 | USR-Call-End-Date-Time | US Robotics | Number
11008 | USR-Default-DTE-Data-Rate | US Robotics | Number
11009 | USR-Initial-Rx-Link-Data-Rate | US Robotics | Number
11010 | USR-Final-Rx-Link-Data-Rate | US Robotics | Number
11011 | USR-Initial-Tx-Link-Data-Rate | US Robotics | Number
11012 | USR-Final-Tx-Link-Data-Rate | US Robotics | Number
11013 | USR-Chassis-Temperature | US Robotics | Number
11014 | USR-Chassis-Temp-Threshold | US Robotics | Number
11015 | USR-Actual-Voltage | US Robotics | Number
11016 | USR-Expected-Voltage | US Robotics | Number
11017 | USR-Power-Supply-Number | US Robotics | Number
11018 | USR-Card-Type | US Robotics | Number
11019 | USR-Chassis-Slot | US Robotics | Number
11020 | USR-Sync-Async-Mode | US Robotics | Number
11021 | USR-Originate-Answer-Mode | US Robotics | Number
11022 | USR-Modulation-Type | US Robotics | Number
11023 | USR-Initial-Modulation-Type | US Robotics | Number
11024 | USR-Connect-Term-Reason | US Robotics | Number
11025 | USR-Failure-to-Connect-Reason | US Robotics | Number
11026 | USR-Equalization-Type | US Robotics | Number
11027 | USR-Fallback-Enabled | US Robotics | Number
11028 | USR-Connect-Time-Limit | US Robotics | Number
11029 | USR-Number-of-Rings-Limit | US Robotics | Number
11030 | USR-DTE-Data-Idle-Timout | US Robotics | Number
11031 | USR-Characters-Sent | US Robotics | Number
11032 | USR-Characters-Received | US Robotics | Number
11033 | USR-Blocks-Sent | US Robotics | Number
11034 | USR-Blocks-Received | US Robotics | Number
11035 | USR-Blocks-Resent | US Robotics | Number
11036 | USR-Retrains-Requested | US Robotics | Number
11037 | USR-Retrains-Granted | US Robotics | Number
11038 | USR-Line-Reversals | US Robotics | Number
11039 | USR-Number-Of-Characters-Lost | US Robotics | Number
11040 | USR-Number-of-Blers | US Robotics | Number
11041 | USR-Number-of-Link-Timeouts | US Robotics | Number
11042 | USR-Number-of-Fallbacks | US Robotics | Number
11043 | USR-Number-of-Upshifts | US Robotics | Number
11044 | USR-Number-of-Link-NAKs | US Robotics | Number
11045 | USR-DTR-False-Timeout | US Robotics | Number
11046 | USR-Fallback-Limit | US Robotics | Number
11047 | USR-Block-Error-Count-Limit | US Robotics | Number
11048 | USR-DTR-True-Timeout | US Robotics | Number
11049 | USR-Security-Login-Limit | US Robotics | Number
11050 | USR-Security-Resp-Limit | US Robotics | Number
11051 | USR-DTE-Ring-No-Answer-Limit | US Robotics | Number
11052 | USR-Back-Channel-Data-Rate | US Robotics | Number
11053 | USR-Simplified-MNP-Levels | US Robotics | Number
11054 | USR-Simplified-V42bis-Usage | US Robotics | Number
11055 | USR-Mbi-Ct-PRI-Card-Slot | US Robotics | Number
11056 | USR-Mbi-Ct-TDM-Time-Slot | US Robotics | Number
11057 | USR-Mbi-Ct-PRI-Card-Span-Line | US Robotics | Number
11058 | USR-Mbi-Ct-BChannel-Used | US Robotics | Number
11059 | USR-Physical-State | US Robotics | Number
11060 | USR-Packet-Bus-Session | US Robotics | Number
11061 | USR-Server-Time | US Robotics | Number
11062 | USR-Channel-Connected-To | US Robotics | Number
11063 | USR-Slot-Connected-To | US Robotics | Number
11064 | USR-Device-Connected-To | US Robotics | Number
11065 | USR-NFAS-ID | US Robotics | Number
11066 | USR-Q931-Call-Reference-Value | US Robotics | Number
