Failover drill

Purpose

A failover drill starts your protected servers at the recovery site, allowing you to validate your applications. This process is crucial for disaster recovery because it helps you:

• Verify that your protected applications launch successfully at the recovery site.

• Familiarize your team with the recovery procedure to ensure they can perform a smooth failover during a real disaster.

Prerequisites

• You can perform a failover drill after the protection group is in the Replicating Incremental Data state or has at least one recovery point. For information about how to create a protection group for cross-availability zone disaster recovery and cross-region disaster recovery, see Start replication for cross-availability zone disaster recovery and Start replication for cross-region disaster recovery.

• For the Create Custom Drill Environment scenario, you must first create the required resources for the drill environment, such as a VPC, vSwitch mappings, and security group mappings.

Procedure

1. Create a drill environment.

   Note

   For the Create Custom Drill Environment scenario, you must first create the required resources for the drill environment, such as a VPC, vSwitch mappings, and security group mappings. After you create the drill environment, configure the drill network.

2. Start the failover drill.

3. Validate your applications or services.

4. Clean up the drill environment.

Creation methods

Auto create and start

1. Log in to the Hybrid Cloud Disaster Recovery Console.

2. If the current page is for continuous replication, click the icon in the upper-left corner of the navigation pane to switch to cloud disk asynchronous replication.

3. Click Site Pairs.

4. On the Site Pairs page, click the target site pair and select the Fault Drill tab.

   Note

   You can also go to the corresponding Protection Group tab and start the failover drill from the Actions column.

5. Click Automatically Create and Start Drill Environment.

6. In the Start Drill dialog box, select a Protection Group from the drop-down list and click Next.

7. Preview the resources in the protection group. After you confirm that the information is correct, click Confirm. On the Resource Preview page, you can select a Resource Group (optional; automatically created ECS instances are added to this group) and set the ECS Tag Sync switch (enabled by default to sync tags to the automatically created ECS instances). The page displays the information of the ECS instances in the protection group in a table, including instance type, operating system, IP address, and secondary ENIs. Note that protection group replication will be paused during the creation of drill resources, which may cause the RPO to exceed the threshold. After you confirm that the configuration is correct, click Confirm to start the drill.

   Note

   • If the instance type or OS at the recovery site does not meet the requirements, you can select a suitable instance type based on the source ECS instance and the prompts on the page. You can click Modify instance type and Modify OS to change the instance type and OS for the recovery site. If the available instance families and operating systems do not meet your needs, submit a ticket to Alibaba Cloud technical support.

   • Before you start replication, you can also Modify Custom Data and Modify DR Site IP.

   • An IP address error indicates that the IP address is already in use. You must remove the original drill ECS instance or change the vSwitch mapping in the network configuration.

8. In the Confirm to Start Drill dialog box, select I have assessed the business and can start the drill and click OK.

   Important

   • The system pauses replication for the protection group to create new disks from the latest recovery point. Replication typically resumes within 5 minutes. Once the drill disks are ready, the system creates the drill ECS instances at the recovery site. You can validate your services after the drill group is created.

   • The failover drill automatically starts the ECS instances at the recovery site but does not stop the ECS instances at the production site. To avoid business risks, carefully assess your services and use measures such as security groups and network isolation to isolate production traffic.

   The status of the drill protection group changes sequentially to Initializing, Drilling, and finally Drill group created successfully.

9. After the drill ECS instances start, you can validate your services.

   In the Drill protection group section of the Failover drill tab, you can view the drill status, such as Drill group created successfully, the recovery point, the drill start time, and the Drill RTO. Expand the row for the protection group to view instance details. Click the Remote Connect button next to the recovery site instance to connect to the instance and validate your services.

10. Clean up the drill environment.

    1. Delete the drill group.

       Deleting the drill group removes all resources created during the drill, including ECS instances, cloud disks, elastic network interfaces, snapshots, and images.

       In the Actions column for the target drill protection group, click Delete Fault Drill Group and confirm the action.

       Note

       You can also go to the Protection Group tab to delete a specific fault drill group or multiple fault drill groups in a batch from the Actions column.

    2. Delete the drill environment.

       In the Drill Environment section, click Delete and confirm the action.

Create custom drill environment

1. Log in to the Hybrid Cloud Disaster Recovery Console.

2. If the current page is for continuous replication, click the icon in the upper-left corner of the navigation pane to switch to cloud disk asynchronous replication.

3. Click Site Pairs.

4. On the site pairs page, click the target site pair and select the Failover drill tab.

   Note

   You can also go to the corresponding protection group tab and start the failover drill from the Actions column.

5. Click Create Custom Drill Environment.

6. In the Create Drill Environment dialog box, set the name prefix for the new ECS instances that will be created during the failover drill, select a Drill VPC from the drop-down list, and then click OK.

   Note

   • The prefix is added to the names of the ECS instances created during the drill. For example, if you set the prefix to Drill_test_20230925_ and the original instance name is ecse, the new instance name becomes Drill_test_20230925_ecse.

   • You must create the VPC for the drill environment at the recovery site in advance.

7. Configure the drill environment network.

   1. In the Drill Environment area, click Details for the Drill Network Configuration parameter.

   2. In the Drill Network Configuration dialog box, you can add vSwitch mappings and security group mappings. The dialog box contains the vSwitch Mapping and Security Group Mapping sections. The vSwitch Mapping section displays availability zone mapping relationships, such as China (Hangzhou) Zone G → China (Shanghai) Zone G, and the mapping status between the production site network and the disaster recovery (DR) site network. The Security Group Mapping section displays the mapping status between the production site security group and the DR site security group. You can click Add vSwitch Mapping and Add Security Group Mapping to add new mappings, or click Edit and Delete to manage existing mappings.

8. In the drill environment section, click Start Drill.

9. In the Start Drill dialog box, select a protection group from the drop-down list and click Next.

10. Preview the protection group resources. After confirming the settings, click OK.

    Note

    • If the instance type or OS at the recovery site does not meet the requirements, you can select a suitable instance type based on the source ECS instance and the prompts on the page. You can click Modify instance type and Modify OS to change the instance type and OS for the recovery site. If the available instance families and operating systems do not meet your needs, submit a ticket to Alibaba Cloud technical support.

    • Before you start replication, you can also Modify Custom Data and Modify DR Site IP.

    • An IP address error indicates that the IP address is already in use. You must remove the original drill ECS instance or change the vSwitch mapping in the network configuration.

11. In the Confirm to Start Drill dialog box, click OK.

    Important

    • The system pauses replication for the protection group to create new disks from the latest recovery point. Replication typically resumes within 5 minutes. After the drill disks are ready, the system creates the drill ECS instances at the recovery site. You can validate your services after the drill group is created.

    • The failover drill automatically starts the ECS instances at the recovery site but does not stop the ECS instances at the production site. To avoid business risks, carefully assess your services and use measures such as security groups and network isolation to isolate production traffic.

    The status of the drill protection group changes sequentially to Initializing, Drilling, and finally Drill Group Created.

12. After the drill ECS instances start, you can validate your services.

13. Clean up the drill environment.

    1. Delete the drill group.

       Deleting the drill group removes all resources created during the drill, including ECS instances, cloud disks, elastic network interfaces, snapshots, and images.

       In the Actions column for the target drill protection group, click Delete Fault Drill Group and confirm the action.

       Note

       You can also go to the Protection Group tab to delete one or more disaster recovery drill groups from the Actions column.

    2. Delete the drill environment.

       In the Drill environment section, click Delete and confirm the action.