8:42 p.m.
Hey All,
Does FreeIPA fully support IPV6 or are there corner cases and
limitations that could make it a show stopper?
Just a general question. If folks here could elaborate on this topic a
bit, it would be appreciated.
--
Thx,
TK.
9:01 a.m.
On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
Hey All,
Does FreeIPA fully support IPV6 or are there corner cases and
limitations that could make it a show stopper?
Can you define 'fully support' IPV6? I say this from seeing various IT
groups still having to deal with major network hardware vendors saying
they 'fully support IPV6' but still needing weekly firmware updates
because of switch crashes due to IPv6 options. And the problem seems
to be that the IPV6 spec is complex and spread out over multiple
documents with parts implemented from draft documents that never got
out of committee. At times I doubt anything fully supports IPv6 so it
is better to come up with what you mean by what you need IPv6 support
to do and work from there.
Just a general question. If folks here could elaborate on this topic
a
bit, it would be appreciated.
--
Thx,
TK.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Stephen J Smoogen.
10:16 a.m.
On ke, 04 joulu 2019, Stephen John Smoogen via FreeIPA-users wrote:
On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> Hey All,
>
> Does FreeIPA fully support IPV6 or are there corner cases and
> limitations that could make it a show stopper?
>
Can you define 'fully support' IPV6? I say this from seeing various IT
groups still having to deal with major network hardware vendors saying
they 'fully support IPV6' but still needing weekly firmware updates
because of switch crashes due to IPv6 options. And the problem seems
to be that the IPV6 spec is complex and spread out over multiple
documents with parts implemented from draft documents that never got
out of committee. At times I doubt anything fully supports IPv6 so it
is better to come up with what you mean by what you need IPv6 support
to do and work from there.
Yep. On the other hand, FreeIPA does have few open IPv6-related problems
at the moment. It is known to work in the most IPv6 environments we have
seen so far but there are management issues in DNS handling, for
example.
https://pagure.io/freeipa/issue/5658
https://pagure.io/freeipa/issue/4674
Whether these issues prevent you to deploy FreeIPA in IPv6-only
environment is up to you.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
10:54 a.m.
Alexander Bokovoy via FreeIPA-users wrote:
On ke, 04 joulu 2019, Stephen John Smoogen via FreeIPA-users wrote:
> On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org> wrote:
>>
>> Hey All,
>>
>> Does FreeIPA fully support IPV6 or are there corner cases and
>> limitations that could make it a show stopper?
>>
>
> Can you define 'fully support' IPV6? I say this from seeing various IT
> groups still having to deal with major network hardware vendors saying
> they 'fully support IPV6' but still needing weekly firmware updates
> because of switch crashes due to IPv6 options. And the problem seems
> to be that the IPV6 spec is complex and spread out over multiple
> documents with parts implemented from draft documents that never got
> out of committee. At times I doubt anything fully supports IPv6 so it
> is better to come up with what you mean by what you need IPv6 support
> to do and work from there.
Yep. On the other hand, FreeIPA does have few open IPv6-related problems
at the moment. It is known to work in the most IPv6 environments we have
seen so far but there are management issues in DNS handling, for
example.
https://pagure.io/freeipa/issue/5658
https://pagure.io/freeipa/issue/4674
Whether these issues prevent you to deploy FreeIPA in IPv6-only
environment is up to you.
In IPV6-only there is also an issue with the CA because server.xml is
configured with localhost as the hostname in some port configuration. I
don't have a link handy. There are obvious workarounds so it isn't a
deal breaker.
rob
9:51 a.m.
On 12/4/2019 11:16 AM, Alexander Bokovoy via FreeIPA-users wrote:
On ke, 04 joulu 2019, Stephen John Smoogen via FreeIPA-users wrote:
> On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org> wrote:
>>
>> Hey All,
>>
>> Does FreeIPA fully support IPV6 or are there corner cases and
>> limitations that could make it a show stopper?
>>
>
> Can you define 'fully support' IPV6? I say this from seeing various IT
> groups still having to deal with major network hardware vendors saying
> they 'fully support IPV6' but still needing weekly firmware updates
> because of switch crashes due to IPv6 options. And the problem seems
> to be that the IPV6 spec is complex and spread out over multiple
> documents with parts implemented from draft documents that never got
> out of committee. At times I doubt anything fully supports IPv6 so it
> is better to come up with what you mean by what you need IPv6 support
> to do and work from there.
