AFS Images and Express Route

Author: David Curwin

articles/backup/backup-azure-mars-troubleshoot.md

@@ -37,7 +37,7 @@ We recommend that you check the following before you start troubleshooting Micro
 | Cause | Recommended actions |
 | ---     | ---    |
 | **Vault credentials aren't valid** <br/> <br/> Vault credential files might be corrupt or might have expired. (For example, they might have been downloaded more than 48 hours before the time of registration.)| Download new credentials from Recovery Services vault on the Azure portal. (See step 6 in the [Download the MARS agent](https://docs.microsoft.com/azure/backup/backup-configure-vault#download-the-mars-agent) section.) Then take these steps, as appropriate: <ul><li> If you've already installed and registered MARS, open the Microsoft Azure Backup Agent MMC console and then select **Register Server** in the **Actions** pane to complete the registration with the new credentials. <br/> <li> If the new installation fails, try reinstalling with the new credentials.</ul> **Note**: If multiple vault credential files have been downloaded, only the latest file is valid for the next 48 hours. We recommend that you download a new vault credential file.
-| **Proxy server/firewall is blocking registration** <br/>or <br/>**No internet connectivity** <br/><br/> If your machine or proxy server has limited internet connectivity and you don't ensure access for the necessary URLs, the registration will fail.| Take these steps:<br/> <ul><li> Work with your IT team to ensure the system has internet connectivity.<li> If you don't have a proxy server, ensure the proxy option isn't selected when you register the agent. [Check your proxy settings](#verifying-proxy-settings-for-windows).<li> If you do have a firewall/proxy server, work with your networking team to ensure these URLs and IP addresses have access:<br/> <br> **URLs**<br> `www.msftncsi.com` <br> .Microsoft.com <br> .WindowsAzure.com <br> .microsoftonline.com <br> .windows.net <br>**IP addresses**<br>  20.190.128.0/18 <br>  40.126.0.0/18 <br/></ul></ul>Try registering again after you complete the preceding troubleshooting steps.
+| **Proxy server/firewall is blocking registration** <br/>or <br/>**No internet connectivity** <br/><br/> If your machine or proxy server has limited internet connectivity and you don't ensure access for the necessary URLs, the registration will fail.| Take these steps:<br/> <ul><li> Work with your IT team to ensure the system has internet connectivity.<li> If you don't have a proxy server, ensure the proxy option isn't selected when you register the agent. [Check your proxy settings](#verifying-proxy-settings-for-windows).<li> If you do have a firewall/proxy server, work with your networking team to ensure these URLs and IP addresses have access:<br/> <br> **URLs**<br> `www.msftncsi.com` <br> .Microsoft.com <br> .WindowsAzure.com <br> .microsoftonline.com <br> .windows.net <br>**IP addresses**<br>  20.190.128.0/18 <br>  40.126.0.0/18 <br/></ul></ul>Try registering again after you complete the preceding troubleshooting steps.<br></br> If you're connection is via Azure ExpressRoute, make sure the settings are configured as described in [Azure ExpressRoute support](backup-support-matrix-mars-agent.md#azure-expressroute-support).
 | **Antivirus software is blocking registration** | If you have antivirus software installed on the server, add necessary exclusion rules to the antivirus scan for these files and folders: <br/><ul> <li> CBengine.exe <li> CSC.exe<li> The scratch folder. Its default location is C:\Program Files\Microsoft Azure Recovery Services Agent\Scratch. <li> The bin folder at C:\Program Files\Microsoft Azure Recovery Services Agent\Bin.
 
 ### Additional recommendations

articles/backup/backup-azure-microsoft-azure-backup.md

@@ -301,6 +301,14 @@ If you have a firewall or a proxy that is preventing access to Azure, you need t
 * \*.microsoftonline.com
 * \*.windows.net
 
+If you are using ExpressRoute Microsoft peering, please select the following services/regions:
+
+* Azure Active Directory (12076:5060)
+* Microsoft Azure Region (as per the location of your Recovery Services vault)
+* Azure Storage (as per the location of your Recovery Services vault)
+
+For more details, visit [ExpressRoute routing requirements](https://docs.microsoft.com/azure/expressroute/expressroute-routing).
+
 Once connectivity to Azure has been restored to the Azure Backup Server machine, the operations that can be performed are determined by the Azure subscription state. The table above has details about the operations allowed once the machine is "Connected".
 
