Azure Site Recovery orchestrates and manages disaster recovery for Azure VMs in Azure Cloud, and on-premises VMs in VMware, System Center VMM and physical servers.
Prerequisites:
- VMware Virtual Server
- Azure Subscription
- Azure Virtual Network
- ExpressRoute between On-premises to Azure Network
- Permit communication between Azure VMs to Azure Site Recovery Virtual Network
- Appropriate Azure Storage Network
- Administrative Credentials in Azure Cloud
- Administrative Credentials in On-premises Network inclusive VMware Virtual Infrastructure
- The Mobility service must be installed on each VM you want to replicate. Site Recovery installs this service automatically when you enable replication for the VM
- Set up an isolated virtual network for the test failover
Supported VMware Environment:
| Component | Requirement |
| vCenter server | Version 5.5 or later |
| vSphere host | Version 5.5 or later |
Supported VMs
| VM Requirement | Details |
| OS disk size | Up to 2TB |
| OS disk count | 1 |
| Data disk count | 64 or less |
| Data disk VHD size | Up to 4TB |
| Network adapters | Multiple adapters are supported |
| Shared VHD | Not supported |
| FC disk | Not supported |
| Hard disk format | VHD or VHDX.
Azure Site Recovery automatically converts VHDX to VHD when you fail over to Azure. When you fail back to on-premises VMs continue to use the VHDX format. |
| Bit-locker | Not supported. Disable before you enable replication for a VM. |
| VM name | Between 1 and 63 characters. Restricted to letters, numbers, and hyphens. The VM name must start and end with a letter or number. |
| VM type | Generation 1 – Linux or Windows Generation 2 – Windows only |
Site Recovery Scenario:
- Fail over from the on-premises site to Azure Site
- Reprotect the Azure VMs, so that they start replicating back to the on-premises VMware VMs.
- Fail back from Azure Site to On-prem Site.
- After data has failed back, re-protect the on-premises VMs that you failed back to, so that they start replicating back to Azure site.
Configuring Azure Site Recovery for the On-prem VMware Vcenter
Step1: Storage Account in Azure
- Sign into the Azure portal using Global Admin, Click Menu, click New>Storage>Storage account>Add to create a new Storage Account.
- Enter a name for your storage account. For these tutorials, I am going to use the name OnPremtoAzureSA01
- Select the below properties
- Deployment model: Resource Manager
- Account Kind: General Purpose
- Performance: Standard
- Replication: RA-GRS
- For replication, you have four options to choose from Locally redundant storage (LRS), Zone-redundant storage (ZRS), Geo-redundant storage (GRS), Read-access geo-redundant storage (RA-GRS)
- Select the subscription in which you want to create the new storage account. For example, your EA or PAYG Account
- Specify a new resource group. An Azure resource group is a logical container into which Azure resources are deployed and managed. For example: CorpRG
- Select the geographic location for your storage account. The storage account must be in the same region as the Recovery Services vault. For these tutorials we use the location Australia East.
- Click Create
Step2: Create a vault.
- In the Azure portal menu, click New > Monitoring & Management > Backup and Site Recovery.
- In Name, specify a friendly name to identify the vault. For example CorpVault.
- Select the existing resource group named CorpRG.
- Specify the Azure region Australia East.
- Click Create
Step3: Create an On-premises Service Account for VMware Environment
- In the Active Directory Users and Computers, Create a Service Account Named , SVC-AzureSR
- Assign permission in the vCenter to the Data Center level and propagate to all
- Windows Local Admin Permissions: Make the service account SVC-AzureSR a Member Off Domain Admins or Local Admin Security Group on the VMs where Azure Mobility Services Software will be installed.
