I would like to assign a static IP to each client based on its certificate (using eap-tls).

Currently, IP is assigned dynamically.


There are several options to assign static virtual IP addresses:

  • If the authentication is done via RADIUS, it's possible to assign virtual IPs and other attributes to the clients as well. For virtual IPs that's done via Framed-IP[v6]-Address RADIUS attributes.
  • The attr-sql plugin optionally maps identities to static address leases (configurable via ipsec pool utility).
  • The dhcp plugin may be used if charon.plugins.dhcp.identity_lease is enabled and static leases are configured on the corresponding DHCP server for the clients. The mapping can be done via client identity DHCP option (sent since 5.6.3) or via the virtual MAC addresses that's based on a hash of the client identity.
  • Configure individual connection entries with single IP address pools and static remote identities so they are matched against the identities of the clients. To do that with EAP authentication is currently not straight forward, though (see this answer).
| improve this answer | |
  • Newbie question... coudn’t I used something in the likes of RSA moonKey.pem. wiki.strongswan.org/projects/strongswan/wiki/Ipsecsecrets – sunknudsen May 16 '19 at 12:57
  • 1
    The secrets have nothing to do with the configuration attributes. And the values before the colon are identities, which could be IP addresses, but a virtual IP assigned by the server will never be used as identity. Plus, for private keys you usually don't configure any identities, as these are only relevant locally. – ecdsa May 17 '19 at 6:26
  • Is there a sample in the docs that I can follow to setup the DHCP plugin? – sunknudsen May 23 '19 at 18:53
  • The documentation of the dhcp plugin describes how it's configured. The configuration of the DHCP server depends on the actual product. The only examples are the test scenarios that use ISC's dhcpd e.g. swanctl/dhcp-dynamic, ikev2/static-client-id, or ikev2/dhcp-static-mac. – ecdsa May 24 '19 at 7:34

Most flexible way to do it is usage of RADIUS server. Detailed example of configuration you can find in the wiki of strongswan

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.