[Freeipa-users] Active Directory slave zone in FreeIPA DNS

[Sigbjorn Lie]

On 08/19/2012 04:39 PM, Franklin Catoni wrote:
> Greetings community.
>
> I do not speak English so I will do my best.
>
> I have two environments in my company, a domain "ejemplo.com 
> <http://ejemplo.com>" with Windows Active Directory running on Windows 
> Server 2003 Enterprise Edition SP2 and domain  "ejemplo.gob.ve 
> <http://ejemplo.gob.ve>" with FreeIPA v2.2. mounted on Centos 6.3 x64. 
>  This is because we are in the middle of a platform migration process 
> (a very slow process) from proprietary solutions to open source.
>
> DNS and DHCP service for my two environments is offered by the server 
> Centos 6.3 which is mounted FreeIPA directory, clients are Windows 
> computers Active Directory domain and linux computers in the domain Ipa.
>
> Currently the zone "ejemplo.gob.ve <http://ejemplo.gob.ve>" is 
> administered by the FreeIPA DNS using the plugin 
> (bind-dyndb-ldap.x86_64 v1.1.0) and I configure a slave zone using 
> bind (bind-9.8.2-0.10.rc1.el6_3.2 . x86_64) for the domain 
> "ejemplo.com <http://ejemplo.com>" Active Directory
>
> Name resolution works perfectly for both Linux and Windows clients.
>
> Now here comes the tricky part
>
> In order to find a more centralized management of my services, I try 
> to configure a slave zone to Active Directory through FreeIPA with 
> dyndb bind-plugin-ldap and so to eliminate configuration through bind, 
> but the transfers zone does not work, causing this many problems on 
> both platforms.
>
> The log shows me the following error:
>
> ServidorIPA named[3706]: zone ejemplo.com/IN/local 
> <http://ejemplo.com/IN/local>: zone serial (2012081801) unchanged. 
> zone may fail to transfer to slaves
>
> I've spent enough time looking at Super Google information that can 
> help me but it has not been easy, because it seems to be a rare situation.
>
> I ask. You can set this up under these circumstances?
> Someone has accomplished?
> Some information that horiente me to get a solution?
>
> Thanks for your time.
>
Hi,

Is the zone not transferring at all, or is it just the updates that's 
not transferred to the AD slave server?

If the zone is not transferring at all: Did yo modify the "Allow 
transfer" property of the zone ?

If the updates is not transferring: I believe automatic increment of the 
zone serial number will be supported in IPA 3.0. The IPA developers will 
have to confirm that. However you can manually change the serial number 
under Zone Settings.

Hope this helps.


Regards,
Siggi

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20120819/73825288/attachment.htm>