11067 | USR-Call-Event-Code | US Robotics | Number
11068 | USR-DS0 | US Robotics | Number
11069 | USR-DS0s | US Robotics | Text
11070 | USR-Gateway-IP-Address | US Robotics | String
11071 | USR-Call-Arrival-in-GMT | US Robotics | Number
11072 | USR-Call-Connect-in-GMT | US Robotics | Number
11073 | USR-Call-Terminate-in-GMT | US Robotics | Number
11074 | USR-IDS0-Call-Type | US Robotics | Number
11075 | USR-Call-Reference-Number | US Robotics | Number
11076 | USR-CDMA-Call-Reference-Number | US Robotics | Number
11077 | USR-Mobile-IP-Address | US Robotics | String
11078 | USR-IWF-IP-Address | US Robotics | String
11079 | USR-Called-Party-Number | US Robotics | Text
11080 | USR-Calling-Party-Number | US Robotics | Text
11081 | USR-Call-Type | US Robotics | Number
11082 | USR-ESN | US Robotics | Text
11083 | USR-IWF-Call-Identifier | US Robotics | Number
11084 | USR-IMSI | US Robotics | Text
11085 | USR-Service-Option | US Robotics | Number
11086 | USR-Disconnect-Cause-Indicator | US Robotics | Number
11087 | USR-Mobile-NumBytes-Txed | US Robotics | Number
11088 | USR-Mobile-NumBytes-Rxed | US Robotics | Number
11089 | USR-Num-Fax-Pages-Processed | US Robotics | Number
11090 | USR-Compression-Type | US Robotics | Number
11091 | USR-Call-Error-Code | US Robotics | Number
11092 | USR-Modem-Setup-Time | US Robotics | Number
11093 | USR-Call-Connecting-Time | US Robotics | Number
11094 | USR-Connect-Time | US Robotics | Number
11095 | USR-RMMIE-Manufacutere-ID | US Robotics | Number
11096 | USR-RMMIE-Product-Code | US Robotics | Text
11097 | USR-RMMIE-Serial-Number | US Robotics | Text
11098 | USR-RMMIE-Firmware-Version | US Robotics | Text
11099 | USR-RMMIE-Firmware-Build-Date | US Robotics | Text
11100 | USR-RMMIE-Status | US Robotics | Number
11101 | USR-RMMIE-Num-Of-Updates | US Robotics | Number
11102 | USR-RMMIE-x2-Status | US Robotics | Number
11103 | USR-RMMIE-Planned-Disconnect | US Robotics | Number
11104 | USR-RMMIE-Last-Update-Time | US Robotics | Number
11105 | USR-RMMIE-Last-Update-Event | US Robotics | Number
11106 | USR-RMMIE-Rcv-Tot-PwrLvl | US Robotics | Number
11107 | USR-RMMIE-Rcv-PwrLvl-3300Hz | US Robotics | Number
11108 | USR-RMMIE-Rcv-PwrLvl-3750Hz | US Robotics | Number
11109 | USR-RMMIE-PwrLvl-NearEcho-Canc | US Robotics | Number
11110 | USR-RMMIE-PwrLvl-FarEcho-Canc | US Robotics | Number
11111 | USR-RMMIE-PwrLvl-Noise-Lvl | US Robotics | Number
11112 | USR-RMMIE-PwrLvl-Xmit-Lvl | US Robotics | Number
11113 | USR-PW-IFilter-IP | US Robotics | Text
11114 | USR-PW-IFilter-IPX | US Robotics | Text
11115 | USR-PW-IFilter-SAP | US Robotics | Text
11116 | USR-PW-OFilter-IP | US Robotics | Text
11117 | USR-PW-OFilter-IPX | US Robotics | Text
11118 | USR-PW-OFilter-SAP | US Robotics | Text
11119 | USR-PW-VPN-ID | US Robotics | Number
11120 | USR-PW-VPN-Name | US Robotics | Text
11121 | USR-PW-VPN-Neighbor | US Robotics | String
11122 | USR-PW-Framed-Routing-V2 | US Robotics | Number
11123 | USR-PW-VPN-Gateway | US Robotics | Text
11124 | USR-PW-Tunnel-Authentication | US Robotics | Text
11125 | USR-PW-Index | US Robotics | Number
11126 | USR-PW-Cutoff | US Robotics | Text
11127 | USR-PW-Packet | US Robotics | Text
11128 | USR-Primary-DNS-Server | US Robotics | String
