OD replica in DMZ?

[tyski]

I have two xserves running 10.6.6. The first is my OD master and sits on my private LAN behind my NAT firewall (FortiGate 60B). The second I want to host e-mail with in the firewall’s DMZ. This requires the second xserve to be an OD replica with only the OD master pushing updates to the replica (since the first xserve can see the second in the DMZ, but not vice versa).

Two questions:
1) Is this setup possible with 10.6?
2) Is it possible to configure this setup using the Server Admin GUI?

I’m pretty sure the answer to #2 is a ‘no’ in the nominal case. Any advice?

Thanks,
Tyrel

[tyski]

I read somewhere that LDAP replications can be initiated in any direction, so this push-only scenario should work. I don’t know about the kerberos replication stuff though. Either way, I’m guessing that Apple’s implementation will either not allow this or be ridiculously hard to configure. In the end, its easy to test and if it doesn’t work, I will just keep the necessary holes in the firewall open to allow bidirectional replication initiation.

[Author]

Posts