Cross-Site Disaster Recovery
Replicate workloads to a second region and fail over when the worst happens.
High availability protects you within a region. Disaster recovery protects you from losing the region — fire, flood, prolonged power or connectivity failure. Protected VMs are asynchronously replicated to a second region and can be brought up there in an orderly, tested fashion.
Core Concepts
| Term | Meaning |
|---|---|
| RPO (Recovery Point Objective) | Maximum data loss, set by replication frequency — typically minutes |
| RTO (Recovery Time Objective) | Time to be running again in the DR region — typically minutes to an hour depending on plan complexity |
| Recovery plan | The scripted order of VM startup, network mapping, and IP re-addressing in the DR region |
| DR drill | A rehearsal that brings up the replica in an isolated network without touching production |
Setting Up Replication
Pair sites
Data Protection → Disaster Recovery → Create Pair. The replication target — a second shared region or a Dedicated Cloud site in the jurisdiction you require — is defined in your service design. Replication traffic is encrypted in transit.
Select VMs and RPO
Add VMs to the replication group and choose the replication interval (e.g. every 5 minutes). Initial seeding copies the full disks; afterward only changes cross the wire.
Build the recovery plan
Define startup order (database before app before web), map each subnet to a DR-region subnet, and set IP handling (keep addresses or re-map).
Drills and Failover
- Drill (recommended quarterly): brings replicas up in an isolated DR network. Production replication continues untouched; you validate that systems actually boot and serve.
- Planned failover: for anticipated events — replicates final changes, shuts down primaries cleanly, starts DR copies. Near-zero data loss.
- Unplanned failover: region is gone — starts DR copies from the latest replicated point. Data loss bounded by your RPO.
- Failback: once the primary region is restored, replication reverses and a planned failover returns workloads home.
A DR setup that has never been drilled will fail in surprising ways on the day it matters. Schedule drills like you schedule payroll — automatically and without debate.