Hello @advuni-af1
Yes, it's possible to assign fixed IP addresses to users in wired and wireless environments based on Active Directory attributes, similar to how it is done for SSL VPN access.
This could be achieved using the Framed-IP-Address attribute in the RADIUS Access-Accept message. When users authenticate via 802.1X, the RADIUS server (ISE in your setup) can retrieve the IP address from an AD attribute (e.g., msRADIUSFramedIPAddress) and include it in the Access-Accept response. The access device, such as a switch or WLC, can then enforce this IP assignment.
However, unlike SSL VPNs where the IP address is directly assigned to the VPN adapter, wired and wireless networks rely on DHCP for IP address allocation. To ensure the correct IP is assigned, there must be coordination between the access device, the RADIUS server, and the DHCP server. In your setup, since the DHCP server for WLAN runs on the IOS XE WLC, enabling the DHCP Proxy feature can facilitate this coordination. The DHCP Proxy function allows the WLC to relay DHCP requests to a central DHCP server while ensuring that the RADIUS-assigned Framed-IP-Address is honored.
Other way, you could use static DHCP reservatios on the DHCP server based on MAC addresses to assign fixed IPs to devices. While this method does not require RADIUS, it diverges from an identity-based networking model and lacks the flexibility of assigning IPs dynamically based on user identity. Configuring static IPs directly on client devices is another option but is not scalable or practical for large deployments....
Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
