<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Yes, but you need to allow zone transfers to your non-IPA servers:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">$ ipa dnszone-mod --allow-transfer="1.2.3.4" domain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">(where 1.2.3.4 is the IP of your new slave and domain.com is the zone name you want to transfer)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Josh<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com]
<b>On Behalf Of </b>Christopher Young<br>
<b>Sent:</b> Monday, April 06, 2015 7:02 PM<br>
<b>To:</b> Rob Crittenden<br>
<b>Cc:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] Slave DNS on FreeIPA replica<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I clearly missed that. Thanks for the clarification. As far as adding additional DNS servers merely to slave the zones, is that more or less the same as configuring any other bind slave?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Apr 6, 2015 at 3:15 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Christopher Young wrote:<br>
> I have - what I believe to be - a couple of basic questions (I apologize<br>
> in advance if these are answered elsewhere, though I've tried to do some<br>
> searching ahead of time.):<br>
><br>
> I recently added an IPA replica to an existing IPA server and noticed<br>
> that everything appeared to succeed in the setup. One observation is<br>
> that DNS (bind) was not set up on this new host. I was wondering if<br>
> this is normal behavior, and if so, is there a set of instructions<br>
> needed to add/create additional DNS servers for use with FreeIPA?<br>
><br>
> Ideally, I would like to have DNS running on all IPA hosts.<br>
> Additionally, I plan on adding a pair of caching/slave DNS servers<br>
> running standing BIND on remote networks and was wondering what the<br>
> procedure would be to slave those zones onto those. Would that be the<br>
> same as allowing the transfer from those IPs and treating them just like<br>
> any other BIND slave for the appropriate zones?<br>
><br>
> I appreciate the clarifications and all the effort that goes into this!<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">DNS and a CA are optional components in a replica. You can add them<br>
using ipa-dns-install and ipa-ca-install respectively.<br>
<br>
To install bind during the replica install process add the option<br>
--setup-dns.<br>
<span style="color:#888888"><br>
<span class="hoenzb">rob</span></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>