|
| 1 | +--- |
| 2 | +title: Reliability in Azure DDoS Network Protection |
| 3 | +description: Find out about reliability in Azure DDoS Network Protection |
| 4 | +author: anaharris-ms |
| 5 | +ms.author: anaharris |
| 6 | +ms.topic: overview |
| 7 | +ms.custom: subject-reliability, references_regions |
| 8 | +ms.service: ddos-protection |
| 9 | +ms.date: 02/05/2024 |
| 10 | +--- |
| 11 | + |
| 12 | +# Reliability in Azure DDoS Network Protection |
| 13 | + |
| 14 | + |
| 15 | +This article describes reliability support in [Azure DDoS Network Protection](../ddos-protection/ddos-protection-overview.md), and both regional resiliency with availability zones and [cross-region recovery and business continuity](#cross-region-disaster-recovery-and-business-continuity). For a more detailed overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). |
| 16 | + |
| 17 | + |
| 18 | +## Availability zone support |
| 19 | + |
| 20 | +[!INCLUDE [Availability zone description](includes/reliability-availability-zone-description-include.md)] |
| 21 | + |
| 22 | +Azure DDoS Protection is [zone-redundant](./availability-zones-overview.md#zonal-and-zone-redundant-services) by default and is managed by the service itself. You don't need to configure or setup zone redundancy yourself. |
| 23 | + |
| 24 | +### Prerequisites |
| 25 | + |
| 26 | + |
| 27 | + |
| 28 | +### Zone down experience |
| 29 | + |
| 30 | + |
| 31 | + |
| 32 | +### Cross-region recovery and business continuity |
| 33 | + |
| 34 | +[!INCLUDE [introduction to disaster recovery](includes/reliability-disaster-recovery-description-include.md)] |
| 35 | + |
| 36 | + |
| 37 | + |
| 38 | +#### Disaster recovery in multi-region geography |
| 39 | + |
| 40 | +A Virtual Network (VNet) is a logical representation of your network in the cloud. VNets serve as a trust boundary to host your resources such as Azure Application Gateway, Azure Firewall and Azure Virtual Machines. Each VNet is created within the scope of a region, but you can create VNets with same address space in two different regions (For example, US East and US West). Keep in mind that, because they have the same address space, you can't connect them together. |
| 41 | + |
| 42 | +You can choose one of two approaches to managing business continuity for DDoS Protection over your VNets. The first approach is reactive and the second approach is proactive. |
| 43 | + |
| 44 | + |
| 45 | +- **Reactive business continuity plan**. Virtual networks are fairly lightweight resources. In the case of a regional outage, you can invoke Azure APIs to create a VNet with the same address space, but in a different region. To recreate the same environment that was present in the affected region, you'll need to make API calls to redeploy primary region VNet resources. If on-premises connectivity is available, such as in a hybrid deployment, you must deploy a new VPN Gateway, and connect to your on-premises network. |
| 46 | + |
| 47 | +>[!NOTE] |
| 48 | +>A reactive approach to maintaining business continuity always runs the risk that you may not have access to the primary region's resources, due the extent of the disaster. In that case, you'll need to recreate all of the primary region's resources. |
| 49 | +
|
| 50 | + |
| 51 | +- **Proactive business continuity plan**. You can create two VNets using the same private IP address space and resources in two different regions ahead of time. If you are hosting internet-facing services in the VNet, you could set up Traffic Manager to geo-route traffic to the region that is active. However, you cannot connect two VNets with the same address space to your on-premises network, as it would cause routing issues. At the time of a disaster and loss of a VNet in one region, you can connect the other VNet in the available region, with the matching address space to your on-premises network. |
| 52 | + |
| 53 | + |
| 54 | +To create a virtual network, see [Create a virtual network](/azure/virtual-network/manage-virtual-network#create-a-virtual-network). |
| 55 | + |
| 56 | + |
| 57 | +### Disaster recovery in single-region geography |
| 58 | + |
| 59 | +For single region geographies in a disaster scenario, the virtual network and the resources in the affected region remains inaccessible during the time of the service disruption. |
| 60 | + |
| 61 | +## Next steps |
| 62 | + |
| 63 | +- [Reliability in Azure](/azure/availability-zones/overview) |
0 commit comments