Description of problem: As reported in https://www.redhat.com/archives/freeipa-users/2015-December/msg00259.html it is suggested that $ ipa-host-net-manage is used for managing netgroups. Instead, "ipa netgroups-*" commands can be suggested. However, under normal conditions, the netgroups commands should not be used with the shadowed netgroups that just mirror hostgroups, but rather only with "native" netgroups created via "netgroup-add" command.
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/index