Copyright: Thursday, October 07, 1999 10:40:30


Click to configure settings for the EAP type you selected, such as specifying the use of a smart card or certificate.


Click to permit or deny inbound traffic based on the destination address, destination mask, and protocol.


Click to permit or deny outbound traffic based on the source address, source mask, and protocol.


Click to add a new static route to the list of predefined routes.


Removes a static route from the list of predefined routes.


Click to modify the days and times that dial-in connections can be made.


Click to define the destination address, the network mask, and the metric (number of hops) for a static route.


Specifies whether to restrict dial-in access based on the type of media used. For example, if you only want to allow dial-in connections that use modems, select this check box, and then select the Async check box.


Specifies whether to configure predefined routes for one-way initiated demand-dial routed connections. By selecting this option and defining one or more static routes, the answering router adds the configured routes to its routing table when the demand-dial connection is made. For example, users on a small office LAN may need to communicate with users on a larger main office LAN. By properly defining the static route that corresponds to the small office LAN, the answering router properly delivers packets to the entire range of addresses that exist on the small office LAN. For more information on one-way initiated demand-dial connections, see One-way initiated demand-dial connections in Help.


Specifies whether this user is required to dial in from a particular number.


Specifies whether to restrict dial-in access to a single number.


Specifies whether to use the Extensible Authentication Protocol (EAP) for authentication. EAP provides support for a wide range of authentication methods, including token cards, one-time passwords, and public key authentication using smart cards.


Specifies whether to disconnect a dial-up connection after no activity occurs for a specific period of time.


Specifies whether to use encrypted authentication (CHAP). Encrypted authentication permits a connection by using any authentication that is requested by the server except unencrypted authentication (PAP, SPAP).

This option is useful if you are calling a non-Microsoft server and do not want to transmit plaintext passwords on the communication line.

Message Digest 5 (MD5) is an industry-standard hashing scheme. A hashing scheme is a method for transforming data (for example, a password) in such a way that the result is unique and cannot be changed back to its original form. CHAP uses a challenge-response with one-way MD5 hashing on the response. In this way, you can prove to the server that you know your password without actually sending the password over the network. By supporting CHAP, Windows 2000 PPP clients that use encrypted authentication can connect to almost all other PPP servers.


Specifies whether to use Microsoft encrypted authentication (MS-CHAP). MS-CHAP requires a challenge-response mechanism with encryption on the response.


Specifies whether to use a new version of the Microsoft encrypted authentication (MS-CHAP v2). This protocol provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 drops support for the MS-CHAP password change and does not transmit the encoded password.

For virtual private network (VPN) connections, Windows 2000 Server offers MS-CHAP v2 before offering the legacy MS-CHAP. Updated Windows clients accept MS-CHAP v2 when it is offered. Dial-up connections are not affected.


Specifies whether to allow remote PPP clients to connect without authentication. You may want to enable this feature for one or more of the following reasons:

PPP clients can dial in with no authentication. For example, as Guest.

Authentication is based on the number that the user is calling from. Known as ANI or CallerID, this type of authentication is used with cellular phones and by some Internet service providers (ISPs).


Specifies whether to use unencrypted authentication (PAP, SPAP). PAP is the most permissive authentication that you can use when you are not concerned about passwords. This option is sometimes needed if you are calling a non-Microsoft server. SPAP is Shiva's Password Authentication Protocol. Windows 2000 remote access supports SPAP to allow dial-in by Shiva clients.


Specifies whether the use of the Bandwidth Allocation Protocol (BAP) is required for additional multilinked connections.


Specifies whether dial-in connections for the members of a group dial-in profile are restricted to certain days and times.


Specifies whether to limit the length of a dial-in session.


Specifies whether to disregard group dial-in profile settings and assign a static TCP/IP address to this user.


Lists the EAP authentication types that you can use for authentication. For example, if you select Smart card or other certificate (TLS), then all users in this profile who authenticate by using EAP must do so by using a smart card or other type of certificate.


Lists the sec (seconds) or min (minutes) units of time for which Bandwidth Allocation Protocol (BAP) settings are displayed.


Provides a space for you to type the number to call back to.


Provides a space for you to type the number from which this user is required to dial in.


Provides a space for you to type the dial-in number.


Provides a space for you to type the destination network IP address, in dotted decimal notation. For more information, see TCP/IP and remote access in Help.


Provides a space for you to type the number of minutes after which an idle session is disconnected. You can also click the arrows to select a setting.


Provides a space for you to type the static TCP/IP address for this user.


Provides a space for you to type the network mask. Routing uses a combination of the network mask and IP address to determine the Network ID and Host ID portions of the destination address. The network mask is based on your address class or your local network subnet requirements. In the network mask, every bit that is set (a value of one) belongs to the Network ID and every bit that is off (a value of zero) belongs to the Host ID. Because of this distinction, a zero value in a network mask can only be followed by other zero values.

