I think when client ip address isn't 10.68.49.21,then should prompt the enter username and password.if the username and password isn't right,the last should deny access or display not authroised.