11129 | USR-Secondary-DNS-Server | US Robotics | String
11130 | USR-Primary-NBNS-Server | US Robotics | String
11131 | USR-Secondary-NBNS-Server | US Robotics | String
11132 | USR-Syslog-Tap | US Robotics | Number
11133 | USR-Log-Filter-Packet | US Robotics | Number
11134 | USR-Chassis-Call-Slot | US Robotics | Number
11135 | USR-Chassis-Call-Span | US Robotics | Number
11136 | USR-Chassis-Call-Channel | US Robotics | Number
11137 | USR-Keypress-Timeout | US Robotics | Number
11138 | USR-Unauthenticated-Time | US Robotics | Number
11139 | USR-VPN-Encryptor | US Robotics | Text
11140 | USR-VPN-GW-Location-Id | US Robotics | Text
11141 | USR-Re-Chap-Timeout | US Robotics | Number
11142 | USR-CCP-Algorithm | US Robotics | Number
11143 | USR-ACCM-Type | US Robotics | Number
11144 | USR-Connect-Speed | US Robotics | Number
11145 | USR-Framed-IP-Address-Pool-Name | US Robotics | Text
11146 | USR-MP-EDO | US Robotics | String
11147 | USR-Local-Framed-IP-Addr | US Robotics | String
11148 | USR-Framed-IPX-Route | US Robotics | String
11149 | USR-MPIP-Tunnel-Originator | US Robotics | String
11150 | USR-Bearer-Capabilities | US Robotics | Number
11151 | USR-Speed-Of-Connection | US Robotics | Number
11152 | USR-Max-Channels | US Robotics | Number
11153 | USR-Channel-Expansion | US Robotics | Number
11154 | USR-Channel-Decrement | US Robotics | Number
11155 | USR-Expansion-Algorithm | US Robotics | Number
11156 | USR-Compression-Algorithm | US Robotics | Number
11157 | USR-Receive-Acc-Map | US Robotics | Number
11158 | USR-Transmit-Acc-Map | US Robotics | Number
11159 | USR-Compression-Reset-Mode | US Robotics | Number
11160 | USR-Min-Compression-Size | US Robotics | Number
11161 | USR-IP | US Robotics | Number
11162 | USR-IPX | US Robotics | Number
11163 | USR-Filter-Zones | US Robotics | Number
11164 | USR-Appletalk | US Robotics | Number
11165 | USR-Bridging | US Robotics | Number
11166 | USR-Spoofing | US Robotics | Number
11167 | USR-Host-Type | US Robotics | Number
11168 | USR-Send-Name | US Robotics | Text
11169 | USR-Send-Password | US Robotics | Text
11170 | USR-Start-Time | US Robotics | Number
11171 | USR-End-Time | US Robotics | Number
11172 | USR-Send-Script1 | US Robotics | Text
11173 | USR-Reply-Script1 | US Robotics | Text
11174 | USR-Send-Script2 | US Robotics | Text
11175 | USR-Reply-Script2 | US Robotics | Text
11176 | USR-Send-Script3 | US Robotics | Text
11177 | USR-Reply-Script3 | US Robotics | Text
11178 | USR-Send-Script4 | US Robotics | Text
11179 | USR-Reply-Script4 | US Robotics | Text
11180 | USR-Send-Script5 | US Robotics | Text
11181 | USR-Reply-Script5 | US Robotics | Text
11182 | USR-Send-Script6 | US Robotics | Text
11183 | USR-Reply-Script6 | US Robotics | Text
11184 | USR-Terminal-Type | US Robotics | Text
11185 | USR-Appletalk-Network-Range | US Robotics | Number
11186 | USR-Local-IP-Address | US Robotics | Text
11187 | USR-Routing-Protocol | US Robotics | Number
11188 | USR-Modem-Group | US Robotics | Text
11189 | USR-IPX-Routing | US Robotics | Number
11190 | USR-IPX-WAN | US Robotics | Number
11191 | USR-IP-RIP-Policies | US Robotics | Number
11192 | USR-IP-RIP-Simple-Auth-Password | US Robotics | Text
11193 | USR-IP-RIP-Input-Filter | US Robotics | Text
11194 | USR-IP-Call-Input-Filter | US Robotics | Text
