Azure Site Recovery: VM disaster recovery

Load the network IDs, start web01, and give snet-web an outbound path for the mobility service:

$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
$sub = az account show --query id -o tsv
az vm start --resource-group rg-saat-vms --name web01
az network public-ip create --resource-group rg-saat-core --name pip-saat-natgw --sku Standard --location centralindia --tags course=saatvedha-azure lesson=39 -o none
az network nat gateway create --resource-group rg-saat-core --name natgw-saat --public-ip-addresses pip-saat-natgw --idle-timeout 4 --location centralindia --tags course=saatvedha-azure lesson=39 -o none
az network vnet subnet update --ids $v.'snet-web' --nat-gateway natgw-saat -o none

1Build the DR side in South India

A resource group, a DR VNet for real failovers, an isolated VNet for tests, and the vault in the target region:

az group create --name rg-saat-dr --location southindia --tags course=saatvedha-azure lesson=39 -o none
az network vnet create --resource-group rg-saat-dr --name vnet-saat-dr --location southindia --address-prefixes 10.50.0.0/16 --subnet-name snet-web --subnet-prefixes 10.50.1.0/24 -o none
az network vnet create --resource-group rg-saat-dr --name vnet-saat-drtest --location southindia --address-prefixes 10.51.0.0/16 --subnet-name snet-web --subnet-prefixes 10.51.1.0/24 -o none
az backup vault create --resource-group rg-saat-dr --name rsv-saat-dr --location southindia -o none
az resource list --resource-group rg-saat-dr --query "[].{name:name, type:type, location:location}" -o table

You should see something like this:

Name              Type                                  Location
----------------  ------------------------------------  ----------
vnet-saat-dr      Microsoft.Network/virtualNetworks     southindia
vnet-saat-drtest  Microsoft.Network/virtualNetworks     southindia
rsv-saat-dr       Microsoft.RecoveryServices/vaults     southindia

The test VNet isn’t peered or connected to anything. That’s the point: a test copy of web01 must never talk to production.

2Enable replication for web01

In the portal, open web01, then Disaster recovery. Set Target region to South India. On Advanced settings, choose resource group rg-saat-dr, virtual network vnet-saat-dr and subnet snet-web, keep the default cache storage and replication policy, and set the vault to rsv-saat-dr.

Review and start replication.

Check progress from the CLI (initial replication takes 30 to 60 minutes):

az rest --method get --url "https://management.azure.com/subscriptions/$sub/resourceGroups/rg-saat-dr/providers/Microsoft.RecoveryServices/vaults/rsv-saat-dr/replicationProtectedItems?api-version=2023-08-01" --query "value[].{vm:properties.friendlyName, health:properties.replicationHealth, state:properties.protectionStateDescription, testFailover:properties.testFailoverStateDescription}" -o table

When it’s done, you should see something like this:

Vm     Health    State      TestFailover
-----  --------  ---------  --------------
web01  Normal    Protected  None

3Run a test failover

In the vault, open Replicated items, web01, then Test failover. Choose Latest processed (low RTO) and Azure virtual network vnet-saat-drtest. Start it.

ASR creates a VM named web01-test in rg-saat-dr.

When the job finishes, check the copy serves the page:

az vm run-command invoke --resource-group rg-saat-dr --name web01-test --command-id RunShellScript --scripts 'hostname -I; curl -s localhost' --query "value[0].message" -o tsv

You should see something like this:

Enable succeeded: 
[stdout]
10.51.1.4 
<h1>web01</h1>
<p>SaatVedha Azure course, Lesson 15</p>

[stderr]

Same app, a 10.51 address in the isolated test network, in another region. That’s the evidence a DR test is meant to produce.

4Clean up the test failover

In Replicated items, web01, choose Cleanup test failover, write a short note (“Lesson 39 drill passed”), tick Testing is complete, and confirm. ASR deletes web01-test.

az rest --method get --url "https://management.azure.com/subscriptions/$sub/resourceGroups/rg-saat-dr/providers/Microsoft.RecoveryServices/vaults/rsv-saat-dr/replicationProtectedItems?api-version=2023-08-01" --query "value[].{vm:properties.friendlyName, health:properties.replicationHealth, state:properties.protectionStateDescription, testFailover:properties.testFailoverStateDescription}" -o table

You should see something like this:

Vm     Health    State      TestFailover
-----  --------  ---------  --------------
web01  Normal    Protected  None

✅ Checkpoint: web01 replicates to South India, a test failover served the page from the isolated network, and the test was cleaned up.