<div dir="ltr">HI<div><br></div><div>thanks for the replay.</div><div><br></div><div>iwas going through the replays and find that you suggested to check firewall and DNS</div><div><br></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# systemctl status firewalld</font></i></div><div><i><font color="#0000ff">firewalld.service - firewalld - dynamic firewall daemon</font></i></div><div><i><font color="#0000ff"> Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled)</font></i></div><div><i><font color="#0000ff"> Active: inactive (dead)</font></i></div></div><div><i><font color="#0000ff"><br></font></i></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# systemctl status iptables</font></i></div><div><i><font color="#0000ff">iptables.service - IPv4 firewall with iptables</font></i></div><div><i><font color="#0000ff"> Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled)</font></i></div><div><i><font color="#0000ff"> Active: inactive (dead)</font></i></div></div><div><i><font color="#0000ff"><br></font></i></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# sestatus</font></i></div><div><i><font color="#0000ff">SELinux status: disabled</font></i></div></div><div><br></div><div>From windows (AD) nslookup command like below:</div><div><br></div><div><br></div><div><div><i><font color="#0000ff">C:\Windows\system32>nslookup.exe</font></i></div><div><i><font color="#0000ff">Default Server: <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">Address: 172.16.104.231</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">> set type=srv</font></i></div><div><i><font color="#0000ff">> _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">Server: <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">Address: 172.16.104.231</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">_ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a> SRV service location:</font></i></div><div><i><font color="#0000ff"> priority = 0</font></i></div><div><i><font color="#0000ff"> weight = 100</font></i></div><div><i><font color="#0000ff"> port = 389</font></i></div><div><i><font color="#0000ff"> svr hostname = <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff"><a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a> internet address = 172.16.104.231</font></i></div><div><i><font color="#0000ff">> _ldap._tcp.solipa.local</font></i></div><div><i><font color="#0000ff">Server: <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">Address: 172.16.104.231</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">Non-authoritative answer:</font></i></div><div><i><font color="#0000ff">_ldap._tcp.solipa.local SRV service location:</font></i></div><div><i><font color="#0000ff"> priority = 0</font></i></div><div><i><font color="#0000ff"> weight = 100</font></i></div><div><i><font color="#0000ff"> port = 389</font></i></div><div><i><font color="#0000ff"> svr hostname = kwtpocpbis01.solipa.local</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">kwtpocpbis01.solipa.local internet address = 172.16.107.244</font></i></div></div><div><i><br></i></div><div>Thsi is from IPA server</div><div><br></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# dig SRV _ldap._tcp.solipa.local</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> SRV _ldap._tcp.solipa.local</font></i></div><div><i><font color="#0000ff">;; global options: +cmd</font></i></div><div><i><font color="#0000ff">;; Got answer:</font></i></div><div><i><font color="#0000ff">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65274</font></i></div><div><i><font color="#0000ff">;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; OPT PSEUDOSECTION:</font></i></div><div><i><font color="#0000ff">; EDNS: version: 0, flags:; udp: 4000</font></i></div><div><i><font color="#0000ff">;; QUESTION SECTION:</font></i></div><div><i><font color="#0000ff">;_ldap._tcp.solipa.local. IN SRV</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ANSWER SECTION:</font></i></div><div><i><font color="#0000ff">_ldap._tcp.solipa.local. 81125 IN SRV 0 100 389 kwtpocpbis01.solipa.local.</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ADDITIONAL SECTION:</font></i></div><div><i><font color="#0000ff">kwtpocpbis01.solipa.local. 