11195 | USR-IPX-RIP-Input-Filter | US Robotics | Text
11196 | USR-MP-MRRU | US Robotics | Number
11197 | USR-IPX-Call-Input-Filter | US Robotics | Text
11198 | USR-AT-Input-Filter | US Robotics | Text
11199 | USR-AT-RTMP-Input-Filter | US Robotics | Text
11200 | USR-AT-Zip-Input-Filter | US Robotics | Text
11201 | USR-AT-Call-Input-Filter | US Robotics | Text
11202 | USR-ET-Bridge-Input-Filter | US Robotics | Text
11203 | USR-IP-RIP-Output-Filter | US Robotics | Text
11204 | USR-IP-Call-Output-Filter | US Robotics | Text
11205 | USR-IPX-RIP-Output-Filter | US Robotics | Text
11206 | USR-IPX-Call-Output-Filter | US Robotics | Text
11207 | USR-AT-Output-Filter | US Robotics | Text
11208 | USR-AT-RTMP-Output-Filter | US Robotics | Text
11209 | USR-AT-Zip-Output-Filter | US Robotics | Text
11210 | USR-AT-Call-Output-Filter | US Robotics | Text
11211 | USR-ET-Bridge-Output-Filter | US Robotics | Text
11212 | USR-ET-Bridge-Call-Output-Filter | US Robotics | Text
11213 | USR-IP-Default-Route-Option | US Robotics | Number
11214 | USR-MP-EDO-HIPER | US Robotics | String
11215 | USR-Modem-Training-Time | US Robotics | Number
11216 | USR-Interface-Index | US Robotics | Number
11217 | USR-Tunnel-Security | US Robotics | Number
11218 | USR-Port-Tap | US Robotics | Number
11219 | USR-Port-Tap-Format | US Robotics | Number
11220 | USR-Port-Tap-Output | US Robotics | Number
11221 | USR-Port-Tap-Facility | US Robotics | Number
11222 | USR-Port-Tap-Priority | US Robotics | Number
11223 | USR-Port-Tap-Address | US Robotics | String
11224 | USR-MobileIP-Home-Agent-Address | US Robotics | String
11225 | USR-Tunneled-MLPP | US Robotics | Number
11226 | USR-Multicast-Proxy | US Robotics | Number
11227 | USR-Multicast-Receive | US Robotics | Number
11228 | USR-Multicast-Forwarding | US Robotics | Number
11229 | USR-IGMP-Query-Interval | US Robotics | Number
11230 | USR-IGMP-Maximum-Response-Time | US Robotics | Number
11231 | USR-IGMP-Robustness | US Robotics | Number
11232 | USR-IGMP-Version | US Robotics | Number
11233 | USR-IGMP-Routing | US Robotics | Number
11234 | USR-VTS-Session-Key | US Robotics | Text
11235 | USR-Orig-NAS-Type | US Robotics | Text
11236 | USR-Call-Arrival-Time | US Robotics | Number
11237 | USR-Call-End-Time | US Robotics | Number
11238 | USR-Rad-Multicast-Routing-Ttl | US Robotics | Number
11239 | USR-Rad-Multicast-Routing-Rate-Limit | US Robotics | Number
11240 | USR-Rad-Multicast-Routing-Protocol | US Robotics | Number
11241 | USR-Rad-Multicast-Routing-Boundary | US Robotics | Text
11242 | USR-Rad-Dvmrp-Metric | US Robotics | Number
11243 | USR-Chat-Script-Name | US Robotics | Text
11244 | USR-Chat-Script-Rules | US Robotics | Text
11245 | USR-Rad-Location-Type | US Robotics | Number
11246 | USR-Tunnel-Switch-Endpoint | US Robotics | Text
11247 | USR-OSPF-Addressless-Index | US Robotics | Number
11248 | USR-Callback-Type | US Robotics | Number
11249 | USR-Tunnel-Auth-Hostname | US Robotics | Text
11250 | USR-Acct-Reason-Code | US Robotics | Number
11251 | USR-DNIS-ReAuthentication | US Robotics | Number
11252 | USR-PPP-Source-IP-Filter | US Robotics | Text
11253 | USR-Auth-Mode | US Robotics | Number
11254 | USR-NAS-Type | US Robotics | Number
11255 | USR-Request-Type | US Robotics | Number


