Planning Azure Site Recovery in a Hub-Spoke Network

This is a sample article that shows the MDX authoring format. Replace it with your real content. The frontmatter fields at the top must match the schema in src/content.config.ts, and category must be one of the categories defined in src/site.config.ts.

Why this matters

In a hub-spoke design, the spoke VNet hosting your protected VMs often routes all egress traffic back through the hub (forced tunneling via a Network Virtual Appliance or Azure Firewall). Azure Site Recovery’s replication traffic needs a clear path to the Recovery Services vault endpoints, and a misconfigured route table in the spoke can silently break replication health without an obvious error at first glance.

Pre-flight checklist

• Confirm NSG rules allow outbound HTTPS (443) to the required Azure Site Recovery service tags
• Check User Defined Routes (UDRs) on the protected subnet for unintended forced tunneling of ASR replication traffic
• Validate the Recovery Services vault and target region have sufficient quota for the VM SKUs you’re protecting
• Test a planned failover before you need an unplanned one

A simple route table snippet

Get-AzRouteTable -ResourceGroupName "rg-hub-network" |
    Select-Object Name, @{N='Routes';E={$_.Routes.Count}}

More detail on the actual SHIFT engagement this pattern came from will follow in a future article.