Skip to content

Commit 88035a7

Browse files
kuthialakuthiala
committed
add disaster recovery guidance for NGINXaaS for Azure deployments
1 parent 97aea9f commit 88035a7

File tree

1 file changed

+207
-0
lines changed

1 file changed

+207
-0
lines changed

‎content/nginxaas-azure/quickstart/disaster-recovery.md

+207
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
---
2+
title: Disaster recovery
3+
weight: 800
4+
toc: true
5+
url: /nginxaas/azure/quickstart/disaster-recovery/
6+
type:
7+
- how-to
8+
---
9+
10+
11+
This guide describes how to configure disaster recovery (DR) for F5 NGINX as a Service for Azure deployments in separate Azure regions, ensuring upstream access remains available even if a region fails. The deployment architecture ensures users can access backend application servers (upstreams) continuously from an alternative region if the primary region becomes unavailable. The solution leverages Terraform, Azure Virtual Network (VNet) peering, and unique subnets to support failover.
12+
13+
---
14+
15+
**Architecture Overview**
16+
17+
```
18+
+-------------------+ +-------------------+
19+
| Region 1 | | Region 2 |
20+
| VNet1 | | VNet2 |
21+
| +-------------+ | Peered | +-------------+ |
22+
| | Subnet A1 | |<------->| | Subnet B | |
23+
| | NGINXaaS #1 | | | | NGINXaaS #2 | |
24+
| +-------------+ | | +-------------+ |
25+
| | Subnet A2 | | | |
26+
| | Upstreams | | | |
27+
| +-------------+ | | |
28+
+-------------------+ +-------------------+
29+
```
30+
31+
- Each region has its own VNet, subnet, and NGINXaaS for Azure deployment.
32+
- VNet peering enables cross-region connectivity.
33+
- Upstreams (e.g., VMs) are accessible from either NGINX deployment.
34+
35+
---
36+
37+
## Prerequisites
38+
39+
- Two Azure regions selected for DR.
40+
- Unique, non-overlapping VNet and subnet address spaces for each region.
41+
- Terraform 1.3+ and AzureRM provider 4.23+.
42+
43+
> **Note**: Each NGINX deployment **must run on separate subnets and non-overlapping address spaces**. This is critical for [Virtual Network (VNet) peering](https://learn.microsoft.com/en-us/azure/virtual-network/how-to-configure-subnet-peering) between the two regions. For example:
44+
>
45+
> - Region 1 (Virtual Network - 1 Address Space): `10.0.0.0/16`
46+
> - Region 2 (Virtual Network - 2 Address Space): `10.1.0.0/16`
47+
48+
---
49+
50+
51+
## Step 1: Deploy Prerequisite Infrastructure
52+
53+
Each region requires its own resource group, VNet, subnet, public IP, network security group, and user-assigned identity. Example allocation in the prerequisites module:
54+
55+
```hcl
56+
# Region 1
57+
resource "azurerm_virtual_network" "deployment_primary_vnet" {
58+
address_space = ["10.0.0.0/16"]
59+
# other config...
60+
}
61+
resource "azurerm_subnet" "deployment_primary_subnet" {
62+
address_prefixes = [cidrsubnet("10.0.0.0/16", 8, 0)] # results in 10.0.0.0/24
63+
}
64+
65+
# Region 2
66+
resource "azurerm_virtual_network" "deployment_secondary_vnet" {
67+
address_space = ["10.1.0.0/16"]
68+
}
69+
resource "azurerm_subnet" "deployment_secondary_subnet" {
70+
address_prefixes = [cidrsubnet("10.1.0.0/16", 8, 0)] # results in 10.1.0.0/24
71+
}
72+
```
73+
---
74+
75+
## Step 2: Deploy NGINXaaS for Azure Deployment in Each Region
76+
77+
```hcl
78+
resource "azurerm_nginx_deployment" "deployment_primary_nginxaas" {
79+
name = var.name_primary
80+
resource_group_name = var.resource_group_primary
81+
location = var.location_primary
82+
...
83+
network_interface {
84+
subnet_id = azurerm_subnet.deployment_primary_subnet.id
85+
}
86+
}
87+
resource "azurerm_nginx_deployment" "deployment_secondary_nginxaas" {
88+
name = var.name_secondary
89+
resource_group_name = var.resource_group_secondary
90+
location = var.location_secondary
91+
...
92+
network_interface {
93+
subnet_id = azurerm_subnet.deployment_secondary_subnet.id
