Home / server / Questions / 711540
Accepted
jornane
Asked: 2015-08-08 01:42:00 +0800 CST

ESXi refuses AD join, "The host does not have a suitable FQDN"

  • 772

I have an ESXi 6 hypervisor (esx.ad.example.com) that I want to join into an AD domain (ad.example.com) with one DC. Both domain controller (dc.ad.example.com) and hypervisor have an IPv6 address and working DNS. The domain is resolvable globally and thus no custom DNS server is set. This setup works fine for Windows workstations or guests on the same ESXi joining the same domain.

The real domain name does not end with example.com, but is substituted for privacy reasons. Dig output with the same substitution follows, this output is consistent over multiple locations in the world:

$ dig NS ad.example.com. +short
dc.ad.example.com.
$ dig AAAA ad.example.com. +short
2001:db8::ad:dc:1
$ dig AAAA dc.ad.example.com. +short @dc.ad.example.com
2001:db8::ad:dc:1
$ dig PTR 1.0.0.0.c.d.0.0.d.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. +short
dc.ad.example.com.

To make things clear: The domain ad.example.com uses AD-integrated DNS, but the Windows DNS server on the DC is non-resolving. A normal resolver, without any forwarders explicitly configured, will still forward all requests for *.ad.example.com to 2001:db8::ad:dc:1, because NS records are in place, as illustrated by the dig commands mentioned. If I would add @8.8.8.8 to the commands, the output would be the same. According to this Technet article, this means that the domain uses AD-integrated DNS.

In ESXi, under Configuration -> DNS and Routing, I have set Name to esx and Domain to ad.example.com. Then under Authentication Services I set Directory Services Type to Active Directory. I enter the domain ad.example.com, click Join and enter credentials. Within a second, the following message appears:

The host does not have a suitable FQDN.

The only non-standard thing in my setup is that there is no IPv4 connectivity (and non-trivial to set up), otherwise i'd say everything is done by the book. There is no packet filter between the hosts, apart from the default firewall ESXi has, which I have not changed from its defaults. Can it be that the ESXi AD implementation requires IPv4, or is something else wrong?

active-directory

3 Answers

  1. Best Answer

    Read the relevant documentation for your product.

    http://pubs.vmware.com/vsphere-60/index.jsp?topic=%2Fcom.vmware.vsphere.networking.doc%2FGUID-6BC115DF-4EC5-409E-8B74-45525E966F0F.html

    The documentation clearly states that ipv6 is not supported for ESXi -> Active Directory communication. (as of 6.0.)

    No ipv6

    • 9

  2. Honestly, if this is a standalone host, it's not worth joining it to a domain. Ideally you join your vCenter Server to Active Directory, not the individual hosts.

    • 2

  3. Prior to trying to join the host to the domain, under the hosts configuration tab, select 'DNS and Routing' and ensure the host informaiton including Name and Domain is populated.

    • -1