For example, a network mask (expressed in dotted decimal notation) of 255.255.0.0 is valid, but 255.0.255.0 is not.


Provides a space for you to type the maximum number of dial-in ports that Multilink can use. You can also click the arrows to select the number.


Provides a space for you to type the number of minutes after which a session is disconnected. You can also click the arrows to select the number of minutes.


Provides a space for you to type the cost metric to use for this static route. The cost metric typically is the number of hops to the destination network and is displayed in the Metric column of the IP routing table when the connection for this user account is made. If there is only one router between the calling router and the destination network, type 1. If there are multiple routers between the calling router and the destination network, and you want to reflect the cost of reaching the destination network by using this static route, include the number of hops. You can also click the arrows to select the number.


Provides a space for you to type the usage capacity at which you want extra lines to be released. You can also click the arrows to select the usage capacity. The time setting must also be met before the extra line is dropped. For example, if you want a line to be dropped when total line usage is 30 percent or less for at least 40 seconds, type 30 and 40 in the text boxes.

BAP policy only affects those client connections that are configured in Network and Dial-up Connections to Dial devices only as needed. It does not affect those client connections that are configured to Dial all devices or Dial only first available device.

BAP policy does not disconnect the last line in a client connection that is configured in Network and Dial-up Connections to Dial devices only as needed. To disconnect the last line, configure the Disconnect if idle for setting on the Dial-in Constraints tab.


Provides a space for you to type the time at which you want extra lines to be released. You can also click the arrows to select a setting. The usage capacity setting must also be met before the line is dropped. For example, if you want a line to be dropped when total line usage is 30 percent or less for at least 40  seconds, type 30 and 40 in the text boxes.

BAP policy only affects those client connections that are configured in Network and Dial-up Connections to Dial devices only as needed. It does not affect those connections that are configured to Dial all devices or Dial only first available device.

BAP policy does not disconnect the last line in a client connection that is configured in Network and Dial-up Connections to Dial devices only as needed. To disconnect the last line, configure the Disconnect if idle for setting on the Dial-in Constraints tab.


Specifies that IPSec or MPPE encryption is allowed for members of this group dial-in profile. For more information, see Microsoft Point-to-Point Encryption (MPPE)or Internet Protocol security (IPSec) in Help.


Specifies that data encryption is required for members of this group dial-in profile.


Specifies whether members of this group dial-in profile can use IPSec 56-bit DES or MPPE 56-bit data encryption.


Specifies whether members of this group dial-in profile can use IPSec Triple DES (3DES) or MPPE 128-bit data encryption.


Specifies whether members of this group dial-in profile can use IPSec 56-bit DES or MPPE 40-bit data encryption.


Specifies whether Microsoft 56-bit MPPE is required. This type of encryption is used internationally.


Specifies whether the Microsoft implementation of IPSec by using DES 56-bit encryption is required. This implementation of IPSec is used in North America.


Specifies whether members of this group dial-in profile can connect without using data encryption. If this is the only check box selected, then members of the profile cannot connect by using data encryption.


Click to add a RADIUS attribute to the list for this dial-in profile.


Click to modify the settings of the selected RADIUS attribute for this dial-in profile.


Removes the selected RADIUS attribute from the list for this dial-in profile.


Lists the RADIUS attributes that are associated with this dial-in profile. For more information, see Configure attributes for a profile in Help.


Lists the RADIUS attributes that you can add to this dial-in profile. Select an attribute in the list, and then click Add.

For more information about the RADIUS attributes, see your NAS documentation or RFC 2138, "Remote Authentication Dial-In User Service (RADIUS)."

For more information about adding attributes, see Configure attributes for a profile in Help.

For more information about the attributes supported by Windows 2000 Routing and Remote Access, see Remote access RADIUS attributes in Help.


Lists the media types that you can select to restrict dial-in access.


Lists the static routes that you can enable for this dial-in connection.


Specifies that dial-in or virtual private network (VPN) remote access is allowed for this user.


Specifies that dial-in or virtual private network (VPN) remote access is prohibited for this user.


Specifies that remote access permission for this user is controlled through a remote access policy. The remote access permission profiles defined by the remote access policy apply the same permissions to more than one user. In order to control remote access through a remote access policy, all domain controllers must run Windows 2000.


Specifies that a dial-in connection can use more than one line.


Specifies that the settings of the server determine the use of Multilink.


Specifies that a dial-in connection is limited to a single line.


Specifies that the dial-in client may request an IP address.


Specifies that the TCP/IP address assignment settings of the server are used. For example, the server may be configured to dynamically assign TCP/IP addresses as users connect.


Specifies that this user cannot use callback.


Specifies that this user must use callback.


Specifies that the server must supply an IP address.


Specifies that this user can set callback options.


Saves all the changes you have made without closing the dialog box.