1101 IN A 172.16.107.244</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; Query time: 0 msec</font></i></div><div><i><font color="#0000ff">;; SERVER: 172.16.104.231#53(172.16.104.231)</font></i></div><div><i><font color="#0000ff">;; WHEN: Tue Mar 03 13:28:35 AST 2015</font></i></div><div><i><font color="#0000ff">;; MSG SIZE rcvd: 113</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# dig SRV _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> SRV _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">;; global options: +cmd</font></i></div><div><i><font color="#0000ff">;; Got answer:</font></i></div><div><i><font color="#0000ff">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43860</font></i></div><div><i><font color="#0000ff">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; OPT PSEUDOSECTION:</font></i></div><div><i><font color="#0000ff">; EDNS: version: 0, flags:; udp: 4000</font></i></div><div><i><font color="#0000ff">;; QUESTION SECTION:</font></i></div><div><i><font color="#0000ff">;_ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a>. IN SRV</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ANSWER SECTION:</font></i></div><div><i><font color="#0000ff">_ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a>. 600 IN SRV 0 100 389 <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ADDITIONAL SECTION:</font></i></div><div><i><font color="#0000ff"><a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>. 3600 IN A 172.16.104.231</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; Query time: 0 msec</font></i></div><div><i><font color="#0000ff">;; SERVER: 172.16.104.231#53(172.16.104.231)</font></i></div><div><i><font color="#0000ff">;; WHEN: Tue Mar 03 13:28:43 AST 2015</font></i></div><div><i><font color="#0000ff">;; MSG SIZE rcvd: 115</font></i></div></div><div><br></div><div>and there is no replica server too</div><div><br></div><div>Regards,</div><div>Ben</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 2, 2015 at 11:27 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, 02 Mar 2015, Ben .T.George wrote:<br> </span><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi please find below output<br> <br> [root@kwttstfreipa01 ~]# kinit admin<br> Password for admin@SOLIPA.LOCAL:<br> <br> [root@kwttstfreipa01 ~]# id admin<br> uid=756800000(admin) gid=756800000(admins) groups=756800000(admins)<br> <br> <br> [root@kwttstfreipa01 ~]# KRB5_TRACE=/dev/stderr kvno -S cifs<br> <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a><br> [16898] 1425327238.662939: Convert service cifs (service with host as<br> instance) on host <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a> to principal<br> [16898] 1425327238.663650: Remote host after forward canonicalization:<br> <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a><br> [16898] 1425327238.663684: Remote host after reverse DNS processing:<br> <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a><br> [16898] 1425327238.663728: Get host realm for <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a><br> [16898] 1425327238.663742: Use local host <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a> to get<br> host realm<br> [16898] 1425327238.663749: Look up <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a> in the<br> domain_realm map<br> [16898] 1425327238.663757: Look up .<a href="http://kwttestdc.com" target="_blank">kwttestdc.com</a> in the domain_realm map<br> [16898] 1425327238.663764: Temporary realm is <a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a><br> [16898] 1425327238.663771: Got realm <a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a> for host<br> <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a><br> [16898] 1425327238.663792: Got service principal cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a><br> [16898] 1425327238.663818: Getting credentials admin@SOLIPA.LOCAL -> cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a> using ccache KEYRING:persistent:0:0<br> [16898] 1425327238.664257: Retrieving admin@SOLIPA.LOCAL -> cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a> from KEYRING:persistent:0:0 with<br> result: -<a href="tel:1765328243" value="+911765328243" target="_blank">1765328243</a>/Matching credential not found<br> [16898] 1425327238.664381: Retrieving admin@SOLIPA.LOCAL -><br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL from KEYRING:persistent:0:0 with result:<br> -<a href="tel:1765328243" value="+911765328243" target="_blank">1765328243</a>/Matching credential not found<br> [16898] 1425327238.664500: Retrieving admin@SOLIPA.LOCAL -><br> krbtgt/SOLIPA.LOCAL@SOLIPA.<u></u>LOCAL from KEYRING:persistent:0:0 with result:<br> 0/Success<br> [16898] 1425327238.664516: Starting with TGT for client realm:<br> admin@SOLIPA.LOCAL -> krbtgt/SOLIPA.LOCAL@SOLIPA.<u></u>LOCAL<br> [16898] 1425327238.664608: Retrieving admin@SOLIPA.LOCAL -><br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL from KEYRING:persistent:0:0 with result:<br> -<a href="tel:1765328243" value="+911765328243" target="_blank">1765328243</a>/Matching credential not found<br> [16898] 1425327238.664622: Requesting TGT krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL<br> using TGT krbtgt/SOLIPA.LOCAL@SOLIPA.