Configure Azure DR for AWS Resources with vpn

Question

Configure Azure DR for AWS Resources with vpn

Anoop Sabu 20

We need to establish secure Site-to-Site VPN connectivity between our AWS and the Azure DR environment. Once the VPN is operational, we need to configure Azure Site Recovery (ASR).

Alex Burlachenko 18,570 Reputation points Volunteer Moderator

2025-10-31T08:55:30.0233333+00:00

Anoop Sabu you are right, you need that site to site vpn tunnel established before azure site recovery can do its job. asr needs a network path to replicate the data from your aws vms to azure.

build the vpn tunnel. in your aws account, you need to create a virtual private gateway and a customer gateway. the customer gateway will point to the public ip address of your azure vpn gateway.

in azure, you create a virtual network gateway, get its public ip, and then create a local network gateway that points to the aws virtual private gateway's ip. finally, you create a connection between them using a shared pre shared key, just like connecting two physical sites.

this establishes the encrypted tunnel between the two clouds.

set up azure site recovery. now, with the network connected, you can configure asr. in the azure portal, you create a recovery services vault. inside the vault, you set up replication for your aws ec2 instances.

you will need to install the azure site recovery mobility service agent on each of your aws ec2 instances that you want to protect. this agent handles the continuous replication of data from the aws vm to an azure storage account.

when you configure the replication, you will point asr to the private ip addresses of your aws vms, and the traffic will flow securely over the vpn tunnel you built.

a key point. azure site recovery does not manage the vpn connection for you. you are responsible for building and maintaining that network connectivity separately. asr just uses the network path that exists.

this pattern of using a vpn to connect two different clouds for dr is a universal concept. the same principles apply if you were connecting google cloud to azure.

to summ- first, get your network team to build the site to site vpn between aws and azure. then, use azure site recovery to replicate your aws ec2 instances over that private connection.

good luck with your cross cloud dr project

rgds,

Alex

1 answer

Your answer

Answer 1

Hello Anoop Sabu,

It looks like you're trying to set up a secure Site-to-Site VPN between AWS and the Azure disaster recovery environment, and then configure Azure Site Recovery (ASR) for your AWS EC2 instances.

Here's What You Can Do:

Establish the Site-to-Site VPN:

On AWS:

Create a Virtual Private Gateway and a Customer Gateway. The Customer Gateway should point to the public IP address of your Azure VPN Gateway.

On Azure:

Create a Virtual Network Gateway. Note down its public IP.
Set up a Local Network Gateway that points to the AWS Virtual Private Gateway's IP.
Create a connection between them, using a shared pre-shared key (PSK).

This will establish an encrypted tunnel for secure communication.

2.Configure Azure Site Recovery (ASR):

After the VPN connection is active, go to the Azure portal and create a Recovery Services Vault.
Set up replication for your AWS EC2 instances within this vault.
Install the Azure Site Recovery Mobility Service on each EC2 instance that you want to protect. This agent will manage the data replication from AWS to Azure continuously.

3.Networking:

Be aware that ASR does not manage the VPN connection; you're responsible for its resilience.
Make sure to point ASR to the private IP addresses of your AWS VMs during replication setup, ensuring data flows securely through the VPN tunnel.

Getting Started:

Here’s a summarized checklist to help you with your setup:

VPN Configuration:
- AWS: Create Virtual Private Gateway & Customer Gateway.
- Azure: Set up Virtual Network Gateway & Local Network Gateway.
Connect: Establish the VPN connection with the shared PSK.
ASR Configuration:
- Create Recovery Services Vault in Azure.
- Install Mobility Service Agent on EC2 instances.
- Set up replication for the EC2 instances.

Key Point:

You must ensure that the AWS VMs are correctly targeting the right IP addresses over the VPN for ASR to function correctly. If you encounter any connectivity issues, refer to the documentation on networking for troubleshooting.

Reference Documents:

Backup and data recovery for Azure Stack with the Infrastructure Backup Service

Azure Site Recovery: Backup and restore virtual machines

Configure disaster recovery setup for multiple Azure resources

Migrate AWS VMs to Azure

Hope this helps! If you have more questions or run into issues, feel free to reach out.

Share via

Configure Azure DR for AWS Resources with vpn

1 answer

Your answer