Yep. On the other hand, FreeIPA does have few open IPv6-related problems
at the moment. It is known to work in the most IPv6 environments we have
seen so far but there are management issues in DNS handling, for
example.
https://pagure.io/freeipa/issue/5658
https://pagure.io/freeipa/issue/4674
Whether these issues prevent you to deploy FreeIPA in IPv6-only
environment is up to you.
Thanks everyone. What I mean by 'fully supported' is just as the
subject says, the FreeIPA piece.
To clarify a bit further I'll break this down into two parts:
1) FreeIPA Core Project: Let's assume for the sake of this discussion
that the OS, Hardware and what not fully supports IPv6. So in other
words, anything outside the realm of what you control or code within the
FreeIPA project is out of scope of this question.
2) Integration: FreeIPA / SSSD will integrate with a host of
technologies including SSSD, 389 Directory Server etc. If any of those
components aren't ready and impact FreeIPA components, I would be
interested to know.
--
Thx,
TK.
9:57 a.m.
New subject: FreeIPA / SSSD and IPV6
On 12/6/2019 10:51 AM, TomK wrote:
On 12/4/2019 11:16 AM, Alexander Bokovoy via FreeIPA-users wrote:
> On ke, 04 joulu 2019, Stephen John Smoogen via FreeIPA-users wrote:
>> On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users
>> <freeipa-users(a)lists.fedorahosted.org> wrote:
>>>
>>> Hey All,
>>>
>>> Does FreeIPA fully support IPV6 or are there corner cases and
>>> limitations that could make it a show stopper?
>>>
>>
>> Can you define 'fully support' IPV6? I say this from seeing various IT
>> groups still having to deal with major network hardware vendors saying
>> they 'fully support IPV6' but still needing weekly firmware updates
>> because of switch crashes due to IPv6 options. And the problem seems
>> to be that the IPV6 spec is complex and spread out over multiple
>> documents with parts implemented from draft documents that never got
>> out of committee. At times I doubt anything fully supports IPv6 so it
>> is better to come up with what you mean by what you need IPv6 support
>> to do and work from there.
>
> Yep. On the other hand, FreeIPA does have few open IPv6-related problems
> at the moment. It is known to work in the most IPv6 environments we have
> seen so far but there are management issues in DNS handling, for
> example.
>
> https://pagure.io/freeipa/issue/5658
> https://pagure.io/freeipa/issue/4674
>
> Whether these issues prevent you to deploy FreeIPA in IPv6-only
> environment is up to you.
>
Thanks everyone. What I mean by 'fully supported' is just as the
subject says, the FreeIPA piece.
To clarify a bit further I'll break this down into two parts:
1) FreeIPA Core Project: Let's assume for the sake of this discussion
that the OS, Hardware and what not fully supports IPv6. So in other
words, anything outside the realm of what you control or code within the
FreeIPA project is out of scope of this question.
2) Integration: FreeIPA / SSSD will integrate with a host of
technologies including SSSD, 389 Directory Server etc. If any of those
components aren't ready and impact FreeIPA components, I would be
interested to know.
+ Subject change to include SSSD folks. Remembered just now meant to
ask the SSSD community as well. So therefore a third question as well:
3) SSSD Core Project: Same as question 1 above but for SSSD.
--
Thx,
TK.
2:53 p.m.
hi,
On Wed, Dec 4, 2019 at 3:43 AM TomK via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hey All,
Does FreeIPA fully support IPV6 or are there corner cases and
limitations that could make it a show stopper?
Just a general question. If folks here could elaborate on this topic a
bit, it would be appreciated.
we use ipv6 in a dual stack environment and so far (after one year and a
half) no problems found.
never tried a pure ipv6 environment yet, but I do not see why that would
cause any trouble. Overall the rhel tooling for ipv6 is very nice,
firewalld sets rules for both stacks, for instance.
Ah, yes, one thing, sssd prefers ipv4 instead of ipv6, so in sites with
just ipv6 this could cause a bit of a head scratcher, but it's easily
fixable:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
regards,
natxo
--
--
Groeten,
natxo
1596
days inactive
1598
days old
freeipa-users@lists.fedorahosted.org
6 comments
5 participants
participants (5)
-
Alexander Bokovoy -
Natxo Asenjo -
Rob Crittenden -
Stephen John Smoogen -
TomK