<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"> <p>It usually fails, hence I skip it.<br> </p> <p><br> </p> <p>Since I have no firewall either side and I know I have a simple network since I built there is nothing possible blocking in-between.</p> <p><br> </p> <p>I will double check the DNS zone file.</p> <p><br> </p> <p>I had to rename the server to ipam004 as the replica attempt sulked if i re-used an old hostname, ipam001.</p> <p><br> </p> <div id="Signature"> <div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <p>regards</p> <p>Steven </p> </div> </div> </div> </div> </div> <div style="color: rgb(33, 33, 33);"><br> <hr tabindex="-1" style="display:inline-block; width:98%"> <div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> freeipa-users-bounces@redhat.com <freeipa-users-bounces@redhat.com> on behalf of Dmitri Pal <dpal@redhat.com><br> <b>Sent:</b> Tuesday, 10 March 2015 1:22 p.m.<br> <b>To:</b> freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] Error in replication while inserting a RHEL7.1 server into a RHEL6.6 IPA setup.</font> <div> </div> </div> <div> <div class="moz-cite-prefix">On 03/09/2015 05:35 PM, Steven Jones wrote:<br> </div> <blockquote type="cite"> <div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif"> <p style="margin-top: 0px; margin-bottom: 0px;">Any idea what is going on here please?</p> <p style="margin-top: 0px; margin-bottom: 0px;"><br> </p> <p style="margin-top: 0px; margin-bottom: 0px;">==========</p> <pre class="pcmTextBlock browserNotIE ng-binding">[<a target="_blank" href="mailto:root@vuwunicoipam004">root@vuwunicoipam004</a> ipa-certs]# ipa-replica-install --setup-dns --forwarder=10.100.32.31 -U replica-info-vuwunicoipam004.ods.vuw.ac.nz.gpg --skip-conncheck</pre> </div> </blockquote> <br> <br> Why are you skipping a connection check?<br> The check will find issues like this ahead of time.<br> I suspect there is something wrong with either DNS entries for LDAP server records or LDAP or Kerberos port is not open between new replica and master.<br> At least I would try with connection check on and see if it gives some hints.<br> <br> <blockquote type="cite"> <div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif"> <pre class="pcmTextBlock browserNotIE ng-binding">Checking forwarders, please wait ... WARNING: DNS forwarder 10.100.32.31 does not return DNSSEC signatures in answers Please fix forwarder configuration to enable DNSSEC support. (For BIND 9 add directive "dnssec-enable yes;" to "options {}") WARNING: DNSSEC validation will be disabled Directory Manager (existing master) password: Adding [10.100.32.50 vuwunicoipam004.ods.vuw.ac.nz] to your /etc/hosts file Using reverse zone(s) 32.100.10.in-addr.arpa. Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv): Estimated time 1 minute [1/35]: creating directory server user [2/35]: creating directory server instance [3/35]: adding default schema [4/35]: enabling memberof plugin [5/35]: enabling winsync plugin [6/35]: configuring replication version plugin [7/35]: enabling IPA enrollment plugin [8/35]: enabling ldapi [9/35]: configuring uniqueness plugin [10/35]: configuring uuid plugin [11/35]: configuring modrdn plugin [12/35]: configuring DNS plugin [13/35]: enabling entryUSN plugin [14/35]: configuring lockout plugin [15/35]: creating indices [16/35]: enabling referential integrity plugin [17/35]: configuring ssl for ds instance [18/35]: configuring certmap.conf [19/35]: configure autobind for root [20/35]: configure new location for managed entries [21/35]: configure dirsrv ccache [22/35]: enable SASL mapping fallback [23/35]: restarting directory server [24/35]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 128 seconds elapsed [vuwunicoipam002.ods.vuw.ac.nz] reports: Update failed! Status: [10 Total update abortedLDAP error: Referral] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Failed to start replication [<a target="_blank" href="mailto:root@vuwunicoipam004">root@vuwunicoipam004</a> ipa-certs]# ======== </pre> <p style="margin-top: 0px; margin-bottom: 0px;">No firewalls are active and the network is a simple vyos virtual router.</p> <p style="margin-top: 0px; margin-bottom: 0px;"><br> </p> <p style="margin-top: 0px; margin-bottom: 0px;">=====</p> <pre class="pcmTextBlock browserNotIE ng-binding">[<a target="_blank" href="mailto:root@vuwunicoipam002">root@vuwunicoipam002</a> etc]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [<a target="_blank" href="mailto:root@vuwunicoipam002">root@vuwunicoipam002</a> etc]# ===== ===== <pre class="pcmTextBlock browserNotIE ng-binding">Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [<a target="_blank" href="mailto:root@vuwunicoipam004">root@vuwunicoipam004</a> ipa-certs]# ===== </pre> </pre> <p style="margin-top: 0px; margin-bottom: 0px;"><br> </p> <div id="Signature"> <div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <p style="margin-top: 0px; margin-bottom: 0px;">regards</p> <p class="MsoNormal" style="margin: 0px 0in; font-size: 11pt; font-family: "Calibri","sans-serif";"> Steven </p> </div> </div> </div> </div> </div> <div style="color:rgb(33,33,33)"> <div></div> </div> </div> <br> <fieldset class="mimeAttachmentHeader"></fieldset> <br> </blockquote> <br> <br> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.</pre> </div> </div> </div> </body> </html>