EAP-TLS

Hi all

I am trying to get to the bottom of EAP-TLS, specifically step by step process explained here

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a008009256b.shtml#wp39068

Based on that, can somebody tell me at which point client gets an IP address if its DHCP based?

For me it should have an IP before TLS tunnel is established but at the same time initial dot1x conversation before port is authenticated wouldn't allow any non dot1x traffic?