About networking in Azure VM disaster recovery
This article provides networking guidance when you're replicating and recovering Azure VMs from one region to another, using Azure Site Recovery.
Before you start
Learn how Site Recovery provides disaster recovery for this scenario.
Typical network infrastructure
The following diagram depicts a typical Azure environment, for applications running on Azure VMs:
If you're using Azure ExpressRoute or a VPN connection from your on-premises network to Azure, the environment is as follows:
Typically, networks are protected using firewalls and network security groups (NSGs). Firewalls use URL or IP-based whitelisting to control network connectivity. NSGs provide rules that use IP address ranges to control network connectivity.
Using an authenticated proxy to control network connectivity isn't supported by Site Recovery, and replication can't be enabled.
Outbound connectivity for URLs
If you are using a URL-based firewall proxy to control outbound connectivity, allow these Site Recovery URLs:
|*.blob.core.windows.net||Required so that data can be written to the cache storage account in the source region from the VM. If you know all the cache storage accounts for your VMs, you can allow access to the specific storage account URLs (Ex: cache1.blob.core.windows.net and cache2.blob.core.windows.net) instead of *.blob.core.windows.net|
|login.microsoftonline.com||Required for authorization and authentication to the Site Recovery service URLs.|
|*.hypervrecoverymanager.windowsazure.com||Required so that the Site Recovery service communication can occur from the VM. You can use the corresponding 'Site Recovery IP' if your firewall proxy supports IPs.|
|*.servicebus.windows.net||Required so that the Site Recovery monitoring and diagnostics data can be written from the VM. You can use the corresponding 'Site Recovery Monitoring IP' if your firewall proxy supports IPs.|
Outbound connectivity for IP address ranges
If you are using an IP-based firewall proxy, or NSG rules to control outbound connectivity, these IP ranges need to be allowed.
- All IP address ranges that correspond to the storage accounts in source region
- Create a Storage service tag based NSG rule for the source region.
- Allow these addresses so that data can be written to the cache storage account, from the VM.
- Create a Azure Active Directory (AAD) service tag based NSG rule for allowing access to all IP addresses corresponding to AAD
- If new addresses are added to the Azure Active Directory (AAD) in the future, you need to create new NSG rules.
- Site Recovery service endpoint IP addresses - available in an XML file and depend on your target location.
- We recommend that you create the required NSG rules on a test NSG, and verify that there are no problems before you create the rules on a production NSG.
Site Recovery IP address ranges are as follows:
|Target||Site Recovery IP||Site Recovery monitoring IP|
|North Central US||188.8.131.52||184.108.40.206|
|South Central US||220.127.116.11||18.104.22.168|
|East US 2||22.214.171.124||126.96.36.199|
|West Central US||188.8.131.52||184.108.40.206|
|West US 2||220.127.116.11||18.104.22.168|
|UK South 2||22.214.171.124||126.96.36.199|
|Australia Central 2||188.8.131.52||184.108.40.206|
|South Africa West||220.127.116.11||18.104.22.168|
|South Africa North||22.214.171.124||126.96.36.199|
|US Gov Virginia||188.8.131.52||184.108.40.206|
|US Gov Iowa||220.127.116.11||18.104.22.168|
|US Gov Arizona||22.214.171.124||126.96.36.199|
|US Gov Texas||188.8.131.52||184.108.40.206|
|US DoD East||220.127.116.11||18.104.22.168|
|US DoD Central||22.214.171.124||126.96.36.199|
|China North 2||188.8.131.52||184.108.40.206|
|China East 2||220.127.116.11||18.104.22.168|
|Germany West Central||22.214.171.124||126.96.36.199|
Example NSG configuration
This example shows how to configure NSG rules for a VM to replicate.
- If you're using NSG rules to control outbound connectivity, use "Allow HTTPS outbound" rules to port:443 for all the required IP address ranges.
- The example presumes that the VM source location is "East US" and the target location is "Central US".
NSG rules - East US
Create an outbound HTTPS (443) security rule for "Storage.EastUS" on the NSG as shown in the screenshot below.
Create an outbound HTTPS (443) security rule for "AzureActiveDirectory" on the NSG as shown in the screenshot below.
Create outbound HTTPS (443) rules for the Site Recovery IPs that correspond to the target location:
Location Site Recovery IP address Site Recovery monitoring IP address Central US 188.8.131.52 184.108.40.206
NSG rules - Central US
These rules are required so that replication can be enabled from the target region to the source region post-failover:
Create an outbound HTTPS (443) security rule for "Storage.CentralUS" on the NSG.
Create an outbound HTTPS (443) security rule for "AzureActiveDirectory" on the NSG.
Create outbound HTTPS (443) rules for the Site Recovery IPs that correspond to the source location:
Location Site Recovery IP address Site Recovery monitoring IP address East US 220.127.116.11 18.104.22.168
Network virtual appliance configuration
If you are using network virtual appliances (NVAs) to control outbound network traffic from VMs, the appliance might get throttled if all the replication traffic passes through the NVA. We recommend creating a network service endpoint in your virtual network for "Storage" so that the replication traffic does not go to the NVA.
Create network service endpoint for Storage
You can create a network service endpoint in your virtual network for "Storage" so that the replication traffic does not leave Azure boundary.
Select your Azure virtual network and click on 'Service endpoints'
Click 'Add' and 'Add service endpoints' tab opens
Select 'Microsoft.Storage' under 'Service' and the required subnets under 'Subnets' field and click 'Add'
Do not restrict virtual network access to your storage accounts used for ASR. You should allow access from 'All networks'
You can override Azure's default system route for the 0.0.0.0/0 address prefix with a custom route and divert VM traffic to an on-premises network virtual appliance (NVA), but this configuration is not recommended for Site Recovery replication. If you're using custom routes, you should create a virtual network service endpoint in your virtual network for "Storage" so that the replication traffic does not leave the Azure boundary.