Alright! I am now requesting to our DNS team please delegate dns zone "<a href="http://unix.abcd.ca">unix.abcd.ca</a>" to ??? Question: is the ipa server fqdn, be <a href="http://ipaserver.unix.abcd.ca">ipaserver.unix.abcd.ca</a> or <a href="http://ipaserver.abcd.ca">ipaserver.abcd.ca</a>? does it matter? thanks <div class="gmail_quote">2012/3/8 Simo Sorce <<a href="mailto:simo@redhat.com">simo@redhat.com</a>> <blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div class="im">On Thu, 2012-03-08 at 09:46 -0500, Sylvain Angers wrote: > Hi Again > Our current Linux/AIX servers fqdn should remain on <a href="http://abcd.ca" target="_blank">abcd.ca</a> domain > > I need an advice: Should the ipa server fqdn be <a href="http://ipa.abcd.ca" target="_blank">ipa.abcd.ca</a> or > <a href="http://ipa.unix.abcd.ca" target="_blank">ipa.unix.abcd.ca</a>? </div>You can have machines on a different DNS domain with FreeIPA. So you can use <a href="http://unix.abcd.ca" target="_blank">unix.abcd.ca</a> for your IPA server and still install clients in <a href="http://abcd.ca" target="_blank">abcd.ca</a>. I think the onlt thing you should take care of is to make sure a <a href="http://abcd.ca" target="_blank">abcd.ca</a> -> <a href="http://UNIX.ABCD.CA" target="_blank">UNIX.ABCD.CA</a> mapping in krb5.conf under the [domain_realm] section is available on all machines of the domain to avoid issues resolving the correct realm for clients in the other domain. On clients this should be autometed in the very last release but the ipa server needs to be configured after install. <div class="im"> > and on the Linux/AIX server, should we add entry of both dns (ipa and > Microsoft AD) in resolv.conf? </div>No, that would not work. What you should do is ask your DNS admin to delegate you the <a href="http://unix.abcd.ca" target="_blank">unix.abcd.ca</a> zone. Once that is done it doesn't matter which DNS you are querying they will know who to ask. If delegation is not possible you could still use named forwarders in both IPA and AD so that each DNS server still know where to forward requests for the specific domain. This again will allow you to use whatever DNS your network uses and have queries properly forwarded around. <div class="im"> > domain <a href="http://unix.abcd.ca" target="_blank">unix.abcd.ca</a> > search <a href="http://unix.abcd.ca" target="_blank">unix.abcd.ca</a> <a href="http://abcd.ca" target="_blank">abcd.ca</a> > nameserver ipa_adress > nameserver ad_adress > </div>No, don't do this as a way to not configure the DNS servers, it won't work and will cause really confusing mis-behaviors if the DNS servers themselves do not know how to talk to each other. If delegation of zones or forwarding is properly set up though then this scheme would allow you to have a fallback when either infrastructure is temporarily unreachable. <div class="HOEnZb"><div class="h5">> Simo. -- Simo Sorce * Red Hat, Inc * New York </div></div></blockquote></div> -- Sylvain Angers