Resources

This section provides information on:

  • Tools for monitoring IAS
  • RADIUS RFCs
  • Microsoft Platform Software Development Kit
  • Windows 2000 Resource Kit
  • IAS updated technical information


Tools for monitoring IAS

You can obtain useful information by charting the performance of IAS at specified intervals. There are several Windows 2000 server components and Microsoft programs you can use with IAS to capture statistics. After analyzing these statistics, you can reevaluate your bandwidth and hardware configuration, determine the cause of malformed and invalid packets and rejected or discarded authentication requests, and alert yourself to potential disruptions in network security. This topic discusses the following:

  • Windows 2000 System Monitor counters
  • Windows 2000 Event Viewer
  • Windows 2000 SNMP Service
  • The Network Monitor component of Microsoft Systems Management Server

System Monitor counters

Use System Monitor to monitor resource use of specific components and program processes. With System Monitor, you can use charts and reports to see how efficiently your server uses IAS, and to identify and troubleshoot possible problems and bottlenecks.

You can use System Monitor to monitor the following IAS-related performance objects:

  • IAS Accounting Clients
  • IAS Accounting Server
  • IAS Authentication Clients
  • IAS Authentication Server

Event Viewer

Use Event Viewer to gather information about hardware and software problems and to monitor Windows 2000 security events, including informational, warning, and error events. For more information on using IAS with Event Viewer, see Event logging for IAS

SNMP Service

Use Simple Network Management Protocol (SNMP) Service to monitor status information for your IAS server.

Network Monitor component

You can use Network Monitor component of Windows 2000 or a commercial packet analyzer or "sniffer", to view authentication packets and accounting packets as they arrive at the IAS server. With Network Monitor, you can detect dropped packets, monitor lack of response from authentication providers. Network Monitor also contains a RADIUS parser, so you can observe how the NAS interacts with the IAS server.


RADIUS RFCs

RFCs are an evolving series of technical reports, proposals for protocols, and protocol standards used by the Internet community. Routing standards are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups. For information on configuring PPP settings in connections, see PPP settings.

RFCs covering IAS attributes

RFC number | Title
2138 | Remote Authentication Dial In User Service (RADIUS)
2139 | Radius Accounting
2548 | Microsoft Vendor-specific RADIUS Attributes

Obtaining RFCs

You can obtain RFCs from the Requests for Comments Web site. This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following:

  • Approved Internet standards
  • Proposed Internet standards (circulated in draft form for review)
  • Internet best practices
  • For Your Information (FYI) documents.

Note


Microsoft Platform Software Development Kit

The Microsoft Platform Software Development Kit contains the IAS Software Development Kit (SDK). Using the IAS SDK, you can extend the IAS functionality and:

  • Return custom attributes to the NAS in addition to those returned by IAS. This enables you to build your own plug-in for assigning IP Addresses.
  • Control the number of end-user network sessions.
  • Extend the remote access authorizations currently provided by IAS.
  • Import usage/audit data directly into an Open Database Connectivity (ODBC)-compliant database.
  • Enable custom (non-EAP) authentication methods for IAS.


Windows 2000 Resource Kit

The Windows 2000 Resource Kit, published by Microsoft Press, contains a significant amount of information on IAS. Also, the CD that accompanies it contains useful tools you can use to help interpret the attributes contained in the IAS accounting and authentication logs.

For more information, see Windows 2000 Resource Kit.


IAS updated technical information

You can find updated technical information about IAS by searching technical articles available from the Personal Support Center at the microsoft Web site. For more information, see Updated technical information.


Troubleshooting

This topic covers common problems with IAS installation.

What problem are you having?

Valid users cannot log on, and the Windows 2000 Event Viewer error message is one of the following:
Unknown username or bad password.
The specified user does not exist.
The specified domain did not exist.

Cause: The user has typed in the wrong user name or password.

Solution: Check the user's Windows 2000 user name and account password to make sure they are typed correctly and that the account is valid for the domain IAS is authenticating the user against.

Cause: Realm replacement might be set up incorrectly, or in the wrong order, so that the domain controller can not recognize the user name.

Solution: Adjust the realm replacement rules.

See also: Realm names, Configure realm replacement in IAS

Cause: If the remote access server is a member of domain and the user response does not contain a domain name, then the domain name of the remote access server is used.

Solution: To use a different domain name than that of the IAS server, on the computer running IAS, set the following registry value to the name of the domain that you want to use:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\Policy

Important

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Cause: Some NASs automatically strip the domain name from the user name before forwarding the user name to a RADIUS server.

Solution: Turn off the feature that strips the domain name from the user name. For more information, see your NAS documentation.

Cause: The user might be using CHAP, but Active Directory might not be configured to use clear-text passwords.

