More Related Content
Similar to Azure BCDR in Action: From Setup to Failover and Back
Azure BCDR in Action: From Setup to Failover and Back
- 1. Azure BCDR inAction From Setup to Failover and Back Yung Chou Cloud Solution Architect US West
- 2. References • Microsoft CloudWorkshop • Building a resilient IaaS architecture • Selected Readings • Multi-tier web application built for HA/DR • Tutorial: AG in multiple subnets - SQL Server on Azure VMs • Azure Application Architecture Fundamentals • Microsoft Azure Well-Architected Framework • Security documentation • General questions about the Azure Site Recovery service 2 3/17/2023
- 3. Agenda • The app •Architecture and Deployment • SQL AlwaysOn • DR Approach • DR Settings • SQL Back End • Automation and DR Plan • IIS Front End • Failover Test This delivery covers most of Exercise 2 and beyond of the workshop. 3/17/2023 3
- 4. 3/17/2023 4 The followingslides are: • Taken from multiple deployments of the workshop • Intended as additional information to facilitate your workshop deployment by providing a reference for the context and expected results These slides are: • NOT for replacing the workshop instructions • With most values if referenced along with the workshop instructions on relevant exercises and tasks Notice while the slides taken from deployments may show resource names inconsistent from one section to another, the process flows with expected resource states remain correctly depicted.
- 5.
- 6. West US3 EastUS ContosoWebLBPrimary ContosoWebLBSecondary Contoso Front Door Contoso Insurance App • Front Door pointing to Contoso origin • External LB • HTTP only on port 80 • Source and DR sites • Front Door routes • Web/IIS Tier • Zone redundancy • Backup with CRR • Internal LB • Port 1443 from IIS Tier only • Source and DR sites • Data/SQL Tier • Three-node failover cluster • Cloud Witness • Zone redundancy • AlewaysOn with listener on 1443 • One vnet with a DC in each zone • Vnet peering between westus3 and eastus • RSV • Backup RSV in westus3 • Site Recovery RSV in eastus 3/17/2023 9
- 7. Disaster Recovery Approach 10 TierDR Strategy Web Failover using Azure Site Recovery SQL Secondary SQL AlwaysOn Availability Group replica with asynchronous replication. Failover steps are integrated into Azure Site Recovery using Azure Automation. AD Active-active domain controllers 3/17/2023
- 8. Create a CloudWitness for SQL Failover Cluster 11 3/17/2023
- 9. Add SQLVMs toLoad Balancer Backend Pool 12 3/17/2023
- 10. Create a SQLFailover Cluster (in SQLVM1) New-Cluster -Name AOGCLUSTER -Node SQLVM1,SQLVM2 -StaticAddress 10.0.2.99 13 3/17/2023
- 11.
- 12.
- 13. Enable SQLVM1 AlwaysOnfor High Availability 16 3/17/2023
- 14.
- 15. Enable SQLVM2 AlwaysOnfor High Availability 19 3/17/2023
- 16. Configure SQL AlwaysOn(with SQLVM1) 21 3/17/2023
- 17.
- 18.
- 19.
- 20.
- 21.
- 22. Add WebVMs toLoad Balancer Backend Pool 27 3/17/2023
- 23.
- 24.
- 25.
- 26.
- 27. Contoso Insurance App •External LB • HTTP only on port 80 only • Web/IIS Tier • Zone redundancy • Internal LB • Port 1443 from IIS Tier only • Data/SQL Tier • Two-node failover cluster • Cloud Witness • Zone redundancy • AlewaysOn with listener on 1443 • One vnet with one DC in each zone HTTP Requests 3/17/2023 34
- 28. Contoso Insurance AppDeployment Highlights • Contoso.ins • Source in westus3 • contoso-vnet-westus3 • Contoso.ins.DR-Site • DR site in eastus • contoso-vnet-eastus • Contoso.ins.RSV • Backup: contoso-RSV-westus3 • IIS1, IIS2, SQL1 and SQL2 backup • DR: contoso-RSV-eastus • Automation account • Failover runbooks 3/17/2023 35
- 29.
- 30.
- 31.
- 32.
- 33.
- 34.
- 35.
- 36.
- 37.
- 38. Create An Automation(RunAs) Account for Executing DR Runbooks 45 3/17/2023
- 39. DR Runbooks 46 MCW-Building-a-resilient-IaaS-architecture/studentfiles.zip atmaster · benstegink/MCW-Building-a-resilient-IaaS-architecture (github.com) 3/17/2023
- 40. Import SQL DRRunbooks 47 3/17/2023
- 41.
- 42.
- 43. Import Web DRRunbook 50 3/17/2023
- 44.
