"domain-change-failed" condition when creating a Control Class...

[rezaalikhani]

Hi all;

When creating a Control Class based on matching condition of "authorization-failure", there are a parameter name "domain-change-failed". Based on official documents, we must use condition if "Specifies that the domain change has failed."

As you can see, this official statement is totally unclear. Can anyone explain more regarding this parameter?

Thanks

[marce1000]

  - Possibly this refers to the domain name set (or changed) in the running configuration of an ISE node as in :
    ip domain-name newdomain.com

   M.

[Greg Gibbs]

This is IBNS 2.0 configuration on the switch and has nothing to do with ISE. My guess is that it's related to a failure to change between the VOICE and DATA domains on the switch for some reason but I've never seen it used.

If deploying ISE, I would highly suggest sticking to the validated IBNS 2.0 configuration documented in the ISE Secure Wired Access Prescriptive Deployment Guide. Tweaking settings outside that could result in unexpected behaviours.

If you really want to chase this down, you might try posting your question along with more details about the switching platform (hardware, software) to the Switching community space.