The following lists the RADIUS attributes that are supported by the remote access server running Windows 2000 for the various RADIUS packet types. For more information about these attributes, see RFC 2138, "Remote Authentication Dial-in User Service (RADIUS)" and RFC 2548, "Microsoft Vendor-specific RADIUS Attributes."
A string value that contains the user principal name or the Windows NT name without the domain.
A string value that contains the user password and is only sent if Password Authentication Protocol (PAP) is negotiated as the authentication protocol.
Contains the response value provided by the Challenge Handshake Authentication Protocol (CHAP) in response to the challenge.
Contains the IP address of the remote access server.
Indicates the number of the port on the remote access server on which the incoming call was received.
The only value that is sent is "Framed" (2).
The only value that is sent is "PPP" (1).
Used in conjunction with EAP authentication to notify the RADIUS server of the maximum transmission unit (MTU) negotiated with the client, so that the RADIUS server does not send EAP messages that cannot be delivered over the link.
The remote access server never sends this attribute in the initial Access-Request. If EAP is used as the authentication protocol and a State attribute is received in an Access-Challenge packet, that State attribute is returned unmodified in the next Access-Request packet sent.
Telephone number on which the call was received. For virtual private network (VPN) connections, the IP address of the VPN server.
Telephone number on which the call was made. For virtual private network (VPN) connections, the IP address of the VPN client.
The fully qualified domain name of the remote access server.
The challenge sent by the remote access server during CHAP authentication.
The only values sent are Async (0), ISDN Sync (2), ISDN Async V.120 (3) ISDN Async V.110 (4), and Virtual (5). Virtual port is used to indicate VPN connections.
The only values sent are PPTP (1) and L2TP (3).
The only value sent is IP (1).
Contains whatever data TAPI returns about the call.
Always sent if EAP is used for authentication. Otherwise, it is configurable on the properties of the RADIUS server.
Only Framed (2) and Callback Framed (4) are accepted. If any other Service-Type is received, the call is dropped.
Only PPP (1) is accepted. If any other Framed-Protocol is received, the call is dropped.
The only acceptable values are 0xFFFFFFFF (user selects address) and 0xFFFFFFFE (remote access server selects address). If any other Framed-IP-Address is received, the call is dropped.
Not used.
The only recognized values are None (0) and VJ TCP/IP header compression (1). All other values are ignored.
Returned in CHAP, PAP, and
Returned to the remote access server unchanged.
Sent unchanged to accounting server in Accounting Start message.
Not used.
Only accepted if EAP is used for authentication.
The Access-Challenge is only used with EAP. Otherwise, the receipt of an Access-Challenge is treated as Access-Reject.
"On" is sent when the Routing and Remote Access service is started. "Off" is sent if the Routing and Remote Access service is gracefully stopped. "Start" and "Stop" are sent at the beginning and end of a user connection. "Interim-Update" is sent at approximately the interval specified in the Acct-Interim-Interval attribute (some random jitter is applied) and only if the Acct-Interim-Interval attribute was returned in the Access-Accept message.
Five seconds are added on every retransmission (regardless of the actual time between retransmissions).
The only values sent are 1 (User Request), 4 (Idle Timeout), 5 (Session Timeout), 6 (Admin Reset), and 8 (Port Error).