Configure IAS

This is preliminary documentation and is subject to change.

Configuring IAS

If this is the first time you've configured this authentication server, perform the configuration tasks in the following order:


To Set Internet Authentication Services Port Properties

To set IAS port information

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Right-click your computer name, and then click Properties.
  5. If your RADIUS authentication and RADIUS accounting UDP ports differ from the default values provided, click the RADIUS tab, and then, in Authentication and Accounting, type your port settings.
Notes
  • To configure a remote IAS server, you must be logged on with under a user account that has administrative privileges to the remote server. You must also be able to communicate with the server by using the Server Message Block (SMB) protocol. Not all firewalls can transfer the SMB protocol, so if you are not sure whether or not yours can, consult your network administrator.
  • If IAS is running, stop it and restart it to apply any changes you have made to the properties.
  • The default values are set to the commonly defined RADIUS standards: 1645 for authentication and 1646 for accounting. The most recently defined RADIUS standards at the time of this publication are 1812 for authentication and 1813 for accounting. If you are unsure of your port settings, refer to your NAS documentation.


To register clients of this server

To register clients of this server

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Double-click the name of your computer.
    The Clients, Logging, and Network Access Policies folders appear.
  5. Right-click the Clients folder, and then click New.
  6. Click Friendly name for client, and then type a descriptive name for the client.
  7. Click Address (IP or DNS), and then enter the appropriate value.
    To verify the address, click Verify.
  8. In Password (shared secret), enter the shared secret for the client.

Note

  • Passwords (shared secrets) are case-sensitive. Be sure that the client’s shared secret and the shared secret you enter in this field are identical to each other and conform with the password rules listed in “Deploying Internet Authentication Services.”


To set logging properties

To set up the logging service

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Double-click the name of your computer.
    The Clients, Logging, and Network Access Policies folders appear.
  5. Right-click Logging and click New to create a new log.
  6. On the Settings tab under Enable Logging, select one or more check boxes to capture packet traffic processed by IAS:
    • To capture accounting requests, approvals, and denials, click Log accounting requests.
    • To capture authentication requests, access approvals, and access denials, click Log authentication requests.
    • To capture periodic status updates, such as interim accounting packets, click Log periodic status.
  7. On the Local File tab,select the Automatically open new log check box, and then click the interval you want.
    • To handle heavy transaction volume and logging activity, select Daily.
      Or, if your server experiences very little activity, select Weekly or Monthly.
    • If you are unsure of the transaction volume, enter a log size at which a new log should be opened.
  8. In Log file directory, enter a location to store the log file.
Notes
  • The information collected in the Event Viewer is valuable for evaluating server performance and for troubleshooting. Selecting Log accounting requests can help by alerting you to accounting-software compatibility problems between the NAS and IAS. Selecting Log Authentication Requests can help by alerting you to problems with transaction volume and attempts to access unauthorized resources.
  • By default, the event log reserves 512 kilobytes for the event log file. If this is insufficient, you can change that setting by right-clicking IAS Log in the left pane of Event Viewer, clicking Properties, and entering a larger number in Maximum Log Size.
  • You must back up or delete the logs on a regular basis, regardless of the interval you specify in step 7.
  • The default transaction volume is 10 MB.
  • The default log-file location is the IAS directory.
  • If you are administering an IAS server other than your local machine, you will not be able to browse the directory structure to find a directory path. If you need to log accounting to a remote server, enter a Universal Naming Convention (UNC) name to specify the log file location (for example, \\MyLogServer\LogShare).


Create Network Access Policies and Profiles

To edit network access policies

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Double-click the name of your computer.
    The Clients, Logging, and Network Access Policies folders appear.
  5. Right-click the Network Access Policies folder, and then click New.
  6. On the Define Condition tab, click Name of Condition, type the name of the condition you want to specify, and then click Add.
  7. Select the attribute you want to add, and click OK.
  8. In the dialog box that appears, configure the attribute, and then click OK.
    If necessary, repeat this step for each attribute you want to specify.
  9. On the On Condition Match tab, enter the settings you want.
    • To grant dial-in access to the users who match the conditions you specified, click Grant dial-in permission.
    • To configure for users who have individual profiles in the Active Directory Service, click Do not override network parameters in the Profile with those specified on a user basis.
    • To edit the profile for the users who match the conditions you specified, click Edit Profile, and then configure the profile settings.

