On Sat, Jan 26, 2019 at 11:21 AM François Cami <fcami(a)redhat.com> wrote:
Hi,
On Fri, Jan 25, 2019 at 2:06 PM lejeczek via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> hi gents,
>
> I wonder if IPA when setup up on an "isolated" network segment, having
> one single point of communicating with outside, which specifically means
> Win AD, would established a trust and work okey later.
>
> A briefly sketched example...
>
> 1st IPA master 2nd & 3rd all on 10.10.10.0/24, with pacemaker/HA
> floating one IP between IPAs masters on 192.168.2.0, which is where
> whole Win AD is(and the rest of intranet).
>
> DNS is where the devil is, details. Can it be done?
Please read:
https://www.redhat.com/archives/freeipa-users/2015-March/msg00983.html
and:
https://www.redhat.com/archives/freeipa-users/2015-March/msg00989.html
You could try putting two replica on the 192.168.2.0 network and
configure them to handle the trust.
Or, rather, please tell us what you are trying to achieve and we might
be able to propose a way.
> > I read that zone views are discouraged and I do not think IPA's DNS
> > support those anyway.
> >
> > Can DNS be "completed" without harming IPA in a way that incoming
trust
> > from AD can be achieved in above scenario?
> >
> > many thanks, L.
> >
> >
> >
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...