Solution: To use CHAP authentication with IAS, configure the dial-in profile for a user or group to use CHAP. The NAS and the user's dialing program (such as Connection Manager) should also be configured to use CHAP authentication. You also need to enable CHAP on the domain controller. After you enable reversibly-encrypted passwords in a domain, all users must change their passwords before they will be able to authenticate against the domain.

See also: Enable reversibly encrypted passwords in a domain.

Valid users cannot log on, and the Windows 2000 Event Viewer error message is:
The authentication type is not supported on this system.

Cause: The user is trying to authenticate by using an authentication method that is not supported on this computer. For example, the user may be using an EAP type that hasn't been installed.

Solution: Edit the dial-in profile to allow the protocol in question.

See also: To configure authentication.

Valid users cannot log on, and the Windows 2000 Event Viewer error message is one of the following:
The user's information did not match a Remote Access Policy.
The user is not allowed dial-in access to the network.
User attempted an unauthorized authentication method.
User tried to connect from an unauthorized calling station.
User tried to dial in outside of permitted hours.
User tried to connect by calling an unauthorized NAS phone number.
User tried to connect using an invalid port type.
A constraint defined in the Remote Access Policy failed.

Cause: A remote access policy might be denying access to the user.

Solution: Check the policy list to make sure you have not excluded users who should be granted access. Check the event log to see if the user is trying to connect with parameters not permitted by a remote access policy (for example, during an unauthorized time period, using an unauthorized wrong port type, calling from an unauthorized wrong phone number, or calling an unauthorized NAS phone number). You may have to revise the remote access policies accordingly to grant the user access.

Cause: Remote access policies might be in the wrong order.

Solution: Authorization is granted or denied by the first policy whose conditions apply to the user who is trying to connect. Use the Move Up button to move the policy that grants access to the users who are having trouble so that it is higher in the list.

Valid users cannot log on, and the Windows 2000 Event Viewer error message is:
The user has exceeded the dial-in lockout count.

Cause: If account lockout is enabled, then previous failed access attempts may have caused the user account to be locked out.

Solution: Expand the dial-in lockout count.

See also: Account lockout

Valid users cannot log on, and the Windows 2000 Event Viewer error message is :
The user's account is currently locked out and may not be logged on to.

Cause: If account lockout is enabled, then previous failed access attempts may have caused the user account to be locked out.

Solution: Either have the user wait until the failed attempt timer is reset, or manually reset the account (if the user can not wait until the timer is reset).

See also: Account lockout

Valid users cannot log on, and the Windows 2000 Event Viewer error message is:
The user is not allowed dial-in access to the network.

Cause: User may be denied dial-in access.

Solution: Check the user's information on the domain controller (or in Local Users and Groups) to see that dial-in access is granted for the user. If dial-in access is denied, this overrides any remote access policy that grants access.

Valid users cannot log on, and the Windows 2000 Event Viewer error message is:
The current configuration only supports local user accounts.

Cause: IAS is set up to authenticate against the local SAM, and the user is not a member of the local user database.

Solution: Add the IAS server to Active Directory.

See also: To enable the IAS server to view user objects in Active Directory

Valid users cannot log on, and the Windows 2000 Event Viewer error message is one of the following:
The user's account domain is unreachable.
The server is unavailable.
The specified domain did not exist.
IAS could not access the Global Catalog.

Cause: There may be a communication problem between the NAS and IAS, or between IAS and the domain controller or Global Catalog server.

Solution: Use the ping command to check the communication with the domain controller or Global Catalog server. If ping works, try to connect to the server by using the command net use \\servername\share.

See also: If no packet information appears in the IAS log, check the Windows 2000 event log to see whether the connection attempt times out. For more information on configuring the IAS log, see ODBC-compatible log files or IAS-formatted log files, depending on the log file format you have chosen to use.

Valid users cannot log on, and the Windows 2000 Event Viewer error message is:
The user must change his password.

Cause: The user might be using CHAP, but Active Directory might not be configured to use clear-text passwords.

Solution: To use CHAP authentication with IAS, configure the dial-in profile for a user or group to use CHAP. The NAS and the user's dialing program (such as Connection Manager) should also be configured to use CHAP authentication. You also need to enable CHAP on the domain controller.

See also: Enable reversibly encrypted passwords in a domain.

Valid users cannot log on, IAS does not return a response, and the Windows 2000 Event Viewer error message is one of the following:
The request was malformed.
Dropped the authentication request because it contained an unexpected packet.

