A server running Internet Authentication Service (IAS) can authenticate a connection request from a network access server ...

A server running Internet Authentication Service (IAS) can authenticate a connection request from a network access server (NAS) locally, or it can act as a RADIUS proxy by forwarding the request to a remote RADIUS server group.  For local authentication, the user account must be a member of the same domain as the IAS server or a trusted domain. To authenticate requests from users who are members of other domains, set up IAS to forward authentication requests to a remote RADIUS server group.  To create a remote RADIUS server group, in the console tree, right-click Remote RADIUS Server Groups, and then click New Remote RADIUS Server Group.  A connection request policy is used to determine whether a connection request is processed locally or remotely. To create a connection request policy, in the console tree, right-click Connection Request Policies, and then click New Connection Request Policy.