Thanks for prompt response. I was wrong in mentioning that krb is not running on UDP port it is running.<div><br></div><div>Now this time, I did not specify --skip-conncheck and ended up with same error. I could see ldap requests are reaching to the Primary IPA server from secondary (both from tshark and directory server logs).</div> <div><br></div><div>#ipa-replica-install --setup-ca /var/lib/ipa/replica-info-ipa02.ma.net.gpg</div><div><br></div><div>(I tried with/without --setup-ca got same result)</div><div><br></div><div>I have pasted the directory server (Primary ipa01 machine) logs in the blow paste bin </div> <div><br></div><div><a href="http://pastebin.com/HxAwMiDw">http://pastebin.com/HxAwMiDw</a></div><div><br></div><div>And replication logs (on the replica ipa02 machine)</div><div><br></div><div><a href="http://pastebin.com/QNNRVw2k">http://pastebin.com/QNNRVw2k</a>.</div> <div><br></div><div>I am not using IPA server for DNS, I have separate DNS server and both host names are getting resolved. </div><div><br></div><div>Connection with ldap search command. </div><div><br></div><div>It appears the it is not able to connect at secure port (this could be the reason)</div> <div><br></div><div><div>#ldapsearch -x -D "cn=Directory Manager" -W -H ldaps://<a href="http://ipa01.ma.net">ipa01.ma.net</a></div><div>Enter LDAP Password: </div><div>ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)</div> </div><div><br></div><div>----------------------------- </div><div>Works perfect on non Secure port</div><div><br></div><div><div># ldapsearch -x -D "cn=Directory Manager" -W -H ldap://<a href="http://ipa01.ma.net">ipa01.ma.net</a></div> <div>Enter LDAP Password: </div><div># extended LDIF</div><div>#</div><div># LDAPv3</div><div># base <> (default) with scope subtree</div><div># filter: (objectclass=*)</div><div># requesting: ALL</div><div>#</div><div> <br></div><div># search result</div><div>search: 2</div><div>result: 32 No such object</div><div><br></div><div># numResponses: 1</div></div><div><br></div><div>-----------------</div><div><br></div><div>I was under impression that ipa-replica-install does the SSL stuff, may be I am wrong.</div> <div><br></div><div>Thanks</div><div>Chandan</div><div><br>On Monday, April 1, 2013, Rob Crittenden wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Chandan Kumar wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hello,<br> <br> I am new to FreeIPA so far I have setup the Server and few test clients,<br> all went really smooth. However, I am having hard time in setting up the<br> replication and any help will great!.<br> <br> I am using CentOS 6.4. Package Info<br> <br> ipa-server-3.0.0-26.el6_4.2.<u></u>x86_64<br> 389-ds-base-1.2.11.15-12.el6_<u></u>4.x86_64<br> <br> I followed the steps mentioned in<br> <br> <a href="http://freeipa.org/docs/1.2/Installation_Deployment_Guide/en-US/html/chap-Installation_and_Deployment_Guide-Setting_up_Multi_Master_Replication.html" target="_blank">http://freeipa.org/docs/1.2/<u></u>Installation_Deployment_Guide/<u></u>en-US/html/chap-Installation_<u></u>and_Deployment_Guide-Setting_<u></u>up_Multi_Master_Replication.<u></u>html</a><br> </blockquote> <br> FYI, these are very out-of-date.<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> When I try to setup the replica with the replica prepare file from the<br> master with --skip-conneccheck (because krb is not running on UDP ports)<br> </blockquote> <br> I don't understand, you got an error about KRB not running on the UDP ports?<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> ipa-replica-install /var/lib/ipa/replica-info-<u></u>ipa02.ma.net.gpg<br> --skip-conncheck.<br> <br> At the end I get below error<br> <br> ------------------------------<u></u>-----------<br> [22/31]: setting up initial replication<br> Starting replication, please wait until this has completed.<br> [<a href="http://ipa01.ma.net" target="_blank">ipa01.ma.net</a> <<a href="http://ipa01.ma.net" target="_blank">http://ipa01.ma.net</a>>] reports: Update failed! Status: [-1<br> - LDAP error: Can't contact LDAP server]<br> </blockquote> <br> Well, something is blocking the connection, or the server on ipa01 isn't running. This is a really low-level networking error.<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> I also find similar error reported while setting up ipa on Fedora 18 at<br> <a href="https://www.redhat.com/archives/freeipa-users/2013-February/msg00440.html" target="_blank">https://www.redhat.com/<u></u>archives/freeipa-users/2013-<u></u>February/msg00440.html</a><br> <br> But could not find its resolution.<br> </blockquote> <br> We never heard back from the user. You're saying you see the same error?<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I am able to connect to the 389/636 port from the slave. Firewall is off<br> on both ends and hostnames resolves properly.<br> </blockquote> <br> On ipa02 you might try:<br> <br> $ ldapsearch -x -H ldap://<a href="http://ipa01.ma.net" target="_blank">ipa01.ma.net</a> -s base -b '' namingContexts<br> <br> You might also try wireshark to monitor the connection request.<br> <br> rob<br> </blockquote> </div><br><br>-- <br><br><div>--</div><div><a href="http://about.me/chandank" target="_blank">http://about.me/chandank</a><br></div><br>