Azure Site Recovery Zone to Zone - unable to edit Test Fail over network configuration when VM is running in Failed over Zone.

{Ran}-{Kan} 0 Reputation points
2023-05-03T12:35:32.0666667+00:00

Requirement:

  1. While VM is in source zone or when in failed over zone, we want to use same 'Test fail over network' (vNet1/subnet 3). This test fail over network is one of the subnet (8 IPs only) of an existing established Virtual network which has connectivity to on-prem network.
  2. We are able to perform test fail over without affecting the production server availability when VM is in source zone or target zone.
  3. During fail over, failed over VM in target zone to get new IP in same subnet or keep existing IP (static) - ie: Target network same as source network (vNet3/subnet 1) and after fail back keep the same IP address.

Configuration

  1. Test network for fail over configured - vNet1/subnet 3.
  2. Subnet 3 in vNet1 - Security Group configured to allow RDP traffic(inbound) only and all outbound traffic denied.

Note: With this configuration we are able to perform test fail over without impacting the production server availability as RDP traffic only can reach test failed over VM.

Observation

  1. Able to edit and save Network parameters for replicated items ( RSV --> Replicated Items --> VM --> Network) before fail over execution to configure test fail over settings for Virtual Network ( vNet1/subnet 3)
  2. Executed Test Fail over: working as expected. Test VM's-nic obtained IP address in vNet1/subnet 3
  3. Executed Fail over (with Dynamic IP): worked as expected. Failed over VM's-nic obtained IP address in vNet3/subnet 1.
  4. Commit /Reprotect - done
  5. Tried 'test fail over' - Available option to select 'Virtual Network' only - no option to select 'subnet', ended up test failed over VM received IP from vNet1/Subnet 1 which is a production network (un-restricted traffic). Impact on application availability ( 2 hosts has same name and SID ).
  6. Tried configuring Network parameters (same as step 1) on failed over VM to pre-configure Virtual Network and Subnet - Unable to save the configuration as restriction applied (as changes on Failed Over VM not allowed)

Issue:

Azure VM, zone to zone Test Fail over configuration - Test fail over network limitation when VM is in failed over state.

Unable to use preferred subnet (with restricted inbound and outbound traffic) when target vNet has multi subnets and shutting down application server for test fail over is not an option due to business requirement.

Work around:

When Test Fail over subnet is the only one subnet associated to Virtual Network then this is not an issue as we can pickup test fail over virtual network while executing the test fail over, subnet will be defaulted to single subnet. In our environment we have to use x.y.z.0/24 IP address space for virtual network, otherwise connectivity to on-prem network is not working,

Is this a limitation of the product or I am missing something?

Why a capability available to run failover test with a preferred subnet while VM in normal mode ( in source zone without impacting application availability) is not available when failed over VM is running in failed over target zone?

This is limiting the ability to perform test fail over while utilizing same 'test subnet' (few IPs) which has security group configured to allow RDP access only while VM is in Failed over state ( running in failed over zone)

Azure Site Recovery
Azure Site Recovery
An Azure native disaster recovery service. Previously known as Microsoft Azure Hyper-V Recovery Manager.
663 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. risolis 8,701 Reputation points
    2023-05-04T02:41:07.7533333+00:00

    Hello @{Kan}-{Ran}

    Thank you for posting this concern on this community.

    I just wanted to gather the following detail stated down below:

    User's image

    Looking forward to hearing from you

    Cheers,

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.