- 45. 3/17/2023 52 Repeat thesteps to import and published both runbooks.
- 46. Add Automation Variables { "PrimarySiteRG":"contoso-insurance-w3", "PrimarySiteSQLVM1Name": "SQLVM1", "PrimarySiteSQLVM2Name": "SQLVM2", "PrimarySiteSQLPath": "SQLSERVER:SqlSQLVM1DEFAULTAvailabilityGroupssqlAO", "PrimarySiteVNetName": "contoso-insurance-hub-w3", "PrimarySiteWebSubnetName": "Apps", "PrimarySiteWebLBName": "ContosoWebLBPrimary", "SecondarySiteRG": "contoso-insurance-east", "SecondarySiteSQLVMName": "SQLVM3", "SecondarySiteSQLPath": "SQLSERVER:SqlSQLVM3DEFAULTAvailabilityGroupssqlAO", "SecondarySiteVNetName": "contoso-spoke-east", "SecondarySiteWebSubnetName": "Apps", "SecondarySiteWebLBName": "ContosoWebLBSecondary" } 53 3/17/2023
- 47.
- 48. Extend the SQLAlwaysOn Created Earlier to include SQLVM3 to the Always On group as an asynchronous replica 1. In Azure portal, add SQLVM3 to the load-balancer backend pool in the DR site. 2. In SQLVM1, add SQLVM3 to the existing Windows Server Failover Cluster. 3. In SQLVM3, 3nable AlwaysOn and set the domain login credentials. 4. In SQLVM1, • update the Availability Group Listener to include the SQLVM3 IP address, • add SQLVM3 as an asynchronous replica in the existing Always On Availability Group. 5. In SQLVM1, run PowerShell script to update the failover cluster with the Listener IP addresses. 55 3/17/2023
- 49. Add SQLVM3 toDR SQL LB Back End Pool 56 3/17/2023
- 50. Add SQLVM3 tothe Failover Cluster • Restart ADs as needed to ensure DNS entries are current • RDP into SQLVM1 and Add-ClusterNode -Name SQLVM3 58 3/17/2023
- 51. Enable SQL AlwaysOnof SQLVM3 60 3/17/2023
- 52. Back to SQLVM1to Add SQLVM3 as a Replica 61 3/17/2023
- 53.
- 54.
- 55.
- 56. Create Backup andDR Recovery Services Vaults 3/17/2023 68
- 57.
- 58.
- 59.
- 60.
- 61.
- 62.
- 63.
- 64.
- 65.
- 66.
- 67.
- 68.
- 69.
- 70.
- 71.
- 72.
- 73.
- 74.
- 75.
- 76.
- 77.
- 78.
- 79.
- 80.
- 81.
- 82.
- 83.
- 84.
- 85.
- 86.
- 87.
- 88.
- 89.
- 90.
- 91.
- 92.
- 93.
- 94.
- 95.
- 96.
- 97.
- 98.
- 99.
- 100.
- 101.
- 102.
- 103.
- 104.
- 105.
- 106.
- 107.
- 108.
- 109.
- 110.
- 111.
- 112.
- 113.
- 114.
- 115.
- 116.
- 117.
- 118.
- 119.
- 120.
- 121.
- 122.
- 123.
- 124.
- 125.
- 126.
- 127.
- 128.
- 129.
- 130.
- 131.
- 132.
- 133.
- 134.
- 135.
- 136.
- 137.
- 138.
- 139.
- 140.
- 141.
- 142.
- 143.
- 144.
- 145.
- 146.
- 147.
- 148.
- 149.
- 150.
- 151.
- 152.
- 153.
- 154.
- 155.
- 156.
- 157.
- 158.
- 159.
