<div dir="ltr"><div>Thank you ! This is at last crystal clear for me ! </div>Thank you also for the VPN/tunneling suggestion, I'll look into it. <div> <div><div class="gmail_extra"> <div class="gmail_quote">On Mon, Oct 17, 2016 at 12:12 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On ma, 17 loka 2016, Karl Forner wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Mon, Oct 17, 2016 at 10:33 AM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On ma, 17 loka 2016, Karl Forner wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Thanks Alexander, unfortunately I could only find outdated documentation. I just realized that my question is not precise enough. </blockquote> The documentation I linked is the up-to-date one. </blockquote> Yes I know. I was explaining... <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> >From your answer, I understand that during the replica setup process, all I need (because I do not use RHEL) is a ssh port between the master and the replica. </blockquote> You did not read carefully what I quoted. SSH port is in addition to the ports required to be open for normal IPA master. </blockquote> I did read. I wrote "between the master and the replica". Each server has its own set of open ports in its own network, used by its clients. </blockquote> IPA replica is a client of IPA master, there isn't much difference, except where Kerberos tickets are obtained from as each master/replica host own KDC with exactly same keys, so they are able to 'short cut' it here. However, the rest stands. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> What I want to know is what ports are used by the replication process, i.e. what ports must I open on my firewall to enable the replication. </blockquote> Exactly the same ports as specified in the documentation. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Maybe all the ports are used for that purpose, but this is not, unless mistaken, clearly stated in the documentation. </blockquote> You are mistaken and the mistake most likely comes from your idea that somehow IPA master/replica are different from other IPA clients. They are not, they are IPA clients themselves. Replication exchange is built on LDAP protocol. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> In that case, this may be a security problem opening that many ports in the firewall. </blockquote> Nothing prevents you from organizing a proper VPN or other types of tunneling between the networks. -- / Alexander Bokovoy </blockquote></div> </div></div></div></div>