- Linux Admin Permission: Prepare a root account on the source Linux server which will be used to install Azure Mobility Services Software
- VMware vCenter Permissions are:
| Object | Permission |
| Data Center object | Propagate to Child Object |
| Datastore | Allocate space, browse datastore, low-level file operations, remove file, update virtual machine files |
| Network | Network assign |
| Resource | Assign VM to resource pool, migrate powered off VM, migrate powered on VM |
| Tasks | Create task, update task |
| Virtual machine | Configuration,
answer question, device connection, configure CD media, configure floppy media, power off, power on, VMware tools install Create, register, unregister Allow virtual machine download, allow virtual machine files upload Remove snapshots |
Step4: Configure Windows Firewall and IP Based Firewall
- Create a Group Policy or amend an existing Group Policy to allow RDP for all profiles i.e. Domain, Private and Public
- Allow Windows Firewall>Allowed apps and features for Domain and Private
- Be sure to allow IP address ranges for the Azure region of your subscription. Any IP address-based firewall rules should allow communication between On-prem infrastructure to Azure Datacenter IP Ranges, and ports 443 (HTTPS) and 9443 (data replication). You have to allow these IP ranges in your on-prem firewall for example Cisco ASA and Cloud Firewall such as Azure NSG.
Step5: Setup SAN Policy in Diskpart MS KB
- Log on to the VM which will be protected by Azure Site Recovery, Open Command Prompt as an Admin
- Type DiskPart then type SAN
- It will show SAN Policy : Online All
· If not then type SAN POLICY=ONLINEALL
2. On the on-premises machine before failover, check that the Secure Shell service is set to start automatically on system boot. Check that firewall rules allow an SSH connection3. On the Azure VM after failover, check Boot diagnostics to view a screenshot of the VM if you can’t connect.
Step6: Setup Azure Site Recovery Component in an On-premises Server
- Create a Windows Server 2012 R2 VM in VMware vCenter comprised of 8 vCPU, 12GB vRAM, 1 OS Disk, 1 600GB Cache Data Disk, 1 600GB retention disk and 1 VMXNET3 NIC with Static IP
- Allow port 443, 9443 for this VMs if you maintain internal firewall and Azure virtual network NSG. This VM must Access *.Windows.Net, *. windowsazure.com, time.nist.gov , time.windows.com
- Make this VM has access to internet and browse Azure Cloud storage account.
- Assign a static IP address
- Join the Computer to the domain
Step7: Download the Site Recovery Unified Setup
- Open the Azure portal and click on All resources.
- Click on the Recovery Service vault named ContosoVMVault.
- Click Site Recovery > Prepare Infrastructure > Protection goal.
- Select On-premises for where your machines are located, To Azure for where you want to replicate your machines, and Yes, with VMware vSphere Hypervisor. Then, click OK.
- In the Prepare source pane, click +Configuration server.
- In Add Server, check that Configuration Server appears in Server type.
- Download the Site Recovery Unified Setup installation file.
- Download the vault registration key. You need this when you run Unified Setup. The key is valid for five days after you generate it.
Step8: Run and Configure Site Recovery Unified
- Run the Unified Setup installation file.
- In Before You Begin, select Install the configuration server and process server then click Next.
- In Third Party Software License, click I Accept to download and install MySQL, then click Next.
- In Registration, select the registration key you downloaded from the vault.
- In Internet Settings, specify how the Provider running on the configuration server connects to Azure Site Recovery over the Internet. If you have an internet proxy server, provide the proxy details here.
- In Prerequisites Check, Setup runs a check to make sure that installation can run. If a warning appears about the Global time sync check, verify that the time on the system clock (Date and Time settings) is the same as the time zone.
- In MySQL Configuration, create credentials for logging on to the MySQL server instance that is installed.
- In Environment Details, select Yes to protect VMware VMs. Setup checks that PowerCLI 6.0 is installed.
- In Install Location, select where you want to install the binaries and store the cache. The drive you select must have at least 5 GB of disk space available, but we recommend a cache drive with at least 600 GB of free space.
- In Network Selection, specify the listener (network adapter and SSL port) on which the configuration server sends and receives replication data. Port 9443 is the default port used for sending and receiving replication traffic, but you can modify this port number to suit your environment’s requirements. We also open port 443, which is used to orchestrate replication operations. Do not use port 443 for sending or receiving replication traffic.
