This request is already fixed in upstream FreeIPA project. Please refer to the linked ticket for additional details and related commits.

Verified:

Version ::

Results ::

ipa-server-4.1.0-15.el7.x86_64

ON MASTER:

[root@rhel7-1 ~]# vi /etc/hosts
... I added replica info here so replica-prepare didn't ask for it.

[root@rhel7-1 ~]# ipa-replica-prepare -p Secret123 rhel7-2.testrelm.test
Preparing replica for rhel7-2.testrelm.test from rhel7-1.testrelm.test
Creating SSL certificate for the Directory Server
Creating SSL certificate for the dogtag Directory Server
Saving dogtag Directory Server port
Creating SSL certificate for the Web Server
Exporting RA certificate
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg
Waiting for rhel7-2.testrelm.test. A or AAAA record to be resolvable
This can be safely interrupted (Ctrl+C)


^CInterrupted
The ipa-replica-prepare command was successful

[root@rhel7-1 ~]# ipa host-add rhel7-2.testrelm.test --force --no-reverse
----------------------------------
Added host "rhel7-2.testrelm.test"
----------------------------------
  Host name: rhel7-2.testrelm.test
  Principal name: host/rhel7-2.testrelm.test
  Password: False
  Keytab: False
  Managed by: rhel7-2.testrelm.test
[root@rhel7-1 ~]# dig +short @localhost rhel7-2.testrelm.test

[root@rhel7-1 ~]# 


ON REPLICA:

[root@rhel7-2 ~]# scp root.122.71:/var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg
root.122.71's password: 
replica-info-rhel7-2.testrelm.test.gpg                               100%   30KB  30.4KB/s   00:00    
[root@rhel7-2 ~]# ipa-replica-install --setup-dns --forwarder=192.168.122.1 -w Secret123 -p Secret123 /var/lib/ipa/replica-info-rhel7-2.testrelm.test.gpg
Checking forwarders, please wait ...
WARNING: DNS forwarder 192.168.122.1 does not return DNSSEC signatures in answers
Please fix forwarder configuration to enable DNSSEC support.
(For BIND 9 add directive "dnssec-enable yes;" to "options {}")
WARNING: DNSSEC validation will be disabled
Run connection check to master
Check connection from replica to remote master 'rhel7-1.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check SSH connection to remote master
Execute check on remote master
Check connection from master to remote replica 'rhel7-2.testrelm.test':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos KDC: UDP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   Kerberos Kpasswd: UDP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK

Connection from master to replica is OK.

Connection check OK
Adding [192.168.122.72 rhel7-2.testrelm.test] to your /etc/hosts file
Using reverse zone(s) 122.168.192.in-addr.arpa.
The host rhel7-2.testrelm.test already exists on the master server.
You should remove it before proceeding:
    % ipa host-del rhel7-2.testrelm.test

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0442.html