Cause: The shared secrets on the IAS server and the NAS do not match.

Solution: Check to make sure both are typed correctly, and that the capitalization of both shared secrets is identical.

Cause: Certain NASs require shorter shared secrets.

Solution: Try changing the shared secret on both computers to one that is less than 10 characters long.

Cause: Certain NASs do not recognize all the characters that IAS accepts for the shared secret.

Solution: Try changing the shared secret to one with only alphanumeric characters.

Cause: The NAS may be sending packets that do not correspond to the format expected by IAS.

Solution: Right-click Internet Authentication Service and then click Properties. Make sure Log rejected or discarded authentication requests is selected, and then display the Windows 2000 event log to see if unexpected or malformed packets are being sent. If this is the case, you may need to set some vendor-specific attributes in IAS to solve communication problems with your NAS.

See also: Refer to your NAS documentation.

Cause: IAS cannot connect to the domain.

Solution: Make sure IAS is authenticating against the correct domain name. If the domain name is correct, make sure that the IAS server is a member of that domain, or that there is a trust relationship between that domain and the domain to which the IAS server belongs.

Cause: IAS does not have permission to view user objects in Active Directory.

Solution: Add the IAS server to Active Directory.

See also: To enable the IAS server to view user objects in Active Directory

Cause: The user account is in a Active Directory forest that is different than the forest the IAS server is a member of.

Solution: Use a RADIUS proxy to route the authentication request to a IAS server that is a member of the other Active Directory Forest.

Valid users cannot log on, and the IAS log indicates that IAS returned an Access-Accept packet.

Cause: The setting enabled in the remote access policy or user account may not be enabled or supported in the NAS. If your site uses an outsourced dial-in service, also make sure that the setting is supported or allowed by the RADIUS proxy at your ISP, because a user may not be able to connect if the NAS supports all the settings enabled by a remote access policy but the RADIUS proxy does not support some of those settings. For example:

  • The user may be trying to use 128-bit encryption enabled, IAS has it enabled in a remote access policy, but Routing and Remote Access does not.
  • The Remote Access Policy supports a callback attribute for the NAS, but callback is not enabled on the NAS or RADIUS proxy.

Solution: Make sure the settings in the Remote Access policy or user account are all supported and enabled by your NAS.

  • For the 128-bit encryption example, enable the Strongest security setting on the Routing and Remote Access server. (If you have not enabled it on this server before, you may need to install the Microsoft Encryption Pack.)
  • For the callback example, see the documentation for your NAS. In the case of an outsourced dial-in service, contact your ISP to make sure the RADIUS proxy supports callback.

See also: Data encryption

Cause: Your NAS or RADIUS proxy may require a setting that has not been configured in the remote access policy on IAS or the user account. For example:

  • Your NAS may require framed routing, but on IAS, framed routing is not set by default.
  • Your NAS may require Van Jacobsen TCP/IP compression, which is not enabled on IAS by default.
  • If framed MTU is set on the NAS and not on IAS, users will not be able to log on.

Solution: Make sure the settings for your NAS match the settings in the remote access policy or the user account. If you are using an outsourced dial-in service, check with the ISP maintaining the RADIUS proxy to make sure the proxy's settings match the settings in the remote access policy or the user account. The following solutions correspond to the examples.

Solution: Check Enable framed routing.

  1. In IAS, click Remote Access Policies, and then double-click the policy that applies to the users who cannot log on.
  2. Click Edit Profile, click the Advanced tab, and then click Add.
  3. In the list of available RADIUS attributes, double-click Framed-Routing.
  4. In Attribute Value, click None.

Solution: Configure IAS to work with Van Jacobsen TCP/IP compression.

  1. In IAS, click Remote Access Policies, and then double-click the policy that applies to the users who cannot log on.
  2. Click Edit Profile, click the Advanced tab, and then click Add.
  3. In the list of available RADIUS attributes, double-click Framed-Compression.
  4. In Attribute Value, click Van Jacobsen TCP/IP.

Solution: Check your framed MTU settings on IAS and make sure they match the settings on your NAS.

  1. In IAS, click Remote Access Policies, and then double-click the policy that applies to the users who cannot log on.
  2. Click Edit Profile, click the Advanced tab, and then click Add.
  3. In the list of available RADIUS attributes, double-click Framed-MTU.
  4. Click Attribute Value, and then type the value that matches the settings for your NAS.

