issue while ASR failover/back operation using powershell

Question

Service being used - Azure Powershell and Azure CLI

Issue - getting error while enabling RE-PROTECTION after failover (not test failover) using commands

Commands tried -

Update-AzRecoveryServicesAsrProtectionDirection -ReplicationProtectedItem $rpi -Direction RecoveryToPrimary

Update-AzRecoveryServicesAsrProtectionDirection -RecoveryPlan $plan -Direction RecoveryToPrimary

az site-recovery protected-item reprotect

Source - https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-powershell#reprotect-and-fail-back-to-the-source-region

Help required - Guide to exact WORKING COMMANDS to perform the re-protection and failover processes.

I saw multiple questions on the same topic for re-protection, but did not seem to have working solution?

Thanks

Answer 1

Hi @Harshit Z Kothari ,

Please follow below steps this will resolve your issue 100%

Switch protection for a VM replication from Central India to East US, using the appropriate vault and fabric context along with protection containers and cache storage.

 ---

 # Steps Explanation:

 1. Setting the Vault Context:    You set the Azure Site Recovery vault context so that all subsequent commands are executed within the scope of this vault.

  $vault = Get-AzRecoveryServicesVault -Name <recovery vault name>    
  Write-Output $vault
  Set-AzRecoveryServicesAsrVaultContext -Vault $vault

 This sets the context to the <recovery vault name> vault, ensuring all operations are performed on the correct vault.

---

 2. Getting the Fabric Context:    The Get-AzRecoveryServicesAsrFabric cmdlet retrieves the replication fabrics for both the Primary (Central India) and Recovery (East US) regions.

$PrimaryFabric = Get-AzRecoveryServicesAsrFabric -Name "asr-a2a-default-centralindia"    $RecoveryFabric = Get-AzRecoveryServicesAsrFabric -Name "asr-a2a-default-eastus"

 * Primary Fabric: Refers to Central India, where the VM is currently protected from.   

• Recovery Fabric: Refers to East US, the region where the VM needs to be reprotected.

---

 3. Getting the Protection Containers:    Protection containers are used to organize and manage replicated VMs. Here, you're retrieving the protection containers for both Central India and East US.

 $PrimaryProtectionContainer = Get-AzRecoveryServicesAsrProtectionContainer -Fabric $PrimaryFabric    $RecoveryProtectionContainer = Get-AzRecoveryServicesAsrProtectionContainer -Fabric $RecoveryFabric

• Primary Protection Container: Represents the source container in Central India.   
• Recovery Protection Container: Represents the target container in East US where you want to re-protect the VM.

 ---

 4. Getting the Replication Policy:    This retrieves the replication policy, which governs how often the VM data is replicated.

 $ReplicationPolicy = Get-AzRecoveryServicesAsrPolicy -Name <policyname>
 

   * The 24-hour-retention-policy is applied to the replication, defining the retention timeframe 

---

 5. Getting Protection Container Mappings:    The mappings define how protection containers in the source and target regions are related.

 

       $PrimaryToRecoveryMapping = Get-AzRecoveryServicesAsrProtectionContainerMapping -ProtectionContainer $PrimaryProtectionContainer -Name centralindia-eastus-24-hour-retention-policy    $RecoveryToPrimaryMapping = Get-AzRecoveryServicesAsrProtectionContainerMapping -ProtectionContainer $RecoveryProtectionContainer -Name eastus-centralindia-24-hour-retention-policy

  * Primary to Recovery Mapping: This mapping handles the transfer from Central India to East US with the 24-hour retention policy.   

• Recovery to Primary Mapping: This maps the East US protection container back to Central India, but you’ll be switching the protection direction.

 ---

 6. Getting the Cache Storage Accounts:    Cache storage accounts are used for replication data.

  $cacheStorage = Get-AzStorageAccount -ResourceGroupName <resouregroupname> -Name <resouregroupname>    $secondaryCacheStorageAccount = Get-AzStorageAccount -ResourceGroupName <resouregroupname> -Name <resouregroupname>

 * These are the primary and secondary storage accounts used for cache. You’ll need these for reprotecting the VM.

 ---

 7. Getting the Replicated Items:    Retrieve the replicated items (VMs) that need to be reprotected.

 $replicatedItems = Get-AzRecoveryServicesAsrReplicationProtectedItem -ProtectionContainer $PrimaryProtectionContainer    $ReplicatedItems | Select Name, ReplicationHealth, ProtectionState, ProviderSpecificDetails

 * This lists the replicated items under the Primary Protection Container (Central India). It also shows important details like replication health, protection state, and provider-specific information for each item.

