<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">If your AD realm is ABCD.CA and you want your unix realm to be UNIX.ABCD.CA then your FQDN should be <a href="http://ipaserver.unix.abcd.ca">ipaserver.unix.abcd.ca</a><div><br></div><div>When you delegate the zone from AD, you should have at least two IPA servers running bind listed. </div><div><br></div><div>ipaserver1.unix.abcd.ad<br><div>ipaserver2.unix.abcd.ad</div><div><br></div><div>That way if one is down, you can still resolve names.</div><div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">---<br>Brian Cook<br>Solutions Architect, Red Hat, Inc.<br>407-212-7079</div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br></div></span></div></span><br class="Apple-interchange-newline"></span><br class="Apple-interchange-newline">
</div>
<br><div><div>On Mar 8, 2012, at 8:54 AM, Sylvain Angers wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Alright!<br><br>I am now requesting to our DNS team<br><br>please delegate dns zone "<a href="http://unix.abcd.ca/">unix.abcd.ca</a>" to ???<br>Question: is the ipa server fqdn, be <a href="http://ipaserver.unix.abcd.ca/">ipaserver.unix.abcd.ca</a> or <a href="http://ipaserver.abcd.ca/">ipaserver.abcd.ca</a>?<br>
<br>does it matter?<br><br>thanks<br><br><div class="gmail_quote">2012/3/8 Simo Sorce <span dir="ltr"><<a href="mailto:simo@redhat.com">simo@redhat.com</a>></span><br><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="im">On Thu, 2012-03-08 at 09:46 -0500, Sylvain Angers wrote:<br>
> Hi Again<br>
> Our current Linux/AIX servers fqdn should remain on <a href="http://abcd.ca/" target="_blank">abcd.ca</a> domain<br>
><br>
> I need an advice: Should the ipa server fqdn be <a href="http://ipa.abcd.ca/" target="_blank">ipa.abcd.ca</a> or<br>
> <a href="http://ipa.unix.abcd.ca/" target="_blank">ipa.unix.abcd.ca</a>?<br>
<br>
</div>You can have machines on a different DNS domain with FreeIPA.<br>
So you can use <a href="http://unix.abcd.ca/" target="_blank">unix.abcd.ca</a> for your IPA server and still install<br>
clients in <a href="http://abcd.ca/" target="_blank">abcd.ca</a>.<br>
<br>
I think the onlt thing you should take care of is to make sure a<br>
<a href="http://abcd.ca/" target="_blank">abcd.ca</a> -> <a href="http://UNIX.ABCD.CA/" target="_blank">UNIX.ABCD.CA</a> mapping in krb5.conf under the [domain_realm]<br>
section is available on all machines of the domain to avoid issues<br>
resolving the correct realm for clients in the other domain.<br>
<br>
On clients this should be autometed in the very last release but the ipa<br>
server needs to be configured after install.<br>
<div class="im"><br>
> and on the Linux/AIX server, should we add entry of both dns (ipa and<br>
> Microsoft AD) in resolv.conf?<br>
<br>
</div>No, that would not work. What you should do is ask your DNS admin to<br>
delegate you the <a href="http://unix.abcd.ca/" target="_blank">unix.abcd.ca</a> zone. Once that is done it doesn't matter<br>
which DNS you are querying they will know who to ask.<br>
If delegation is not possible you could still use named forwarders in<br>
both IPA and AD so that each DNS server still know where to forward<br>
requests for the specific domain. This again will allow you to use<br>
whatever DNS your network uses and have queries properly forwarded<br>
around.<br>
<div class="im"><br>
> domain <a href="http://unix.abcd.ca/" target="_blank">unix.abcd.ca</a><br>
> search <a href="http://unix.abcd.ca/" target="_blank">unix.abcd.ca</a> <a href="http://abcd.ca/" target="_blank">abcd.ca</a><br>
> nameserver ipa_adress<br>
> nameserver ad_adress<br>
><br>
</div>No, don't do this as a way to not configure the DNS servers, it won't<br>
work and will cause really confusing mis-behaviors if the DNS servers<br>
themselves do not know how to talk to each other.<br>
<br>
If delegation of zones or forwarding is properly set up though then this<br>
scheme would allow you to have a fallback when either infrastructure is<br>
temporarily unreachable.<br>
<div class="HOEnZb"><div class="h5">><br>
Simo.<br>
<br>
--<br>
Simo Sorce * Red Hat, Inc * New York<br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Sylvain Angers<br><br>
_______________________________________________<br>Freeipa-users mailing list<br><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>https://www.redhat.com/mailman/listinfo/freeipa-users</blockquote></div><br></div></div></body></html>