On ke, 13 huhti 2022, Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:
Hi,
I have a few cloud servers and would like to have FreeIPA as an IdM
for them, reusing what I have on a different location.
My current FreeIPA install sits on a LAN, so all IP's are private.
That will be a similar design on the cloud. So, for the replicas to
communicate with each other, I thought about creating some
port-forwarding rules/openings on both firewalls, but the catch is
that the replica creation command would point to the public address of
the destination.
Any problems I might encounter with a setup like this, or is this a
common practice?
Replication is bi-directional. It means all replicas should be able to
initiate and accept connections with other replicas they have direct
topological connection.
I'd recommend you to look into making a mesh networking between
replicas. This can be done on demand with IPSEC (LibreSWAN in RHEL, for
example) or Wireguard or OpenVPN and any other solution. LibreSWAN can
definitely benefit from certificates issued by IPA CA.
See
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
for some details.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland