Due to how certificates work, the powerschool servers must reside in the remc1.net domain. We use a redirect on webservices.remc1.net to move users into the correct place. The reason we do this instead of just using a CNAME to point from ps.SCHOOLDOMAIN.org to psschool.remc1.net is that the CNAME keeps the ps.SCHOOLDOMAIN.org URL (alias style) so the *.remc1.net cert will not work since the URL is SCHOOLDOMAIN.net. The redirect below changes the URL in the end user's browser; when they type in ps.SCHOOLDOMAIN.org, it will actually change the URL to psschool.remc1.net.
The PS redirect file is located on web6, /etc/apache2/sites-enabled/010-powerschoolRedirects.conf
Example
I will use the CCISD as an example. On the CCISD website there is a link to PowerSchool which points to http://powerschool.copperisd.org. This is a CNAME to webservices.remc1.net. Inside webservices there is a virtual host that does a redirect to pscopperisd.remc1.net. pscopperisd will differ from the inside and the outside. On the inside DNS this is CNAMEed to the current PowerSchool server (at time of writing that is ps2copperisd.remc1.net). On the outside that is an A record to the one public IP that is held by the PowerSchool server for the CopperISD. I have also inserted CNAMES for all the ps1, ps2, ectetc. on the outside to point towards it's A record.
| Outside | Inside | Virtual Host config |
|---|---|---|
pscopperisd.remc1.net. IN A 208.68.25.46 ps1copperisd.remc1.net. IN CNAME pscopperisd.remc1.net. ps2copperisd.remc1.net. IN CNAME pscopperisd.remc1.net. | pscopperisd IN CNAME ps2copperisd ps2copperisd IN A 172.16.30.4 ps1copperisd.remc1.net. IN A 172.16.20.144 | <VirtualHost powerschool.copperisd.org> |
As you can see, the way the virtual host is setup will cause the same name to be resolved on the outside as well as the inside. On the outside the VIP will never change, so that's the A record. Where as on the inside the host may so that's the CNAME. You will need to reload apache on the web server in order for the new virtual host config to take hold.
So, in short, the 2 things you need to change to drop a new PowerSchool server in will be:
- The inside IP for the virtual IP on the fortigate
- Add a new DNS record for the new server
- The inside DNS CNAME
...
Configs for example purposes:
| Outside | Inside |
|---|---|
psadams.remc1.net. IN A 208.68.25.14 ps1adams.remc1.net. IN CNAME psadams.remc1.net. psbaraga.remc1.net. IN A 208.68.24.157 psbessemer.remc1.net. IN A 208.68.25.30 pscia.remc1.net IN A 208.68.26.36 pscopperisd.remc1.net. IN A 208.68.25.46 pscts.remc1.net. IN A 208.68.25.60
psetc.remc1.net. IN A 208.68.25.100
psoasd.remc1.net. IN A 208.68.25.212 psremc1.remc1.net. IN A 208.68.24.29 pswakefield.remc1.net. IN A 208.68.25.237
| ;PowerSchool DNS CNAME |
ps19adams |
ps19baraga pscia IN CNAME |
ps19cia |
ps19copperisd |
ps19cts |
ps19dollarbay |
ps19etc |
ps19fp |
ps19goisd |
ps19houghton |
ps19ll |
ps19oasd |
ps19remc1-01 |
ps19wakefield |
ps19watersmeet |
ps19stanton ;New Powerschool servers ;old powerschool servers | |