 ### Handling subscription states

articles/backup/backup-configure-vault.md

@@ -58,6 +58,29 @@ If your machine has limited internet access, ensure that firewall settings on th
 * 20.190.128.0/18
 * 40.126.0.0/18
 
+### Azure ExpressRoute support
+
+You can back up your data over Azure ExpressRoute with public peering (available for old circuits) and Microsoft peering. Backup over private peering is not supported.
+
+With public peering: Ensure access to the following domains/addresses:
+
+* `http://www.msftncsi.com/ncsi.txt`
+* `microsoft.com`
+* `.WindowsAzure.com`
+* `.microsoftonline.com`
+* `.windows.net`
+
+With Microsoft peering, please select the following services/regions and relevant community values:
+
+* Azure Active Directory (12076:5060)
+* Microsoft Azure Region (according to the location of your Recovery Services vault)
+* Azure Storage (according to the location of your Recovery Services vault)
+
+For more details, see the [ExpressRoute routing requirements](https://docs.microsoft.com/azure/expressroute/expressroute-routing).
+
+>[!NOTE]
+>Public Peering is deprecated for new circuits.
+
 Access to all of the URLs and IP addresses listed above uses the HTTPS protocol on port 443.
 
 ## Create a Recovery Services vault
@@ -169,6 +192,7 @@ The backup policy specifies when to take snapshots of the data to create recover
 * Azure Backup doesn't automatically take daylight savings time (DST) into account. This could cause some discrepancy between the actual time and scheduled backup time.
 
 Create a policy as follows:
+
 1. After downloading and registering the MARS agent, launch the agent console. You can find it by searching your machine for **Microsoft Azure Backup**.  
 2. In **Actions**, click **Schedule Backup**.
 
@@ -185,45 +209,39 @@ Create a policy as follows:
 6. In **Select Items to Back up** page, click **Next**.
 7. In **Specify Back up Schedule** page, specify when you want to take daily or weekly backups. Then click **Next**.
 
-    - A recovery point is created when a backup is taken.
-    - The number of recovery points created in your environment is dependent upon your backup schedule.
-
+    * A recovery point is created when a backup is taken.
+    * The number of recovery points created in your environment is dependent upon your backup schedule.
 
 8. You can schedule daily backups, up to three times a day. For example, the screenshot shows two daily backups, one at midnight and one at 6:00 PM.
 
     ![Daily schedule](./media/backup-configure-vault/day-schedule.png)
 
-
 9. You can run weekly backups too. For example, the screenshot shows backups taken every alternate Sunday & Wednesday at 9:30 AM and 1:00 AM.
 
     ![Weekly schedule](./media/backup-configure-vault/week-schedule.png)
 
-
 10. On the **Select Retention Policy** page, specify how you store historical copies of your data. Then click **Next**.
 
-    - Retention settings specify which recovery points should be stored, and how long they should be stored for.
-    - For example, when you set a daily retention setting, you indicate that at the time specified for the daily retention, the latest recovery point will be retained for the specified number of days. Or, as another example, you could specify a monthly retention policy to indicate that the recovery point created on the 30th of every month should be stored for 12 months.
-    - Daily and weekly recovery point retention usually coincides with the backup schedule. Meaning that when the backup is triggered according to schedule, the recovery point created by the backup is stored for the duration indicated in the daily or weekly retention policy.
-    - As an example, in the following screenshot:
+    * Retention settings specify which recovery points should be stored, and how long they should be stored for.
+    * For example, when you set a daily retention setting, you indicate that at the time specified for the daily retention, the latest recovery point will be retained for the specified number of days. Or, as another example, you could specify a monthly retention policy to indicate that the recovery point created on the 30th of every month should be stored for 12 months.
+    * Daily and weekly recovery point retention usually coincides with the backup schedule. Meaning that when the backup is triggered according to schedule, the recovery point created by the backup is stored for the duration indicated in the daily or weekly retention policy.
+    * As an example, in the following screenshot:
 
