Implementing IAS

Internet Authentication Service (IAS) Overview

In most organizations that have multiple network access servers, the centralization of authentication and accounting of connections being established at a centralized server is the better approach than each network access server performing authentication and accounting services.

The Remote Authentication Dial-In User Service (RADIUS) protocol is the recognized protocol for providing a centralized authentication, accounting, authentication and authorization for remote network access. RADIUS is an Internet Engineering Task Force (IETF) standard. Essentially, the RADIUS protocol can be used to control access for dial-up networks, VPNs and for wireless networks. The Internet Authentication Service (IAS), included in Windows Server 2003, is an implementation of a RADIUS server and RADIUS proxy. IAS performs authentication, authorization, and accounting functions for remote users attempting to establish a connection through dial-up access or through a VPN. IAS can manage the complete login process of remote access connection attempts.

ISPs can also use the RADIUS protocol. Third-party ISPs can utilize IAS to authenticate dial-in users to the Active Directory database of the organization. Here, the user names and passwords credentials stored in Active Directory is used, and the ISP not providing the Active Directory directory service does not really matter.

IAS provides the following functions for dial-up connections, VPN connections, and wireless connections:

IAS can also be used for the following purposes:

In order to implement RADIUS, the following RADIUS components are needed:

IAS provides a number of benefits over using standard RRAS authentication. The advantages of using IAS are:

Windows Server 2003 IAS Features

IAS is available in the following editions of Windows Server 2003:

The new IAS features provided with a Windows Server 2003 implementation of IAS are summarized below:

Understanding IAS Authentication Methods

IAS support a number of authentication methods, with the default supported authentication methods being:

You can also add additional authentication methods which are not supported by the default implementation of IAS. After the user is authenticated, IAS next has to authorize the user to verify that the resources attempting to be accessed by the particular user can indeed be accessed by that user.

Understanding IAS Authorization Methods

IAS supports a number of authorization methods, including the following:

Designing a RADIUS (IAS) Strategy

A number of factors should be considered when you plan to implement a RADIUS solution:

The following connection points have to be secured to protect the resources on the private network from remote access users who have access to the private network.

The mechanisms that can be used to secure your RADIUS strategy are listed here:

Ensuring the availability of your RADIUS strategy is another important issue that should be included when you plan your RADIUS design. Having multiple RADIUS clients and multiple IAS servers configured as RADIUS servers assist in ensuring that you remote access users can establish connections.

If you are considering implementing two or more RADIUS servers, consider the following important factors:

When determining the placement of your RADIUS servers and RADIUS clients, consider the following points:

Installing IAS

How to install IAS

  1. Open Control Panel
  2. Double-click Add/Remove Programs, and then click Add/Remove Windows Components.
  3. The Windows Components Wizard starts.
  4. Click Networking Services, and then click Details.
  5. In the Networking Services dialog box, select the checkbox for Internet Authentication Service in the list.
  6. Click OK. Click Next. Click Finish.

Managing and Monitoring IAS

You can use the Internet Authentication Service management console to manage the configuration of your IAS implementation.

To access the Internet Authentication Service management console,

  1. Click Start, Administrative Tools, and then click Internet Authentication Service.

The left pane of the Internet Authentication Service management console contains the following nodes, or RADIUS components:

The IAS Software Development Kit (SDK) can be used for the following purposes:

You can use the Event Viewer tool and the System Monitor utility to monitor your IAS server performance. Event Viewer stores events that are logged in the system log, application log, and security log. The system log contains events that are associated with the operating system. The application log stores events that pertain to applications running on the computer. Events that are associated with auditing activities are logged in the security log.

