You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/site-recovery/azure-to-azure-about-networking.md
+19-18Lines changed: 19 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,10 @@
1
1
---
2
2
title: About networking in Azure VM disaster recovery with Azure Site Recovery
3
3
description: Provides an overview of networking for replication of Azure VMs using Azure Site Recovery.
4
-
services: site-recovery
5
4
author: ankitaduttaMSFT
6
5
manager: rochakm
7
6
ms.service: site-recovery
8
-
ms.topic: article
7
+
ms.topic: conceptual
9
8
ms.date: 11/21/2021
10
9
ms.author: ankitadutta
11
10
ms.custom: engagement-fy23
@@ -41,7 +40,7 @@ Typically, networks are protected using firewalls and network security groups (N
41
40
42
41
## Outbound connectivity for URLs
43
42
44
-
If you are using a URL-based firewall proxy to control outbound connectivity, allow these Site Recovery URLs:
43
+
If you're using a URL-based firewall proxy to control outbound connectivity, allow these Site Recovery URLs:
45
44
46
45
**URL** | **Details**
47
46
--- | ---
@@ -50,13 +49,13 @@ login.microsoftonline.com | Required for authorization and authentication to the
50
49
*.hypervrecoverymanager.windowsazure.com | Required so that the Site Recovery service communication can occur from the VM.
51
50
*.servicebus.windows.net | Required so that the Site Recovery monitoring and diagnostics data can be written from the VM.
52
51
*.vault.azure.net | Allows access to enable replication for ADE-enabled virtual machines via portal
53
-
*.automation.ext.azure.com | Allows enabling auto-upgrade of mobility agent for a replicated item via portal
52
+
*.automation.ext.azure.com | Allows enabling autoupgrade of mobility agent for a replicated item via portal
54
53
55
54
## Outbound connectivity using Service Tags
56
55
57
-
Apart from controlling URLs, you can also use service tags to control connectivity. To do so, you will first need to create a [Network Security Group](../virtual-network/network-security-group-how-it-works.md) in Azure. Once created, you will need to use our existing service tags and create an NSG rule to allow access to Azure Site Recovery services.
56
+
Apart from controlling URLs, you can also use service tags to control connectivity. To do so, you must first create a [Network Security Group](../virtual-network/network-security-group-how-it-works.md) in Azure. Once created, you need to use our existing service tags and create an NSG rule to allow access to Azure Site Recovery services.
58
57
59
-
The advantages of using service tags to control connectivity, when compared to controlling connectivity using IP addresses, is that there will be no hard dependency on a particular IP address to stay connected to our services. In such a scenario, if the IP address of one of our services changes, then the ongoing replication will not be impacted for your machines. Whereas, a dependency on hard coded IP addresses will cause the replication status to become critical and put your systems at risk. Moreover, service tags ensures better security, stability and resiliency than hard coded IP addresses.
58
+
The advantages of using service tags to control connectivity, when compared to controlling connectivity using IP addresses, is that there is no hard dependency on a particular IP address to stay connected to our services. In such a scenario, if the IP address of one of our services changes, then the ongoing replication is not impacted for your machines. Whereas, a dependency on hard coded IP addresses causes the replication status to become critical and put your systems at risk. Moreover, service tags ensure better security, stability and resiliency than hard coded IP addresses.
60
59
61
60
While using NSG to control outbound connectivity, these service tags need to be allowed.
62
61
@@ -65,9 +64,9 @@ While using NSG to control outbound connectivity, these service tags need to be
65
64
- Allow these addresses so that data can be written to the cache storage account, from the VM.
66
65
- Create a [Microsoft Entra service tag](../virtual-network/network-security-groups-overview.md#service-tags) based NSG rule for allowing access to all IP addresses corresponding to Microsoft Entra ID
67
66
- Create an EventsHub service tag-based NSG rule for the target region, allowing access to Site Recovery monitoring.
68
-
- Create an AzureSiteRecovery service tag-based NSG rule for allowing access to Site Recovery service in any region.
67
+
- Create an Azure Site Recovery service tag-based NSG rule for allowing access to Site Recovery service in any region.
69
68
- Create an AzureKeyVault service tag-based NSG rule. This is required only for enabling replication of ADE-enabled virtual machines via portal.
70
-
- Create a GuestAndHybridManagement service tag-based NSG rule. This is required only for enabling auto-upgrade of mobility agent for a replicated item via portal.
69
+
- Create a GuestAndHybridManagement service tag-based NSG rule. This is required only for enabling autoupgrade of mobility agent for a replicated item via portal.
71
70
- We recommend that you create the required NSG rules on a test NSG, and verify that there are no problems before you create the rules on a production NSG.
72
71
73
72
## Example NSG configuration
@@ -79,17 +78,17 @@ This example shows how to configure NSG rules for a VM to replicate.