-        -   Daily backups at midnight and 6:00 PM are kept for seven days.
-        -   Backups taken on a Saturday at midnight and 6:00 PM are kept for four weeks.
-        -   Backups taken on Saturday on the last week of the month at midnight and 6:00 PM are kept for 12 months.
-        -   Backups taken on a Saturday in the last week of March are kept for 10 years.
+        * Daily backups at midnight and 6:00 PM are kept for seven days.
+        * Backups taken on a Saturday at midnight and 6:00 PM are kept for four weeks.
+        * Backups taken on Saturday on the last week of the month at midnight and 6:00 PM are kept for 12 months.
+        * Backups taken on a Saturday in the last week of March are kept for 10 years.
 
         ![Retention example](./media/backup-configure-vault/retention-example.png)
 
-
 11. In **Choose Initial Backup Type** decide if you want to take the initial backup over the network or use offline backup (for more information on offline backup refer, see this [article](offline-backup-azure-data-box.md)). To take the initial backup over the network, select **Automatically over the network** and click **Next**.
 
     ![initial Backup Type](./media/backup-azure-manage-mars/choose-initial-backup-type.png)
 
-
 12. In **Confirmation**, review the information, and then click **Finish**.
 
     ![Confirm Backup Type](./media/backup-azure-manage-mars/confirm-backup-type.png)
 
-
 13. After the wizard finishes creating the backup schedule, click **Close**.
 
     ![Confirm Modify Backup Process](./media/backup-azure-manage-mars/confirm-modify-backup-process.png)

articles/backup/backup-support-matrix-mabs-dpm.md

@@ -108,12 +108,35 @@ You can deploy MABS on an Azure Stack VM so that you can manage backup of Azure
 
 The DPM server/MABS needs access to these URLs:
 
-- http://www.msftncsi.com/ncsi.txt
+- `http://www.msftncsi.com/ncsi.txt`
 - *.Microsoft.com
 - *.WindowsAzure.com
 - *.microsoftonline.com
 - *.windows.net
 
+### Azure ExpressRoute support
+
+You can back up your data over Azure ExpressRoute with public peering (available for old circuits) and Microsoft peering. Backup over private peering is not supported.
+
+With public peering: Ensure access to the following domains/addresses:
+
+* `http://www.msftncsi.com/ncsi.txt`
+* `microsoft.com`
+* `.WindowsAzure.com`
+* `.microsoftonline.com`
+* `.windows.net`
+
+With Microsoft peering, please select the following services/regions and relevant community values:
+
+* Azure Active Directory (12076:5060)
+* Microsoft Azure Region (according to the location of your Recovery Services vault)
+* Azure Storage (according to the location of your Recovery Services vault)
+
+For more details, see the [ExpressRoute routing requirements](https://docs.microsoft.com/azure/expressroute/expressroute-routing).
+
+>[!NOTE]
+>Public Peering is deprecated for new circuits.
+
 ### DPM/MABS connectivity to Azure Backup
 
 Connectivity to the Azure Backup service is required for backups to function properly, and the Azure subscription should be active. The following table shows the behavior if these two things don't occur.

articles/backup/backup-support-matrix-mars-agent.md

@@ -62,6 +62,29 @@ And to these IP addresses:
 
 Access to all of the URLs and IP addresses listed above uses the HTTPS protocol on port 443.
 
+### Azure ExpressRoute support
+
+You can back up your data over Azure ExpressRoute with public peering (available for old circuits) and Microsoft peering. Backup over private peering is not supported.
+
+With public peering: Ensure access to the following domains/addresses:
+
+- `http://www.msftncsi.com/ncsi.txt`
+- `microsoft.com`
+- `.WindowsAzure.com`
+- `.microsoftonline.com`
+- `.windows.net`
+
+With Microsoft peering, please select the following services/regions and relevant community values:
+
+- Azure Active Directory (12076:5060)
+- Microsoft Azure Region (according to the location of your Recovery Services vault)
+- Azure Storage (according to the location of your Recovery Services vault)
+
+For more details, see the [ExpressRoute routing requirements](https://docs.microsoft.com/azure/expressroute/expressroute-routing).
+
+>[!NOTE]
+>Public Peering is deprecated for new circuits.
+
 ### Throttling support
 
 **Feature** | **Details**