The System Monitor utility is the main tool for monitoring system performance. System Monitor can track various processes on the Windows system in real time. System Monitor uses objects, counters and instances to monitor the system. An object is a collection of counters which are associated with a system resource or service. As the object executes a function, its associated counters are updated. A number of IAS objects are automatically added to System Monitor when IAS is installed. A counter represents data for a particular component of the system or service. Each object has a set of counters. An instance refers to the incident of multiple performance objects of the identical type on a computer. An object can have one or multiple instances. You can specify specific elements or components that should be tracked on the local computer and remote computers. You can determine resource usage by monitoring trends. System Monitor can be displayed in a graph, histogram, or report format.

You have to be a member of one of these groups to use System Monitor: Administrators group, Server Operators group, Performance Log Users group, or Performance Monitor Users group.

The objects most commonly used to monitor network activity are:

How to enable IAS authentication

  1. Click Start, Administrative Tools, and then click Routing And Remote Access to open the Routing And Remote Access management console.
  2. In the console tree, right-click the server that you want to configure and then select Properties from the shortcut menu.
  3. Switch to the Security tab.
  4. From the Authentication Provider drop down list, select the RADIUS Authentication option.
  5. Click Configure.
  6. Click Add to include a RADIUS server in the list.
  7. When the Add RADIUS Server dialog box opens, provide the name of the RADIUS server and click OK. Click OK again to close the Properties dialog box.
  8. Click OK to acknowledge that the RRAS service has to be restarted.
  9. In the Routing and Remote Access management console, right-click the server and select All Tasks, and then select Restart from the shortcut menu.

How to enable EAP authentication on the IAS server

  1. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service management console.
  2. In the left pane, select Remote Access Policies.
  3. In the right pane, click Connections to Microsoft Routing and Remote Access Server.
  4. From the Action menu, click Properties.
  5. Click Edit Profile to navigate to the Edit Dial-in Profile dialog box.
  6. Switch to the Authentication tab.
  7. This is where you can specify the order in which EAP types are negotiated, and enable/disable non-EAP authentication methods.
  8. Click the EAP Methods button to add, remove, or view existing EAP types.
  9. Click OK.

How to configure IAS on a domain controller

  1. Open Control panel.
  2. Double-click Add/Remove Programs, and then click Add/Remove Windows Components.
  3. The Windows Components Wizard starts.
  4. Click Networking Services, and then click Details.
  5. In the Networking Services dialog box, select the checkbox for Internet Authentication Service in the list.
  6. Click OK. Click Next. Click Finish.
  7. To register the IAS server in Active Directory so that IAS can access the user account dial-in properties information in your Active Directory domain, navigate to the Internet Authentication Service management console.
  8. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service management console.
  9. In the left pane, right-click Internet Authentication Service, and then click Register Server in Active Directory from the shortcut menu.
  10. Click OK to the message that appears, requiring verification that you want to authorize the computer.

How to create a new remote access policy

  1. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service management console.
  2. In the left pane, right-click the Remote Access Policies node and then select New Remote Access Policy from the shortcut menu.
  3. The New Remote Access Policy Wizard initiates
  4. Click Next on the New Remote Access Policy Wizard welcome screen.
  5. On the Policy Configuration Method page, click the Use the wizard to set up a typical policy for a common scenario option. Click Next.
  6. On the Access Method page, choose one the methods listed here:
    • VPN access
    • Dialup access
    • Wireless access
    • Ethernet
    Click Next.
  7. Configure how remote access should be granted. Click Next
  8. On the Authentication Methods page, select the authentication methods which the new remote access policy will use. Click Next.
  9. Select which level of encryption that should be used. Click Next.
  10. Click Finish.