79
78
80
79
### NSG rules - East US
81
80
82
-
1. Create an outbound HTTPS (443) security rule for "Storage.EastUS" on the NSG as shown in the screenshot below.
81
+
1. Create an outbound HTTPS (443) security rule for "Storage.EastUS" on the NSG as shown in the following screenshot:
83
82
84
83

85
84
86
-
2. Create an outbound HTTPS (443) security rule for "AzureActiveDirectory" on the NSG as shown in the screenshot below.
85
+
2. Create an outbound HTTPS (443) security rule for "AzureActiveDirectory" on the NSG as shown in the following screenshot:
87
86
88
87

89
88
90
-
3. Similar to above security rules, create outbound HTTPS (443) security rule for "EventHub.CentralUS" on the NSG that corresponds to the target location. This allows access to Site Recovery monitoring.
89
+
3. Similar to the security rules, create outbound HTTPS (443) security rule for "EventHub.CentralUS" on the NSG that corresponds to the target location. This allows access to Site Recovery monitoring.
91
90
92
-
4. Create an outbound HTTPS (443) security rule for "AzureSiteRecovery" on the NSG. This allows access to Site Recovery Service in any region.
91
+
4. Create an outbound HTTPS (443) security rule for "Azure Site Recovery" on the NSG. This allows access to Site Recovery Service in any region.
93
92
94
93
### NSG rules - Central US
95
94
@@ -99,16 +98,17 @@ These rules are required so that replication can be enabled from the target regi
99
98
100
99
2. Create an outbound HTTPS (443) security rule for "AzureActiveDirectory" on the NSG.
101
100
102
-
3. Similar to above security rules, create outbound HTTPS (443) security rule for "EventHub.EastUS" on the NSG that corresponds to the source location. This allows access to Site Recovery monitoring.
101
+
3. Similar to the security rules, create outbound HTTPS (443) security rule for "EventHub.EastUS" on the NSG that corresponds to the source location. This allows access to Site Recovery monitoring.
103
102
104
-
4. Create an outbound HTTPS (443) security rule for "AzureSiteRecovery" on the NSG. This allows access to Site Recovery Service in any region.
103
+
4. Create an outbound HTTPS (443) security rule for "Azure Site Recovery" on the NSG. This allows access to Site Recovery Service in any region.
105
104
106
105
## Network virtual appliance configuration
107
106
108
-
If you are using network virtual appliances (NVAs) to control outbound network traffic from VMs, the appliance might get throttled if all the replication traffic passes through the NVA. We recommend creating a network service endpoint in your virtual network for "Storage" so that the replication traffic does not go to the NVA.
107
+
If you're using network virtual appliances (NVAs) to control outbound network traffic from VMs, the appliance might get throttled if all the replication traffic passes through the NVA. We recommend creating a network service endpoint in your virtual network for "Storage" so that the replication traffic doesn't go to the NVA.
109
108
110
109
### Create network service endpoint for Storage
111
-
You can create a network service endpoint in your virtual network for "Storage" so that the replication traffic does not leave Azure boundary.
110
+
111
+
You can create a network service endpoint in your virtual network for "Storage" so that the replication traffic doesn't leave Azure boundary.
112
112
113
113
- Select your Azure virtual network and click on 'Service endpoints'
114
114
@@ -118,14 +118,15 @@ You can create a network service endpoint in your virtual network for "Storage"
118
118
- Select 'Microsoft.Storage' under 'Service' and the required subnets under 'Subnets' field and click 'Add'
119
119
120
120
>[!NOTE]
121
-
>If you are using firewall enabled cache storage account or target storage account, ensure you ['Allow trusted Microsoft services'](../storage/common/storage-network-security.md). Also, ensure that you allow access to at least one subnet of source Vnet.
121
+
>If you're using firewall enabled cache storage account or target storage account, ensure you ['Allow trusted Microsoft services'](../storage/common/storage-network-security.md). Also, ensure that you allow access to at least one subnet of source Vnet.
122
122
123
123
124
124
### Forced tunneling
125
125
126
-
You can override Azure's default system route for the 0.0.0.0/0 address prefix with a [custom route](../virtual-network/virtual-networks-udr-overview.md#custom-routes) and divert VM traffic to an on-premises network virtual appliance (NVA), but this configuration is not recommended for Site Recovery replication. If you're using custom routes, you should [create a virtual network service endpoint](azure-to-azure-about-networking.md#create-network-service-endpoint-for-storage) in your virtual network for "Storage" so that the replication traffic does not leave the Azure boundary.
126
+
You can override Azure's default system route for the 0.0.0.0/0 address prefix with a [custom route](../virtual-network/virtual-networks-udr-overview.md#custom-routes) and divert VM traffic to an on-premises network virtual appliance (NVA), but this configuration isn't recommended for Site Recovery replication. If you're using custom routes, you should [create a virtual network service endpoint](azure-to-azure-about-networking.md#create-network-service-endpoint-for-storage) in your virtual network for "Storage" so that the replication traffic doesn't leave the Azure boundary.
127
127
128
128
## Next steps
129
+
129
130
- Start protecting your workloads by [replicating Azure virtual machines](./azure-to-azure-quickstart.md).
130
131
- Learn more about [IP address retention](site-recovery-retain-ip-azure-vm-failover.md) for Azure virtual machine failover.
131
132
- Learn more about disaster recovery of [Azure virtual machines with ExpressRoute](azure-vm-disaster-recovery-with-expressroute.md).
0 commit comments