Setting up bordermanager vpn in the same tree

Question

Hi,
I want to install a bordermanager 3.9 slave vpn server in the same tree to
place it later to a remote office, so I did what was in Craig's book:
Configured an private ipaddress on the server, that contained the master
replica's and the server that contained the CA. (same subnet as the new
bordermanager)
I installed the new server succesfully in a separate ou. Also installed
bordermanager 3.9 on it. Made this ou a partition.
I assume I need to add a replica of this new OU (partition) to the new
server, and that it must be the master (for licensing issues)? and that I
also need to add r/w replica's to the new server of the partition for
SLPscopes and the root partition? My question is if I add the replica's, do
all my servers then have a communication problem, because they try to
contact this new server, but they can't? (only the master and ca server can
at this moment, because they are in the same subnet). Or is this not the
case?
Is this all and can then the server safely be shipped or are there some
important things to check before I ship the server?
master replica : nw65sp7, edir873
ca : nw65sp5, edir873
mastervpnserver : nw65sp7, bm385
new server : nw65sp7, edir882, bm391
Thanks,
Michael

Answer 1

You don't HAVE to have replicas on the BM servers other than one which
holds the server itself. That said, it can certainly help to have
other servers.
If your slave server cannot communicate with the other servers in the
tree, then your routing setup is incomplete. If you tried to add
another replica to the slave, my guess is that the add would not
complete, unless the master of the replica ring was the master VPN
server (and even then I'm not sure the replica would turn on).
But if you have the VPN up, and basic communications working, you
should be able to put the slave in the remote location and have
everything work. I'd look closely at why routing packets is not
working. It *should* work, unless you already have routing to that
remote subnet address set up.
Perhaps I'm not understanding what you've done there, and I'm thinking
this is more complex than it is. If you have a new subnet on the new
BM server, and an address from that subnet added as a second binding on
the BM master (old) server, then every server in the tree should be
able to communicate with the new server, as long as packets make it to
the old server. This may require some static routes on remote subnets
(be careful).
It is possible to completely emulate the remote site such that the BMgr
server is able to talk to the new server via a VPN connection. This
configuration gets a bit complicated to configure on the master BMgr
side, and usually has a limitation that other slave servers cannot talk
to the new slave in a fully-meshed VPN. But they will once the new
server is put in place at the remote location with the (non-emulated)
public IP address connected to the Internet.
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***