Notes

  • If you select the attribute name Vendor-Specific, see your NAS documentation for the values required in the Vendor ID and Vendor type boxes.
  • You can select the attribute name only. The attribute value is assigned on the basis of the name.
  • A sample profile is provided to illustrate common networking configurations.


To start IAS

To start or stop IAS from Microsoft Management Console

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Right-click the name of your computer and then click Start.
    Or, to stop the service, click Stop.


Administer IAS

Administering IAS

Administering Internet Authentication Services (IAS) includes day-to-day tasks and the less frequent monitoring and maintenance work. This section discusses the following:


Backing Up the IAS Database

This is preliminary documentation; some content may not be available at this time.

To back up the IAS database

  • After you have installed and configured IAS, back up the IAS database file _Adminui.mdb before you run IAS for the first time. The _Adminui.mdb file is stored in the IAS folder.

Important

  • It is essential that you back up the IAS database at regular intervals. If you do not back up the database and then you inadvertently delete one file in the IAS folder or your system experiences a system-wide corruption, you can lose all of your configuration data.


Monitoring Internet Authentication Services

To monitor IAS with Microsoft Management Console

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Authentication Services.
    The Choose Target Machine dialog box appears.
  2. Select the computer you want to administer.
    If you are setting up IAS for the first time, click Local Computer.
  3. In the tree console, click the plus sign to expand Console Root.
  4. Click your computer name.
    RADIUS appears in the right pane under Description, and either Running or Stopped appears under State.


Checking Connections with the PING Utility

Checking Connections with the Ping command

Use the ping command between RADIUS components—such as your client and your RADIUS servers—to determine if there are network problems between different components of the system. For example, if you are successfully able to ping the hostname of a RADIUS server from your IAS server, you have verified basic network functionality between the two servers. If the ping attempt fails, try again, but instead try to ping the IP address of the server in question.

If the ping command is successful, ping returns the IP address of of the remote server, number of bytes read, time to read packet, and time to live packet. If the ping command fails to connect to the server, it returns an error result. This usually indicates a network or DNS problem between the computer running ping and the computer it is addressing.

See your Windows NT documentation for information about arguments to the ping command.


Microsoft Applications You Can Use with Internet Authentication Services

You can obtain useful information by charting the performance of IAS at specified intervals. There are several Microsoft applications you can use with IAS to capture statistics. After analyzing these statistics, you can reevaluate your bandwidth and hardware configuration, determine the cause of malformed and invalid packets, and alert yourself to potential disruptions in network security. This section discusses the following:

  • Windows NT Performance Monitor counters
  • Windows NT Event Viewer
  • The Network Monitor component of Microsoft Systems Management Server

Performance Monitor Counters

Use Performance Monitor (in Windows NT Administrative Tools) to monitor resource use of specific components and program processes. With Performance Monitor, you can use charts and reports to see how efficiently your server uses IAS, and to identify and troubleshoot possible problems and bottlenecks.

The following table lists Performance Monitor counters IAS uses when you select the RADIUS Server object.

Counter | Reveals
AccessAccepts | The total number of RADIUS Access-Request messages sent since server startup.
AccessChallenges | The total number of RADIUS Access-Challenge messages sent since server startup.
Accounting Req/Sec | Accounting requests received per second.
Accounting Requests | The total number of RADIUS Accounting-Request messages received since server startup.
Accounting Responses | The total number of RADIUS Accounting-Response messages sent since server startup.
AccountingBadAuthenticators | The total number of RADIUS Accounting-Request messages that contained invalid authenticators received since server startup.
AccountingNoRecords | The total number of RADIUS Accounting-Request messages that were received but not recorded since server startup.
Authentication Req/Sec | Authentication requests received per second.
Authentication Requests | The total number of RADIUS Access-Request messages received since server startup.
Invalid Client Addresses | The total number of RADIUS Access-Request messages received from unknown addresses since server startup.
Invalid Passwords | The total number of RADIUS Access-Request messages containing invalid user passwords received since server startup.
Malformed Access Requests | The total number of malformed RADIUS Access-Request messages received since server startup.
Start Accounting Records | The total number of RADIUS Accounting-Request messages containing Acct-Status-Type attributes with the value Start (1) received since server startup.
Stop Accounting Records | The total number of RADIUS Accounting-Request messages containing Acct-Status-Type attributes with the value Stop (2) received since server startup.