How to configure IAS for wireless security

Wireless clients can authenticate to IAS through:

The process that occurs when a client attempts to connect to a wireless network that uses the 802.1X authentication is explained next:

  1. The client attempts to connect to the SSID of the wireless access point (WAP).
  2. The client has to authenticate to the WAP if shared network authentication is enabled. The network key is used to authenticate the client.
  3. The WAP sends an authentication challenge to the client.
  4. The WAP next creates a channel to enable the client to communicate directly with the RADIUS service.
  5. When the client initially interacts with the RADIUS server, it first needs to verify that the RADIUS server is in fact who it is. To verify the identity the RADIUS server, the client checks the public key certificate of the RADIUS server.
  6. Once the client has verified the identity the RADIUS server, the client has to use 802.1X authentication to authenticate to the RADIUS service.
  7. If the RADIUS service and the client are set up to use EAP-TLS authentication, public key certificates are used to authenticate the client to the RADIUS service.
  8. If the RADIUS service and the client are set up to use Protected EAP (PEAP) authentication, then a Transport Layer Security (TLS) session is established between the client and the RADIUS service. Once the Transport Layer Security (TLS) session is established, the client starts sending its security credentials to the RADIUS service.
  9. When the RADIUS service receives the credentials of the client, it verifies the received credentials to its directory.
  10. Access is granted to the client when the following occurs:
    • The RADIUS service is able to authenticate the credentials of the client through its authentication database.
    • The access policy allows the client to establish a connection.
  11. At this stage, the RADIUS service sends the dynamic shared secret to the WAP, and informs the WAP that access was granted for the client.
    12. 1
  12. The shared secret is used to encrypt and decrypt communication transmitted between the client and WAP.

The main configuration settings that you have to specify when you configure your wireless access points (WAPs), so that wireless clients can access the network are listed below:

The remote access policy that you configure for wireless users must include the information listed here:

How to configure IAS for the wireless access point

  1. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service console.
  2. In the console, right-click RADIUS Clients and then select New RADIUS Client from the shortcut menu.
  3. The New RADIUS Client Wizard starts.
  4. Add client information for the wireless access point and add the wireless clients as RADIUS Clients. Click Next.
  5. On the New RADIUS Client screen, select the RADIUS Standard option from the Client-Vendor drop-down list box.
  6. Specify the shared secret password.
  7. Click Finish.

How to configure a remote access policy for IAS clients

  1. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service console.
  2. In the console tree, expand Internet Authentication Service.
  3. Select Remote Access Policies.
  4. In the right pane, select and double-click the policy which you need to configure.
  5. Click the Edit Profile button.
  6. Click EAP Methods on the Authentication tab.
  7. Click Add in Select EAP providers, select Protected EAP (PEAP), and then click OK.
  8. Now, click Protected EAP (PEAP) in Select EAP providers, and then click the Edit button.
  9. The Protected EAP Properties dialog box opens.
  10. Using the Certificate Issued drop-down list box, select the certificate which the server will utilize for clients to identify it.
    11. 1
  11. Check the Enable Fast Reconnect checkbox.
    12. 1
  12. In the EAP Type box, select Secure password (EAP-MSCHAPv2)
    13. 1
  13. Click OK.

How to configure a RRAS server for RADIUS accounting

  1. Click Start, Administrative Tools, and then click Routing And Remote Access to open the Routing And Remote Access management console.
  2. In the console tree, right-click the server that you want to configure and then select Properties from the shortcut menu.
  3. Switch to the Security tab.
  4. From the Accounting Provider drop down list, select the RADIUS Accounting option.
  5. Click the Configure button.
  6. Provide the IP address of the IAS server, or alternatively, provide the host name of the IAS server.
  7. Ensure that RRAS and IAS have a common shared secret.
  8. Click OK.

How to configure IAS logging

You can configure IAS to log:

To configure IAS to track user connection attempts

  1. Click Start, Administrative Tools, and then click Internet Authentication Service to open the Internet Authentication Service management console.
  2. In the left pane of the console, click the Remote Access Logging node.
  3. In the right pane of the management console, right-click Local File and then select Properties from the shortcut menu.
  4. The Local File Properties dialog box opens.
  5. To enable IAS logging, select the following options:
    • Authentication Requests
    • Account Requests
    • Periodic Status
  6. Click OK.


Top 5 Free Networking Tools

Bookmark Implementing IAS

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.