Azure Site Recovery reprotect to the primary region - Connection cannot be established to Azure Site Recovery service endpoints.

Question

Hi, We have ASR setup between 2 of our regions. In the primary region, we have our own custom DNS and using private endpoints and we have firewall in force tunneling mode. As a part of our DR test, we failed-over a test vm from our primary region to the secondary one and when trying to reprotect to the primary location, we are getting this error at "install mobility agent" stage:

Connection cannot be established to Azure Site Recovery service endpoints.

We have read several MS documentation and added all required URL as per https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-troubleshoot-network-connectivity and several others, but still getting the same error. Can we please get some suggestion to get this resolved? We also have the Firewall in the secondary region in force tunneling mode. This seems to be the DNS related issue as our DNS server is in the primary region. Can we please get some advice. Many thanks

Answer 1

@Ghulam Abbas Sorry for the inconvenience caused to you!

Based on the details shared in the original post, I understand that you were able to perform test failover to secondary region. However, while re-protecting the VM to primary region, you are getting an error at "install mobility agent" stage:

I know you referred to the troubleshooting guide - https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-troubleshoot-errors#outbound-urls-or-ip-ranges-error-code-151037-or-151072 just wanted to ensure you followed the steps to fix the DNS issue as detailed in the link.

Also refer to this document - Re-protect failed over Azure VMs to the primary region

The error is clear that you cannot reach the endpoint from where the VM will download the agent.

Connection cannot be established to Azure Site Recovery service endpoints.

Recommended action to resolve the issue:

1. If you are using firewall proxy to control outbound network connectivity on the VM, ensure you allow communication to the prerequisite URLs or datacenter IP ranges. Refer to https://aka.ms/a2a-firewall-proxy-guidance
2. If you are using Azure Network security group (NSG) rules to control outbound network connectivity on the VM, ensure you allow communication to the prerequisite URLs or datacenter IP ranges. Refer to https://aka.ms/a2a-nsg-guidance

Location and names of logs that provide error information (from all platforms: CS/PS/protected VM)

On the source VM:

The ASR and Office365 end points are listed in the file below. Please note these change Geo to Geo.

C:\ProgramData\Microsoft Azure Site Recovery\Config\RCMInfo.conf

Hope this helps. Let us know how it goes!

---

If the response helped, do "Accept Answer" and up-vote it