Deploy Forest Recovery to customer-provided Azure resources
This article walks through an end-to-end deployment of a Forest Recovery site into Azure resources that you create and govern. It applies to Cayosoft Guardian 7.4 and later.
Use this scenario when your organization requires the recovery site to run in customer-managed resources, or when backup data must reach Azure Storage over a private endpoint instead of a public endpoint.
If you have no such constraints, use the default scenario instead, in which Cayosoft Guardian creates every resource. See Manage cloud recovery sites.
What each side creates
| Created by you | Created by Cayosoft Guardian |
|---|---|
| Resource group | Virtual machines |
| Virtual network and subnet | Network interfaces |
| Storage account (staging storage) | Disks |
| Azure Relay namespace | Hybrid connection inside your Relay namespace |
| Private endpoints and DNS records (optional) | Blobs inside your staging storage account |
| Network security group (optional) | — |
Cayosoft Guardian does not change the configuration of the resources that you supply. It only creates blobs in the staging storage account and a hybrid connection in the Azure Relay namespace.
Prerequisites
- Cayosoft Guardian 7.4 or later, with a license that includes Forest Recovery.
- An Azure subscription added under Forest Recovery > Cloud Services.
- A service principal with the roles listed in Permissions for Forest Recovery in Cayosoft Guardian.
- A configured forest recovery plan. See Forest Recovery: Create, configure, verify and run forest recovery plan.
NOTE Recovery plans created in Cayosoft Guardian 7.3 or earlier keep their existing templates and temporary blob storage. Create a new recovery plan to use precreated resources. No upgrade procedure is required for existing plans, including 7.3 plans that already use a customer-provided virtual network.
Step 1: Create the resource group
Create a resource group in the same subscription that you added under Cloud Services. It holds your precreated resources and the recovery site virtual machines that Cayosoft Guardian creates.
Step 2: Create the virtual network
Create a virtual network and subnet in the resource group. The virtual network must be in the same Azure region and subscription as the recovery site.
- Make sure the network provides the isolation from the source forest that forest recovery requires.
- Enable any required service endpoints, such as
Microsoft.Storage. - If you attach a network security group, allow the WinRM and agent ports listed in Planning and preparation: Required ports for Cayosoft Guardian. Cayosoft Guardian does not add rules to your network security group.
Step 3: Create the staging storage account
Create an Azure Blob Storage account in the resource group. Cayosoft Guardian uses it to stage agent installers and backup data for the recovery site. See Staging storage account overview.
Step 4: Create the Azure Relay namespace
Create an Azure Relay namespace in the resource group. Cayosoft Guardian creates a hybrid connection inside it during deployment and removes the hybrid connection when the recovery site is deleted.
Step 5: Configure private connectivity (optional)
If your security policy requires that backup traffic stay off public Azure endpoints:
- Create a private endpoint for the recovery site virtual network.
- Create a private endpoint for the Cayosoft Guardian-side virtual network.
- Configure name resolution for both, and verify that the storage account FQDN resolves to a private IP address.
- Disable public network access on the storage account.
For the full procedure, see Configure Azure private endpoints for the staging storage account.
Step 6: Grant permissions to the service principal
Assign the following roles to the service principal used by the cloud service:
| Role | Scope |
|---|---|
| Storage Blob Data Contributor | Staging storage account |
| Virtual Machine Contributor | Resource group |
| Network Contributor | Virtual network, and network security group if used (carried over from customer-provided network support in 7.3) |
| Azure Relay Owner, or an equivalent custom role | Azure Relay namespace |
See Permissions for Forest Recovery in Cayosoft Guardian for the granular Relay actions.
Step 7: Deploy the recovery site
- Open the Cayosoft Guardian web portal.
- Expand the Forest Recovery node.
- Select the Recovery plans node.
- Open your forest recovery plan, and then click Deploy recovery site > Deploy to Azure.
- In the recovery site settings, select Use precreated resources.
- Select the Resource group, Virtual network, Storage account, and Relay that you created.
- Review the site isolation and remaining settings.
- Click Deploy.
Cayosoft Guardian checks that the virtual network and the storage account are accessible. If a check fails, the wizard reports the error before deployment proceeds. Resolve the issue, and then retry.
Step 8: Verify the plan
Run verification against the recovery site before you rely on it. See Prepare recovery site manually for the list of checks that Cayosoft Guardian performs.
What happens during recovery
- Cayosoft Guardian checks the staging storage account for the Forest Recovery agent installers, comparing existence, file size, and version. Missing or outdated installers are uploaded.
- Cayosoft Guardian uploads the backup data for the domain controllers in the plan to the staging storage account.
- Cayosoft Guardian creates the recovery site virtual machines, network interfaces, and disks in your resource group and virtual network.
- Cayosoft Guardian installs the agents on the virtual machines.
- The agents download the backup data from the staging storage account.
- Forest restoration runs.
- Cayosoft Guardian deletes the backup data from the staging storage account, regardless of the result of the restoration.
Delete the recovery site
- Expand the Forest Recovery node.
- Click Recovery Sites.
- Select the recovery site and click Delete.
- Keep the Delete linked Azure resources option enabled to delete resources in Azure.
Cayosoft Guardian deletes only the objects that it created: virtual machines, network interfaces, disks, and the hybrid connection. Your resource group, virtual network, storage account, Relay namespace, and private endpoints remain in place and can be reused for the next recovery site. Backup data was already removed from the staging storage account when recovery finished, and the agent installers stay there for reuse.
Comments
0 comments
Please sign in to leave a comment.