- 160. Step Description DocumentationReference Test Test the ASR configuration routinely and often for failing over from source site to DR one to ensure it works as expected Run a test failover (disaster recovery drill) to ASR Failover Initiate failover to switch over to the replicated environment for DR or planned maintenance About failover and failback in ASR - Modernized - ASR Commit Commit the changes made during the failover process to the replicated environment to ensure it's up-to-date Run a failover during disaster recovery with ASR Re-protect Re-protect the production environment to ensure it's ready for the next failover Reprotect Azure VMs to the primary region with ASR Re-test Re-test the ASR configuration to ensure it works as expected after re-protecting Fall back Fall back to the production environment if the failover was initiated for planned maintenance or testing Re-commit Re-commit the changes made during the failover process to the production environment to ensure it's up-to-date Re-protect Re-protect the replicated environment to ensure it's ready for the next failover after falling back Failover/Failback Routine 3/17/2023 174
Editor's Notes
- #2 In my experience, many companies viewed implementing Business Continuity and Disaster Recovery (BCDR) as too technically complex and financially unfeasible, resulting in it becoming more of an academic exercise than an attainable, predictable, measurable, and verifiable business process. With Azure Recovery Services, I have found this perception no longer accurate. I used the Microsoft Cloud Workshop to showcase Azure BCDR with step-by-step guidance to Configure a DR plan for a database app in Azure West US 3 region Drill/rehearse the plan to failover the app to Azure East US region is a DR scenario Execute a failover to mimic conducting a DR episode Commit the failover upon verifying the plan executed with expected results Later Follow a series of steps for reversing and falling back the app to its original region, West US 3 Reenable the protection, i.e., DR pan, and ensure readiness for future DR needs The slide deck includes screen captures of relevant processes and resource settings, serves as a reference for context and expected results. While the deck is not intended to replace the workshop instructions and despite inconsistent resource names in some sections, the process flows with expected resource states are accurately depicted. One may find it handy for realizing the how and what of executing the workshop exercises and tasks.
- #6 Upon deployed the application, ContosoWebLBPrimaryIP has the public IP and the DNS name of the app. The landing page here is slightly different from that provided by the workshop.
- #7 Policy page
- #8 Customer info page
- #9 Policy Holder page
- #10 The presented demo infrastructure is not necessarily a recommendation. For instance, instead of internal LB, another option may be https://learn.microsoft.com/en-us/azure/architecture/example-scenario/infrastructure/multi-tier-app-disaster-recovery
- #11 Enable Disaster Recovery for the Contoso application https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#exercise-2-enable-disaster-recovery-for-the-contoso-application
- #12 Configure HA for the SQL Server tier https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-3-configure-ha-for-the-sql-server-tier
- #13 https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-3-configure-ha-for-the-sql-server-tier
- #14 https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-3-configure-ha-for-the-sql-server-tier BCDR DEMO GITHUB REPO https://github.com/Microsoft/MCW-Building-A-Resilient-IaaS-Architecture Suggest using: westus3 and eastus New-Cluster -Name AOGCLUSTER -Node SQLVM1,SQLVM2 -StaticAddress 10.0.2.99
- #23 Select the Subnet of 10.0.2.0/24 and then add IPv4 10.0.2.100 and select OK. This is the IP address of the Internal Load Balancer that is in front of the SQLVM1 and SQLVM2 in the Data subnet running in the Primary Site.
- #25 SQLAlwaysOn
- #26 10.0.2.100
- #36 The automation account and associated runbooks can be placed in any region other than the source/primary region, as in DR the source/primary region is expected experiencing an outage.
- #41 Bastion host names are difference due to an unplanned redeployment on Bastion in westus3.
- #46 Location: Any region that support automation except for your primary region.
- #53 Repeat the steps to import and published both runbooks.
- #56 Configure DR for the SQL Server tier https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-3-configure-dr-for-the-sql-server-tier
- #58 Add-ClusterNode -Name SQLVM3
- #67 Enable Disaster Recovery for the Contoso application https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#exercise-2-enable-disaster-recovery-for-the-contoso-application
- #70 https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-4-configure-dr-for-the-web-tier
- #91 Exercise 3: Enable Backup for the Contoso application https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#exercise-3-enable-backup-for-the-contoso-application
- #100 Task 3: Enable Backup for the SQL Server tier https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-3-enable-backup-for-the-sql-server-tier AS NEEDED Register-AzResourceProvider -ProviderNamespace Microsoft.SqlVirtualMachine New-AzSqlVM -Name ‘ci-sql1' -ResourceGroupName ‘ci-w3' -SqlManagementType Full -Location ‘westus3' -LicenseType PAYG New-AzSqlVM -Name ‘ci-sql2' -ResourceGroupName ‘ci-w3' -SqlManagementType Full -Location ‘westus3' -LicenseType PAYG New-AzSqlVM -Name ‘ci-sql3' -ResourceGroupName ‘ci-eus' -SqlManagementType Full -Location ‘eastus' -LicenseType PAYG
- #113 Task 5: Configure a public endpoint using Azure Front Door https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-5-configure-a-public-endpoint-using-azure-front-door
- #138 Task 2: Validate Disaster Recovery - Failover IaaS region to region https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-2-validate-disaster-recovery---failover-iaas-region-to-region
- #148 Task 2: Validate Disaster Recovery - Failover IaaS region to region https://github.com/microsoft/MCW-Building-a-resilient-IaaS-architecture/blob/master/Hands-on%20lab/HOL%20step-by%20step%20-%20Building%20a%20resilient%20IaaS%20architecture.md#task-2-validate-disaster-recovery---failover-iaas-region-to-region