differentiating IPSEC EAP roadwarrior clients

RouterOS General
1

We have routeros configured as IPSEC VPN server with eap-radius authentification (using freeradius 3.0 on linux). Multiple roadwarrior clients are connecting from dynamic IPs with different usernames.

We need a way to differentiate those clients to apply specific firewall and routing policies to each specific user.

Is it possible to override / assign a specific IP to a client from the radius server ? instead of using an IP pool through mode-config address-pool ?

2

Should be possible!
I use this in a PPPoE scenario, it should also work in other places:

username          Cleartext-Password := "abcdefgh"
                  Framed-IP-Address = 1.2.3.4
3

Unfortunately it doesn’t seem to work.

Can someone from Mikrotik explain or provide a fix ?