Azure site recovery without proxy.

Question

So I am planning to Configure ASR but my requirements are below

1. I do not want data replication to go over internet, hence I will use Expressroute combined with private endpoints on storage and ASR vault.
2. I do not want to use proxy for communication between Configuration server and Azure API( storage account *blobs.microsoft.com). Can I use Microsoft Peering ?. Or what is other way around

Is this possible ? How do config server communicates with public websites of Storage account for handshake if proxy is not there ?

Thanks

Answer 1

I am posting this as answer as the answer given by Sadiq is not "completely" true.

1. If you are using Express route and private endpoint and keeping PS/CS server on-premises YOU WILL NEED PROXY, unless you have direct internet connection from your machine to Azure which is highly unlikely.
2. If you dont want to use proxy keep PS/CS server in Azure. Make sure you have connectivity from on-premises to Azure.

Rest all is covered in MS Books online.

Answer 2

@Shashank Singh - You can use private endpoints for both storage and for the Recovery Services Vault. That way you can use the private peering path in Express-route for everything.

If you enable private endpoints on both the storage and the vault, then all traffic is routed across the private peering path of the Express-route circuit to a private IP address created by the private endpoint. Private endpoints allow you to create a private IP address within an Azure VNet that allows you to connect to Azure PaaS objects across private network IPs.

It is very basic and missing some components (like DNS) – but in the graphic below. The left side box is the on-premises network at 10.0.0.0/16 with an Express-route connection in place and only the private peering path enabled. It is connected to an Azure VNet and 10.2.0.0/16 with a subnet defined as 10.2.1.0/16. Private endpoint connections for each of the Vault and a storage account allow for each of those services to be assigned an IP address in the 10.2.1.x/24 range. So now the storage account and the recovery services vault only need a path from the 10.0.0.0/16 network on-premises to the 10.2.0.0/16 VNet in Azure, which should exist by default in the BGP routes built in to Express-route. No proxy is needed because you are connecting to private address – not public ones.

----------------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it

Answer 3

@Shashank Singh I believe this statement in bold needs to be taken in context of preceding and following statements in the doc.

In essence, CS needs to have connectivity to ASR endpoints.
In case of non-PE vaults, this means CS needs access to ASR public endpoints - https://learn.microsoft.com/en-us/azure/site-recovery/vmware-azure-deploy-configuration-server#network-requirements
In case of PE vaults, CS needs access to ASR private endpoints. An exception is required for AAD where access needs to be provided via internet Enable replication for on-premises machines with private endpoints - Azure Site Recovery | Microsoft Learn

In both cases, ExpressRoute is allowed – for non-PE vaults only ExpressRoute with MS Peering or Public peering(deprecated) is allowed. For PE vaults additionally Private peering is also allowed.
In both cases, actual connectivity is subjective to customer topology and access to ER directly or via proxy needs to be configured on a case basis.

----------------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it