---

8. Reprotecting the VM:    The key step involves reconfiguring the protection direction. This will update the protection from East US to Central India using the appropriate mapping and cache storage.

 Update-AzRecoveryServicesAsrProtectionDirection -ReplicationProtectedItem $ReplicatedItems -ProtectionContainerMapping $RecoveryToPrimaryMapping -LogStorageAccountId $secondaryCacheStorageAccount.Id -RecoveryResourceGroupID $sourceVMResourcegroup.ResourceId -AzureToAzure

Explanation:

 * -ReplicationProtectedItem: The replicated VM(s) that need to be reprotected.   

• -ProtectionContainerMapping: The mapping that defines the relationship between source and target protection containers.   
• -LogStorageAccountId: Specifies the cache storage account used for logging during replication. * -RecoveryResourceGroupID: The resource group for the source VM that is being protected.    * -AzureToAzure: Indicates this is an Azure-to-Azure replication, meaning it’s migrating or failing over from one region to another.

---

 # Summary of Steps:(Assuming replication from central india to east us)

 

1. Set the vault context to the appropriate Recovery Services Vault (Set-AzRecoveryServicesAsrVaultContext).
2. Retrieve the fabric information for Central India (Primary) and East US (Recovery).
3. Get the protection containers for both regions.
4. Retrieve the replication policy (e.g., 24-hour retention).
5. Get the mappings that define the relationship between source and target protection containers. 6. Retrieve the cache storage accounts needed for replication.
6. Get the replicated items (VMs) to be reprotected.
7. Reprotect the VM by switching the protection direction using the Update-AzRecoveryServicesAsrProtectionDirection cmdlet.

Below is the Artifact: -

let us know if any help, we will always help as you needed.!

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others

Answer 2

Hi @Harshit Z Kothari,

Kindly confirm that the original primary site (on-premises or Azure) is operational and can receive the workloads again.

• Allow time for the data to synchronize from the current site to the original site.
• Monitor the replication health and ensure it’s healthy..

If the primary region is On-premises.

Set the Recovery Services Vault context

$vault = Get-AzRecoveryServicesVault -Name "<vault-name>"

Set-AzRecoveryServicesAsrVaultContext -Vault $vault

Get the replicated item (VM)

$container = Get-AzRecoveryServicesAsrProtectionContainer -FriendlyName "<Azure-Container-Name>"

$vm = Get-AzRecoveryServicesAsrReplicationProtectedItem -ProtectionContainer $container | Where-Object {$_.FriendlyName -eq "<VM-Name>"}

Start reprotection (Azure to On-Prem)

Start-AzRecoveryServicesAsrReprotectJob -ReplicationProtectedItem $vm -Direction "RecoveryToPrimary"

Set the Recovery Services Vault context.

$vault = Get-AzRecoveryServicesVault -Name "<vault-name>"

Set-AzRecoveryServicesAsrVaultContext -Vault $vault

Get the replicated item (VM).

$container = Get-AzRecoveryServicesAsrProtectionContainer -FriendlyName "<Azure-Container-Name>"

$vm = Get-AzRecoveryServicesAsrReplicationProtectedItem -ProtectionContainer $container | Where-Object {$_.FriendlyName -eq "<VM-Name>"}

Start reprotection (Azure to On-Prem).

Start-AzRecoveryServicesAsrReprotectJob -ReplicationProtectedItem $vm -Direction "RecoveryToPrimary"

If the primary region is Azure.

Connect-AzAccount

Set the Recovery Services Vault context

$vault = Get-AzRecoveryServicesVault -Name "<vault-name>"

Set-AzRecoveryServicesAsrVaultContext -Vault $vault

Get the protection container and replicated item

container = Get-AzRecoveryServicesAsrProtectionContainer -FriendlyName "<Secondary-Container-Name>"

$vm = Get-AzRecoveryServicesAsrReplicationProtectedItem -ProtectionContainer $container | Where-Object {$_.FriendlyName -eq "<VM-Name>"}

Start reprotection (Secondary to Primary)

Start-AzRecoveryServicesAsrReprotectJob -ReplicationProtectedItem $vm -Direction "RecoveryToPrimary"