<div dir="ltr">Hello,<br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div><div dir="ltr">My existing FreeIPA 3.0 (CentOS 6) setup is as follows:<br></div><div dir="ltr"><br></div><div dir="ltr">Kerberos Realm: <a href="http://test.com">test.com</a></div><div dir="ltr">I have several DNS zones</div><div dir="ltr"><a href="http://test.com">test.com</a></div><div dir="ltr"><a href="http://dev.test.com">dev.test.com</a></div><div dir="ltr"><a href="http://stage.test.com">stage.test.com</a></div><div dir="ltr"><a href="http://qa.test.com">qa.test.com</a></div><div dir="ltr"><a href="http://prod.test.com">prod.test.com</a></div><div dir="ltr"><a href="http://mgmt.test.com">mgmt.test.com</a></div><div dir="ltr"><br></div><div dir="ltr"><a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a> - FreeIPA 3.0 Master</div><div dir="ltr"><a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a> - FreeIPA 3.0 Replica</div><div dir="ltr"><br></div><div dir="ltr">The FreeIPA servers actually reside in <a href="http://mgmt.test.com">mgmt.test.com</a>. <a href="http://test.com">test.com</a> in FreeIPA 3 has forwarding DNS servers configured.</div><div dir="ltr"><br></div><div dir="ltr">We are going to move to FreeIPA 4.2 (CentOS 7) and here is the path I have tested that appears to work.</div><div dir="ltr"><br></div><div dir="ltr">I followed this guide.</div><div dir="ltr"><br></div><div dir="ltr"><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html</a></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">1 Create an IPA 4 server (<a href="http://ipa03.mgmt.test.com">ipa03.mgmt.test.com</a>) that is a replica of the IPA 3 master server (<a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a>)</div><div dir="ltr">2 Remove replica agreement for <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a> on IPA 3 master (<a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a>)</div><div dir="ltr">3 Shutdown <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a> to prep for an IPA 4 server to take its place</div><div dir="ltr">4 Build a new server and install IPA 4 server that will become a new <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a></div><div dir="ltr">5 Make <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a> a replica of <a href="http://ipa03.mgmt.test.com">ipa03.mgmt.test.com</a></div><div dir="ltr">6 Make <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a> the master CRL server instead of <a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a></div><div dir="ltr">7 Shutdown <a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a> to prep for an IPA 4 server to take its place</div><div dir="ltr">8 Build a new server and install IPA 4 server that will become a new <a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a></div><div dir="ltr">9 Make <a href="http://ipa01.mgmt.test.com">ipa01.mgmt.test.com</a> a replica of <a href="http://ipa02.mgmt.test.com">ipa02.mgmt.test.com</a></div><div dir="ltr"><br></div><div dir="ltr">The reason for removing old servers to take the place of new servers is so that I can reuse the IP addresses and do not need to change DNS entries on any client</div><div dir="ltr"><br></div><div dir="ltr">The problem occurs when I realize that the <a href="http://test.com">test.com</a> zone needs to be a forwarded zone in IPA 4 but in IPA 3 is it a normal DNS zone and I need to have <a href="http://test.com">test.com</a> be a forwarded zone. In IPA 3 there is no entry for <a href="http://ipa-ca.test.com">ipa-ca.test.com</a> but I do see it in IPA 4. In my testing I have removed the <a href="http://test.com">test.com</a> zone and made it a forwarding zone but that removes the entry for <a href="http://ipa-ca.test.com">ipa-ca.test.com</a> as well as all the <a href="http://test.com">test.com</a> kerberos entries.</div><div dir="ltr"><br></div><div dir="ltr">What I do not know is what did I break when I removed <a href="http://test.com">test.com</a> since it is the Kerberos realm. It appears that replication between the servers still works and I was able to add a IPA 4 client server without issue. We plan on using certs generated from IPA 4 for OpenVPN but I do not have enough information to know if the removal of the <a href="http://test.com">test.com</a> zone will break that certificate validation and revocation since the <a href="http://ipa-ca.test.com">ipa-ca.test.com</a> DNS entry no longer exists.</div><div dir="ltr"><br></div><div dir="ltr">I believe where I went wrong was that I should have setup <a href="http://mgmt.test.com">mgmt.test.com</a> as the Kerberos realm rather than <a href="http://test.com">test.com</a> and I would not have the questions I do now.</div><div dir="ltr"><br></div><div>Thank you for your help.</div></div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"><br></div><div dir="ltr" style="font-size:12.8px"><b><font size="2">Mike Plemmons | Senior DevOps Engineer</font></b><div>614-741-5475</div><div><a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a></div><div><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div>
</div>