Kerberos package and Virtual IP

[Enrico Venturi]

Hello colleagues,
we are using Kerberos in a MC/SG environment.
Several problems arisen:
* if we configure several packages on a node, we've several IP on the same lan card; it seems no possible to have more instances of Kerberos server, therefore just one package can ba supported by Kerberos
* if we configure Kerberos server on the physical IP address then the package virtual IP address isn't supported.
Does anyone know how to configure Kerneros in this environment?

thanks a lot
Enrico

[Tim D Fulford]

Usually when several IPs are on the same lan card they are within the same network. When a server replies to a message it will go out on the LOWEST lan interface available. This is generally lanX, hence your problems.

I THOUGHT Kerbros worked on the master/replica architecture. IF this is the case you really should not put it in service guard & utilise the master/replica functionality for the high availability.

One **FUDGE** & I've only seen it by accident on HP-UX 11.0 was that if you put IPs with different subnet masks as the floating IPs the return messages comes from the package (& not the base IP). e.g.

lan0 172.16.0.10, netmask 255.255.0.0
lan0:1 172.16.4.10 netmask 255.255.255.0
lan0:2 172.16.8.10 netmask 255.255.255.0

I've put lan0 on class B netmask (natrual)
lan0:1 on same "natrual" class, but subnetted to class C and lan0:2 similarly , but in different subnet from lan0:1. the above SHOULD??? allow packets from package to be returned from that IP???

Give it a whirl (on your testbed), good luck

Tim