Event Viewer

Use Event Viewer (in Windows NT Administrative Tools) to service events, including informational, warning, and error events. For examples of Event Viewer messages and their resolutions, see “Troubleshooting Internet Authentication Services.”

Network Monitor Component of Systems Management Server

You can use a commercial packet analyzer, or “sniffer” such as the Network Monitor component of Microsoft Systems Management Server (SMS), to view authentication packets and accounting packets as they arrive at the IAS server. With the SMS Network Monitor, you can detect dropped packets, monitor lack of response from authentication providers, and observe how the NAS interacts with the IAS server.


To register clients of this server

To register clients of this server

  1. Click Client Name, and then type a descriptive name.
  2. Click Client Protocol, and then select the appropriate protocol.
  3. Click Configure Client.
  4. In the Settings dialog box, click Friendly name for client, and then type a descriptive name for the client.
  5. Click Address (IP or DNS), and then enter the appropriate value.
    To verify the address, click Verify.
  6. In Password (shared secret), enter the shared secret for the client.

Note

  • Passwords (shared secrets) are case-sensitive. Be sure that the client’s shared secret and the shared secret you enter in this field are identical to each other and conform with the password rules listed in “Deploying Internet Authentication Services.”


To connect to a machine

This content is not available for this preliminary release.

To connect to a machine


To configuring clients of this server

To configure a new client of this server

  1. Click Friendly name for client, and then type a descriptive name for the client.
  2. Click Address (IP or DNS), and then enter the appropriate value.
    To verify the address, click Verify.
  3. In Password (shared secret), enter the shared secret for the client.

Note

  • Passwords (shared secrets) are case-sensitive. Be sure that the client’s shared secret and the shared secret you enter in this field are identical to each other and conform with the password rules listed in “Deploying Internet Authentication Services.”


To set logging properties

To set logging properties

  • On the Settings tab, click Enable Logging, and then select one or more check boxes to capture packet traffic processed by IAS:
    • To capture accounting requests, approvals, and denials, select the Log accounting requests check box.
    • To capture authentication requests, access approvals, and access denials, select the Log authentication requests check box.
    • To capture periodic status updates, such as interim accounting packets, select the Log periodic status check box.


Setting Logging Properties

To set logging properties

  1. On the Local File tab, select the Automatically open new log check box, and then click the interval you want.
    • To handle heavy transaction volume and logging activity, select Daily.
      Or, if your server experiences very little activity, select Weekly or Monthly.
    • If you are unsure of the transaction volume, enter a log size at which a new log should be opened.
  2. In Log file directory, enter a location to store the log file.


To set logging properties

This content is not available in this preliminary release.

Specify the settings you want, and then click OK.

Note
  • The information collected in the Event Viewer is valuable for evaluating server performance and for troubleshooting. Selecting Log accounting requests can help by alerting you to accounting-software compatibility problems between the NAS and IAS. Selecting Log Authentication Requests can help by alerting you to problems with transaction volume and attempts to access unauthorized resources.


Configuring the IAS server

This is preliminary documentation and is subject to change; some content may not be available for this preliminary release.

To set IAS port properties

  • On the RADIUS tab, in Authentication and Accounting, type your port settings.


Resolving DNS names

To resolve DNS names

  1. Click DNS name, and then type the name of the DNS server you want to resolve.
  2. Click Resolve.
    If IAS is able to resolve the DNS name, the search results appear in Search Results.


Choosing a server to monitor

To choose a server to monitor

  • In Choose Target Machine dialog box, select the computer you want to administer.
    • If you are setting up IAS for the first time, click Local Computer.
    • If you want to manage IAS properties on a different computer on your network, click Another Computer, and then type the name of that computer.


Support Online from Microsoft Technical Support

Get the latest answers to technical questions via the Internet

If you have a technical question and can't find your answer in the Windows NT Help file, go to Support Online. Just select your product, type in your question and the site does the rest of the work for you. From technical articles in the Microsoft Knowledge Base, to Troubleshooting Wizards and downloadable files, Support Online gathers the specific resources most likely to help you find the answer to your question.

To begin your search, go to .