replication broken, can't contact local ldap server on one dc

Hi,

I use a samba domain (4.22.6-Debian-4.22.6+dfsg-0+deb13u1) with two dc's 
(srv-kb-dc1 and srv-kb-dc2) and have trouble with drs replication:

root@srv-kb-dc1:/usr/local/share/ca-certificates# samba-tool drs 
uptodateness
DOMAIN          maximum: 0  median: 0.0  failure: 0
CONFIGURATION   maximum: 0  median: 0.0  failure: 0
SCHEMA          maximum: 0  median: 0.0  failure: 0
DNSDOMAIN       maximum: 0  median: 0.0  failure: 0
DNSFOREST       maximum: 0  median: 0.0  failure: 0

samba-tool drs uptodateness
Failed to connect to ldap URL 'ldap://srv-kb-dc2.local' - LDAP client 
internal error: NT_STATUS_CONNECTION_REFUSED
Failed to connect to 'ldap://srv-kb-dc2.local' with backend 'ldap': LDAP 
client internal error: NT_STATUS_CONNECTION_REFUSED
[...]
missing dn 
CN=SRV-KB-DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=local 
from UTD vector list
DOMAIN          maximum: -231585  median: -231585.0  failure: 1
CONFIGURATION   maximum: -231585  median: -231585.0  failure: 1
SCHEMA          maximum: -231585  median: -231585.0  failure: 1
DNSDOMAIN       maximum: -231585  median: -231585.0  failure: 1
DNSFOREST       maximum: -231585  median: -231585.0  failure: 1

I can ldapsearch both host from srv-kb-dc1 and any other host but srv-kb-dc2

 From srv-kb-l02 ldapsearch fails with:

root@srv-kb-dc2:ldapsearch -H ldap://srv-kb-dc2.local  -b 
dc=domain,dc=local -D "cn=administrator,cn=users,dc=domain,dc=local=de"  
-W -Z
ldap_start_tls: Can't contact LDAP server (-1)

Thanks

Thorsten



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba