----- On Sep 26, 2016, at 1:30 PM, Sumit Bose sb...@redhat.com wrote:

> About the DNS SRV records, did you add matching records for _udp as
> well? I'm not sure if the AD client will fallback to _tcp if they are
> missing or just stop?

Ok, finally got some time to debug this.

tcpdump'ing in the IPA server and logging in, and analyzing the traffic in 
wireshark I can see that some KRB5KDC_ERR_PREAUTH_REQUIRED traffic to both of 
the KDC's as expected, followed by some AS-REQ and AS-REP, finally followed by 
KRB5KRB_ERR-RESPONSE_TOO_BIG, source MAC is a Cisco router despite the server 
being HP, so somewhere in the network a Cisco router is breaking our Kerberos.

I'll start hunting a solution somewhere else but IPA......

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to