Understanding Firewall / DNS policies when failing over to Dr Site?

Is your firewall physical or virtual?  If virtual you could fail that over and make the changes. If physical then additional changes need to be made as those cannot be part of a failover plan.  However if DNS points to the correct IPs then things "technically" should work after failover but tweaking may be needed.

That is subjective and how you want the traffic to be routed.  To me I would replicate the FW policies on the DR side so in the event of a failover requirement you have everything ready to go.

Hi,

There are many ways to achieve this with pro’s and con’s and designs for different scenarios. For example:

Instead of Re-IP you could stretch your subnet between sites, as you’ve got a VPN instead of direct fibre between sites I wouldn’t do this, but you could instead also have the same subnet available at the DR site, with conditional routing decisions based on the availability of other devices, such as whether the primary datacentre’s firewall is available.

If you did re-IP you could utilise load balancers for some services and create a priority order for services to be targeted at their primary or DR IP addresses, then your load balancer looks at the health of the servers based on their IP address availability and routes wherever it needs to go.

Do you own your own public IP addresses? If so for the public facing IP address elements of failover you could leverage BGP and avoid public IP failovers and updates that have to be done when your IP address is ISP/internet circuit specific.

Some services you could just give a priority order to such as PBX and Mail servers where you just set a priority but have primary and DR IP address or DNS records for. For example with email you’d have 2x MX records in your public DNS, and set one to your primary site’s IP address for email delivery and a second, lesser priority to a DR entry. Traffic can only be delivered when a server is answering on that service anyway so that handles failover gracefully then. Same with a PBX you could instruct your SIP provider that if they can’t reach you on a production IP address that they can reach you on the DR Public IP address.

You can even consume services such as Azure Traffic Manager to utilise specific health metrics to determine if DNS should aim at production or DR sites.

There ultimately isn’t that much that Veeam needs to do in a DR with regards to networking but we’re happy to help with considerations for your design 🙂

That is subjective and based on what your requirements are.  Either will work with Veeam.

Thanks @MicoolPaul 

At the data center we have 1.5G / 1.5G WAN 

At the DR site we have the same 1.5G / 1.5G

I plan to replicate about 30vms daily over to the DR SITE.  Most of the VMS are small around 150G some are 500Gig each.  

We have Fortinet 200Fs at both sides as well.

I am leaning toward SD-WAN between them rather than a VPN tunnel.

Hi @J55marshall -

I just wanted to follow up on your post and see if any of the comments provided here helped answer your DR-side failover question? If so, we ask you select one of the comments as ‘Best Answer’ to benefit others who may come across your post with a similar query. If you still have questions, please don’t hesitate to ask and we can try to assist as best we can.

Thank you.