Cause: The IAS server may be configured incorrectly. For example:

  • The shared secret on IAS may not match the shared secret on the NAS.
  • If IAS is returning the Access-Accept packet by using a different network adapter than the one by which the Access-Request packet was received, the NAS will not recognize the packet.

Solution: Check your IAS settings. For the example in which IAS is returning the Access-Accept packet by using a different network adapter than the one by which the Access-Request packet was received, check the routes and metrics assigned to the NAS. If that doesn't solve the problem, edit the port settings for IAS and specify the IP addresses that IAS should use. To do this:

  • Right-click IAS, and then click Properties.
  • On the RADIUS tab, click Authentication and then type the IP address of the NAS and the port, separated by a colon (for example: 10.10.10.10:1812, 10.10.10.10:1645).

See also: Refer to your NAS documentation for these or other attributes that should be returned by the IAS with an Access-Accept packet. IAS might be sending an attribute that the NAS cannot implement, or else the NAS might require attributes that IAS is not including in the Access-Accept packet.

Cause: If the request is returned through a RADIUS proxy, the proxy might not support certain extensions that are necessary to support some features. For example:

  • if you want your users to use EAP authentication, the RADIUS proxy must support digital signatures (according to RADIUS extensions).
  • If you want your users to connect using compulsory tunnels, the RADIUS proxy must support encryption of the tunnel password.
  • If you want connections to use Microsoft Encryption, the RADIUS proxy must support encryption of MPPE keys.

Solution: Check your RADIUS proxy documentation to make sure that it supports the extensions necessary for the features you want to use.

Users can log on who should not have remote access permission.

Cause: A remote access policy might be granting access to the user.

Solution: Check the policy list to make sure you have not included users who should be denied access.

Cause: Dial-in properties for the user object might be set to override the remote access policy.

Solution: Check the dial-in properties for the user object.

See also: To configure dial-in constraints, Dial-in properties of a user account.

Cause: Remote access policies might be in the wrong order.

Solution: Authorization is granted or denied by the first policy whose conditions apply to the user who is trying to connect. Use the Move Up button. to move the policy that denies access to the users so that it is higher in the list.

Users can log on successfully, but their logon attempts do not appear in the log files.

Cause: IAS is not set up to log rejected or discarded authentication requests.

Solution: Set up IAS to log rejected or discarded authentication requests in the Windows 2000 event log and see if any malformed packets are being logged. The NAS might require a different shared secret for RADIUS accounting. Make sure the shared secret for accounting is the same as the one used for authentication.

See also: Event logging for IAS

PAP authentication works but CHAP authentication does not.

Cause: The dial-in profile for the remote access policy may not be set up to permit CHAP encryption.

Solution: Check dial-in profile settings to be sure that IAS is set up for CHAP authentication.

Solution: Check to see whether your NAS is set up for CHAP. For more information, see your NAS documentation.

Solution: Check to make sure the domain controller is configured to store reversibly encrypted passwords.

See also: Enable reversibly encrypted passwords in a domain.

Cause: Passwords are not stored in a reversibly-encrypted form until they are reset.

Solution: After you enable passwords to be stored in a reversibly encrypted form, the current passwords are not in a reversibly encrypted form and are not automatically changed. You must either reset user passwords or set user passwords to be changed the next time each user logs on.

See also: To reset a user password, To modify user account properties

You have just changed your Windows 2000 Domain Controller from mixed mode to native mode, and you no longer have access to the Remote access and IAS Servers Access Check container.

Cause: After you switch a domain controller from Mixed mode to Native mode, every domain controller in the domain must be rebooted in order for the change to replicate.

Solution: Reboot the domain controllers, and then the servers will have access to the domain controller again.

You can no longer see the Remote Access Policies node for your Routing and Remote Access server.

Cause: When a Routing and Remote Access server is set to use RADIUS authentication, Remote Access Policies are only accessible from Internet Authentication Service.

Solution: This is intentional behavior.


Restrict access to specific times

To restrict access to specific times

  1. In the IAS console tree, double-click Internet Authentication Service.
  2. Right-click Remote Access Policies, and then click New Remote Access Policy.
  3. In Policy friendly name, type a unique, descriptive name for the policy, and then click Next.
  4. Click Add, and then double-click Day-And-Time-Restriction.
  5. Select the time range during which you want to grant access, and then click Permitted.