<div dir="ltr">Thanks for the reply. It makes a bit more sense now.<div><br></div><div>I'm running FreeIPA 3.0.0 on CentOS 6.7<br><div><br></div><div>I followed your advice and was able to use dynamic update once I removed the zone forwarder. However I've set the global config to "forward only", but I'm still getting local resolution when I use dig from a client server. I'd expect to see the external records instead.</div><div><br></div><div>I'm not seeing much in documentation how to troubleshoot this. </div><div><br></div><div>Also I realize we're falling into the realm of a different subject and can start a fresh email chain if needed.</div><div><br></div><div>Thanks again,</div><div><br></div><div>Josh</div><br><div class="gmail_quote"><div dir="ltr">On Wed, Feb 3, 2016 at 12:45 AM Martin Basti <<a href="mailto:mbasti@redhat.com" target="_blank">mbasti@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div>On 03.02.2016 01:47, Joshua Ruybal
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">
<div>Hi All,</div>
<div><br>
</div>
<div>I've run into a frustrating issue regarding DNS Dynamic
Updating.</div>
<div><br>
</div>
<div>In a nutshell: </div>
<div><br>
</div>
<div>If I enroll a new client when the forward policy on a dns
zone is set to "disabled" I don't have a problem enrolling
the client and updating the dns record. </div>
<div><br>
</div>
<div>However if the policy of the zone is set to "only" or
"first", nsupdate fails during the client install. Install
logs says nsupdate: Specified Zone '<a href="http://example.com" target="_blank">example.com</a>'
does not exist (NXDOMAIN).</div>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">I'm
seeing this in multiple zones, and all I need to change to fix
it is to change the forwarding policy. However it's
problematic as we start the rollout, since we will need to
rely on external dns until we have all servers enrolled.</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">Client
Install Log Snippet:</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">
<div> 2016-02-02T22:53:17Z DEBUG args=/usr/bin/nsupdate -g
/etc/ipa/.dns_update.txt</div>
<div> 2016-02-02T22:53:17Z DEBUG stdout=</div>
<div> 2016-02-02T22:53:17Z DEBUG stderr=specified zone '<a href="http://dev.example.net" target="_blank">dev.example.net</a>'
does not exist (NXDOMAIN)</div>
<div> specified zone '<a href="http://dev.example.net" target="_blank">dev.example.net</a>' does
not exist (NXDOMAIN)</div>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">Zone
Configuration:</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">
<div> [admin@ipa01 ~]$ ipa dnszone-show --all</div>
<div> Zone name: <a href="http://dev.example.net" target="_blank">dev.example.net</a></div>
<div> dn: idnsname=<a href="http://dev.example.net" target="_blank">dev.example.net</a>,cn=dns,dc=example,dc=com</div>
<div> Zone name: <a href="http://dev.example.net" target="_blank">dev.example.net</a></div>
<div> Authoritative nameserver: ipa01</div>
<div> Administrator e-mail address: <a href="http://hostmaster.dev.example.net" target="_blank">hostmaster.dev.example.net</a>.</div>
<div> SOA serial: 1454447236</div>
<div> SOA refresh: 3600</div>
<div> SOA retry: 900</div>
<div> SOA expire: 1209600</div>
<div> SOA minimum: 3600</div>
<div> BIND update policy: grant <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> krb5-self * A;
grant <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a>
krb5-self * AAAA; grant <a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> krb5-self *
SSHFP;</div>
<div> Active zone: TRUE</div>
<div> Dynamic update: TRUE</div>
<div> Allow query: any;</div>
<div> Allow transfer: none;</div>
<div> Zone forwarders: 8.8.8.8</div>
<div> Forward policy: only</div>
<div> nsrecord: ipa01, ipa02</div>
<div> objectclass: top, idnsrecord, idnszone</div>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">Any
ideas on how to remedy this? I'd like to avoid updating
records by hand if it can be avoided.</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal"><br>
</div>
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;line-height:normal">Thanks!</span><br>
<div>Josh</div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote></div><div text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
which version of freeIPA do you use?<br>
<br>
If version is older than 4.1, then specifying forward policy and
forwarders cause that zone work as forwardzone thus, you cannot add
host there, because all queries ale forwarded to specified
forwarders (8.8.8.8) which does not know zone <a href="http://dev.example.com" target="_blank">dev.example.com</a><br>
<br>
If version is 4.1+ then nsupdate should work and it can be bug.
However I'm curious why do you need forwarding in master zone, what
is the use case?<br>
<br>
More details about forwardzones in IPA:
<a href="http://www.freeipa.org/page/V4/Forward_zones" target="_blank">http://www.freeipa.org/page/V4/Forward_zones</a><br>
<br>
IMO you need specify global forwarder to your external DNS server,
instead of adding per zone forwarders.</div><div text="#000000" bgcolor="#FFFFFF"><br>
<br>
Martin<br>
</div></blockquote></div></div></div>