The optional LimitProxyState flag parameter causes the Client to require a Message-Authenticator attribute to be present when one or more Proxy-State attributes are received. Radius clients that are not proxies should never send Proxy-State attributes. Proxies should always include a Message-Authenticator with the messages they forward. Limiting Proxy-State to requests which also include Message-Authenticator allows the server to discard unexpected requests from non-proxy clients.

This flag parameter is not set by default. Consider this parameter only for clients that are not proxies and are not capable of sending Message-Authenticator. Consider RequireMessageAuthenticator for proxies and other clients that support Message-Authenticator.