<u></u>LOCAL<br> [16898] 1425327238.664690: Generated subkey for TGS request: aes256-cts/F74E<br> [16898] 1425327238.664818: etypes requested in TGS request: aes256-cts,<br> aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts<br> [16898] 1425327238.665062: Encoding request body and padata into FAST<br> request<br> [16898] 1425327238.665256: Sending request (1486 bytes) to SOLIPA.LOCAL<br> [16898] 1425327238.665597: Initiating TCP connection to stream<br> <a href="http://172.16.107.250:88" target="_blank">172.16.107.250:88</a><br> [16898] 1425327238.665802: Sending TCP request to stream <a href="http://172.16.107.250:88" target="_blank">172.16.107.250:88</a><br> [16898] 1425327238.673061: Received answer from stream <a href="http://172.16.107.250:88" target="_blank">172.16.107.250:88</a><br> [16898] 1425327238.673285: Response was from master KDC<br> [16898] 1425327238.673342: Decoding FAST response<br> [16898] 1425327238.673574: FAST reply key: aes256-cts/9134<br> [16898] 1425327238.673650: TGS reply is for admin@SOLIPA.LOCAL -><br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL with session key aes256-cts/4F6F<br> [16898] 1425327238.673691: TGS request result: 0/Success<br> [16898] 1425327238.673753: Removing admin@SOLIPA.LOCAL -><br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL from KEYRING:persistent:0:0<br> [16898] 1425327238.673768: Storing admin@SOLIPA.LOCAL -><br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL in KEYRING:persistent:0:0<br> [16898] 1425327238.673933: Received TGT for service realm:<br> krbtgt/KWTTESTDC.COM@SOLIPA.<u></u>LOCAL<br> [16898] 1425327238.673950: Requesting tickets for cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a>, referrals on<br> [16898] 1425327238.673998: Generated subkey for TGS request: aes256-cts/8623<br> [16898] 1425327238.674084: etypes requested in TGS request: aes256-cts,<br> aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts<br> [16898] 1425327238.674238: Encoding request body and padata into FAST<br> request<br> [16898] 1425327238.674395: Sending request (1531 bytes) to <a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a><br> [16898] 1425327238.676086: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a>.<br> [16898] 1425327238.678096: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a>.<br> [16898] 1425327238.678907: Initiating TCP connection to stream<br> <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.679404: Sending TCP request to stream <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.681292: Received answer from stream <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.682088: Response was not from master KDC<br> [16898] 1425327238.682142: TGS request result: -<a href="tel:1765328372" value="+911765328372" target="_blank">1765328372</a>/KDC policy<br> rejects request<br> [16898] 1425327238.682161: Requesting tickets for cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a>, referrals off<br> [16898] 1425327238.682212: Generated subkey for TGS request: aes256-cts/50DA<br> [16898] 1425327238.682283: etypes requested in TGS request: aes256-cts,<br> aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts<br> [16898] 1425327238.682391: Encoding request body and padata into FAST<br> request<br> [16898] 1425327238.682499: Sending request (1531 bytes) to <a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a><br> [16898] 1425327238.683871: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a>.<br> [16898] 1425327238.684756: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a>.<br> [16898] 1425327238.685461: Initiating TCP connection to stream<br> <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.685864: Sending TCP request to stream <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.687136: Received answer from stream <a href="http://172.16.104.231:88" target="_blank">172.16.104.231:88</a><br> [16898] 1425327238.687793: Response was not from master KDC<br> [16898] 1425327238.687832: TGS request result: -<a href="tel:1765328372" value="+911765328372" target="_blank">1765328372</a>/KDC policy<br> rejects request<br> kvno: KDC policy rejects request while getting credentials for cifs/<br> <a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM" target="_blank">kwttestdc001.kwttestdc.com@<u></u>KWTTESTDC.COM</a><br> </blockquote></div></div> Last line tells that trust is not working.<br> <br> Read discussion in this thread:<br> <a href="https://www.redhat.com/archives/freeipa-users/2015-February/msg00397.html" target="_blank">https://www.redhat.com/<u></u>archives/freeipa-users/2015-<u></u>February/msg00397.html</a><br> and follow recommendations there, it was just last week here.<span class="HOEnZb"><font color="#888888"><br> -- <br> / Alexander Bokovoy<br> </font></span></blockquote></div><br></div>