Radius EAP-TLS: How to force a local IP per device/certificate?

Question

I have configured my wifi network with a freeradius server using EAP-TLS with a different certificate per device.

I am currently using DHCP pool for each VLAN/subnet in my Cisco router/switch. I'd like to allocate an IP per device/certificate.

Since a certificate has less probability than a mac address to be spoofed, I wondered if it was possible to link the certificate with an IP address.

I'm currently defining reservation based on the mac address.

• Is it possible? How?
  • The users file isn't used with EAP-TLS, everything is done via client certificate creation using openssl.

Answer 1

IP addresses are assigned by a DHCP server. Simply add reservations based on MAC addresses to your DHCP server.