94+
}
95+
}
96+
```
97+
98+
99+
---
100+
101+
## Step 3: Peer the VNets
102+
103+
```hcl
104+
resource "azurerm_virtual_network_peering" "vnet_primary_to_vnet_secondary" {
105+
name = "peering-vnet-primary-to-vnet-secondary"
106+
resource_group_name = var.resource_group_primary
107+
virtual_network_name = azurerm_virtual_network.deployment_primary_vnet.name
108+
remote_virtual_network_id = azurerm_virtual_network.deployment_secondary_vnet.id
109+
}
110+
resource "azurerm_virtual_network_peering" "vnet_secondary_to_vnet_primary" {
111+
name = "peering-vnet-secondary-to-vnet-primary"
112+
resource_group_name = var.resource_group_secondary
113+
virtual_network_name = azurerm_virtual_network.deployment_secondary_vnet.name
114+
remote_virtual_network_id = azurerm_virtual_network.deployment_primary_vnet.id
115+
}
116+
```
117+
118+
119+
---
120+
121+
## Step 4: Configure Upstreams
122+
123+
Deploy upstream VMs in a subnet separate from the NGINXaaS deployment subnet in the primary region. Example:
124+
125+
```hcl
126+
resource "azurerm_subnet" "upstreams" {
127+
name = "upstreams-subnet"
128+
resource_group_name = var.resource_group_primary
129+
virtual_network_name = azurerm_virtual_network.deployment_primary_vnet.name
130+
address_prefixes = [cidrsubnet(var.vnet_addr_space, 8, 1)]
131+
}
132+
```
133+
134+
135+
---
136+
137+
## Step 5: NGINX Configuration for Failover
138+
139+
Configure both NGINX deployments to include upstreams from the primary regions in their load balancing configuration. Example `nginx.conf` snippet:
140+
141+
```nginx
142+
upstream backend {
143+
server <vm1-private-ip>:80;
144+
server <vm2-private-ip>:80;
145+
}
146+
```
147+
148+
- Use private IPs reachable via VNet peering.
149+
- Health checks can be configured to detect regional failures and reroute traffic.
150+
151+
---
152+
153+
## Step 6: DNS and Failover
154+
155+
- Use Azure Traffic Manager or an external DNS solution to direct traffic to the healthy NGINX deployment.
156+
- In case of a regional outage, update DNS to point to the public IP of the surviving region's NGINX.
157+
158+
---
159+
160+
## Workarounds for Subnet Peering Caveats
161+
162+
- **Subnet Peering for Overlapping VNets:**
163+
If overlapping address spaces are unavoidable, use subnet-level peering to selectively peer only the required subnets.
164+
165+
```shell
166+
az network vnet peering create \
167+
--name vnet1-to-vnet2 \
168+
--resource-group <rg1> \
169+
--vnet-name <vnet1> \
170+
--remote-vnet <vnet2-id> \
171+
--allow-vnet-access \
172+
--peer-complete-vnet false \
173+
--local-subnet-names <subnet1> \
174+
--remote-subnet-names <subnet2>
175+
```
176+
177+
178+
---
179+
180+
## Failover Process
181+
182+
1. **Monitor**: Continuously monitor NGINXaaS deployment health in both regions.
183+
2. **Failover**: If a region fails, update DNS or Traffic Manager to route traffic to the surviving region's NGINXaaS deployment.
184+
3. **Recovery**: Restore the failed region and verify peering and upstream connectivity before re-enabling traffic.
185+
186+
---
187+
188+
## Diagram
189+
190+
```plaintext
191+
+-----------------------+ Peering +-----------------------+
192+
| Region 1 |<----------------->| Region 2 |
193+
| NGINXaaS Deployment 1| | NGINXaaS Deployment 2|
194+
| Upstreams (VMs) | | |
195+
+-----------------------+ +-----------------------+
196+
| |
197+
+-------------------+ +-----------------+
198+
| |
199+
Users/Clients (via DNS/Traffic Manager)
200+
```
201+
202+
203+
---
204+
205+
**Summary:**
206+
207+
By deploying NGINX in separate regions with unique subnets and peered VNets, and configuring upstreams and DNS for failover, this topology ensures high availability and DR for your upstreams. Use subnet peering if address spaces overlap. Always monitor and test your failover paths.

0 commit comments

Comments
 (0)