- In Summary, review the information and click Install. Setup installs the configuration server and registers with it the Azure Site Recovery service.
- When installation finishes, a passphrase is generated. You will need this when you enable replication, so copy it and keep it in a secure location. The server is displayed on the Settings > Servers pane in the vault.
- On your configuration server, launch exe. It is available as a shortcut on the desktop and located in the install location\home\svsystems\bin folder.
- Click Manage Accounts > Add Account.
- In Account Details, add the account that will be used for automatic discovery.
Step9: Add vCenter Server to Azure Site Recovery Vault
- Open the Azure portal and click on All resources.
- Click on the Recovery Service vault named ContosoVMVault.
- Click Site Recovery > Prepare Infrastructure > Source
- Select +vCenter to connect to a vCenter server or vSphere ESXi host.
- In Add vCenter, specify a friendly name for the server. Then, specify the IP address or FQDN.
- Leave the port set to 443, unless your VMware servers listen for requests on a different port.
- Select the account SVC-AzureSR to use for connecting to the server. Click OK.
- Seat back and relax for Azure Site Recovery to discover VMs.
Step10: Select and verify target resources.
- Click Prepare infrastructure > Target, and select the Azure subscription you want to use.
- Specify whether your target deployment model is Resource Manager-based, or classic.
- Site Recovery checks that you have one or more compatible Azure storage accounts and networks.
Step11: Create a replication policy
- Open the Azure portal and click on All resources.
- Click on the Recovery Service vault named CorpVault.
- To create a replication policy, click Site Recovery infrastructure > Replication Policies > +Replication Policy.
- In Create replication policy, specify a policy name VMwareRepPolicy.
- In RPO threshold, use the default of 60 minutes. This value defines how often recovery points are created. An alert is generated if continuous replication exceeds this limit.
- In Recovery point retention, use the default of 24 hours for how long the retention window is for each recovery point. For this tutorial we select 72 hours. Replicated VMs can be recovered to any point in a window.
- In App-consistent snapshot frequency, use the default of 60 minutes for the frequency that application-consistent snapshots are created. Click OK to create the policy.
- The policy is automatically associated with the configuration server. By default, a matching policy is automatically created for failback.
Step12: Enable replication as follows:
- Click Replicate application > Source.
- In Source, select the configuration server.
- In Machine type, select Virtual Machines.
- In vCenter/vSphere Hypervisor, select the vCenter server that manages the vSphere host, or select the host.
- Select the process server (configuration server). Then click OK.
- In Target, select the subscription and the resource group in which you want to create the failed over VMs. Choose the deployment model that you want to use in Azure (classic or resource management), for the failed over VMs.
- Select the Azure storage account you want to use for replicating data.
- Select the Azure network and subnet to which Azure VMs will connect, when they’re created after failover.
- Select Configure now for selected machines, to apply the network setting to all machines you select for protection. Select Configure later to select the Azure network per machine.
- In Virtual Machines > Select virtual machines, click and select each machine you want to replicate. You can only select machines for which replication can be enabled. Then click OK.
- In Properties > Configure properties, select the account that will be used by the process server to automatically install the Mobility service on the machine.
- In Replication settings > Configure replication settings, verify that the correct replication policy is selected.
- Click Enable Replication. You can track progress of the Enable Protection job in Settings > Jobs > Site Recovery Jobs.
Step13: Verify VM Properties
- In Protected Items, click Replicated Items > VM.
- In the Replicated item pane, there’s a summary of VM information, health status, and the latest available recovery points. Click Properties to view more details.
- In Compute and Network, you can modify the Azure name, resource group, target size, availability set, and managed disk settings
- You can view and modify network settings, including the network/subnet in which the Azure VM will be located after failover, and the IP address that will be assigned to it.
- In Disks, you can see information about the operating system and data disks on the VM.
Step14: Disaster Recovery Drill or Testing a DR
- In Settings > Replicated Items, click the VM > +Test Failover.
- Select a recovery point to use for the failover:
- Latest processed : Fails the VM over to the latest recovery point that was processed by Site Recovery. The time stamp is shown. With this option, no time is spent processing data, so it provides a low RTO (recovery time objective).
- Latest app-consistent: This option fails over all VMs to the latest app-consistent recovery point. The time stamp is shown.
- Custom: Select any recovery point.
- In Test Failover, select the target Azure network to which Azure VMs will be connected after failover occurs.
- Click OK to begin the failover. You can track progress by clicking on the VM to open its properties. Or you can click the Test Failover job in vault name > Settings > Jobs > Site Recovery jobs.
- After the failover finishes, the replica Azure VM appears in the Azure portal > Virtual Machines. Check that the VM is the appropriate size, that it’s connected to the right network, and that it’s running.
- You should now be able to connect to the replicated VM in Azure.
- To delete Azure VMs created during the test failover, click Cleanup test failover on the recovery plan.
Step15: Understanding and Preparing for failover and failback
Objective 1: Run a failover to Azure
- In Settings > Replicated items click the VM > Failover.
- In Failover select a Recovery Point to fail over to. You can use one of the following options:
-
- Latest (default): This option first processes all the data sent to Site Recovery. It provides the lowest RPO (Recovery Point Objective) because the Azure VM created after failover has all the data that was replicated to Site Recovery when the failover was triggered.
- Latest processed: This option fails over the VM to the latest recovery point processed by Site Recovery. This option provides a low RTO (Recovery Time Objective), because no time is spent processing unprocessed data.
- Latest app-consistent: This option fails over the VM to the latest app-consistent recovery point processed by Site Recovery.
- Custom: Specify a recovery point.
- Select Shut down machine before beginning failover to attempt to do a shutdown of source virtual machines before triggering the failover. Failover continues even if shutdown fails. You can follow the failover progress on the Jobs
- If you prepared to connect to the Azure VM, connect to validate it after the failover.
- After you verify, Commit the failover. This deletes all the available recovery points.
- Don’t Cancel the Task. Seat back, relax, take a coffee break. If you cancel a failover in progress, failover stops, but the VM won’t replicate again.
Objective2: Re-protect Azure VMs
Note: This procedure presumes that the on-premises VM isn’t available and you’re re-protecting to an alternate location.
- In Settings > Replicated items, right-click the VM that was failed over and Re-Protect.
- In Re-protect, verify that Azure to On-premises, is selected.
- Specify the on-premises master target server, and the process server.
- In Datastore, select the master target datastore to which you want to recover the disks on-premises. Use this option when the on-premises VM has been deleted, and you need to create new disks. This settings is ignored if the disks already exist, but you do need to specify a value.
- Select the master target retention drive. The failback policy is automatically selected.
- Click OK to begin re-protection. A job begins to replicate the virtual machine from Azure to the on-premises site. You can track the progress on the Jobs tab.
Objective3: Run a failover from Azure to on-premises
Note: To replicate back to on-premises, a failback policy is used. This policy is automatically created when you created a replication policy for replication to Azure:
- On the Replicated Items page, right-click the machine > Unplanned Failover.
- In Confirm Failover, verify that the failover direction is from Azure.
- Select the recovery point that you want to use for the failover. An app-consistent recovery point occurs before the most recent point in time, and it will cause some data loss. When failover runs, Site Recovery shuts down the Azure VMs, and boots up the on-premises VM. There will be some downtime, so choose an appropriate time.
- Right-click the machine, and click Commit. This triggers a job that removes the Azure VMs.
- Verify that Azure VMs have been shut down as expected.
Objective4: Re-protect on-premises machines to Azure
Note: Data should now be back on your on-premise site, but it isn’t replicating to Azure. You can start replicating to Azure again as follows:
- In the vault > Settings >Replicated Items, select the failed back VMs that have failed back, and click Re-Protect.
- Select the process server that is used to send the replicated data to Azure, and click OK.
