Skip to content

Files

Latest commit

mepandmepand
Update backup-network-connectivity.md
Apr 4, 2022
d7700e0 · Apr 4, 2022

History

History
96 lines (70 loc) · 5 KB

backup-network-connectivity.md

File metadata and controls

96 lines (70 loc) · 5 KB
title description services author manager ms.service ms.topic ms.date ms.author ms.custom
include file
include file
backup
v-amallick
carmonm
backup
include
06/04/2021
v-amallick
include file

The MARS agent requires access to Azure Active Directory, Azure Storage, and Azure Backup service endpoints. To obtain the public IP ranges, see the JSON file. Allow access to the IPs corresponding to Azure Backup (AzureBackup), Azure Storage (Storage), and Azure Active Directory (AzureActiveDirectory). Also, depending on your Windows version, network connectivity checks of the operating system will need access to www.msftconnecttest.com, or www.msftncsi.com.

If your machine has limited internet access, ensure that firewall, proxy, and network settings allow access to the following FQDNs and public IP addresses.

URL and IP access

FQDNs

  • *.microsoft.com
  • *.windowsazure.com
  • *.microsoftonline.com
  • *.windows.net
  • *blob.core.windows.net
  • *queue.core.windows.net
  • *blob.storage.azure.net

If you are a US Government customer, ensure that you have access to the following URLs:

  • www.msftncsi.com
  • *.microsoft.com
  • *.windowsazure.us
  • *.microsoftonline.us
  • *.windows.net
  • *.usgovcloudapi.net
  • *blob.core.windows.net
  • *queue.core.windows.net
  • *blob.storage.azure.net

Access to all of the URLs and IP addresses listed above uses the HTTPS protocol on port 443.

When backing up files and folders from Azure VMs using the MARS Agent, you also need to configure the Azure virtual network to allow access. If you use Network Security Groups (NSG), use the AzureBackup service tag to allow outbound access to Azure Backup. In addition to the Azure Backup tag, you also need to allow connectivity for authentication and data transfer by creating similar NSG rules for Azure AD (AzureActiveDirectory) and Azure Storage (Storage).

To create a rule for the Azure Backup tag, follow these steps:

  1. In All Services, go to Network security groups and select the network security group.
  2. Select Outbound security rules under Settings.
  3. Select Add.
  4. Provide all required details for creating a new rule as described in security rule settings.
    Ensure the options are set as below:
    • Destination is set to Service Tag.
    • Destination service tag is set to AzureBackup.
  5. Select Add to save the newly created outbound security rule.

You can similarly create NSG outbound security rules for Azure Storage and Azure AD. To learn more about service tags, see Virtual network service tags.

Azure ExpressRoute support

You can back up your data through Azure ExpressRoute by using public peering (available for old circuits). We don’t support Microsoft peering Backup over private peering.

To use public peering, ensure that the following domains and addresses have HTTPS access on port 443 to:

  • *.microsoft.com
  • *.windowsazure.com
  • *.microsoftonline.com
  • *.windows.net
  • *blob.core.windows.net
  • *queue.core.windows.net
  • *blob.storage.azure.net

To use Microsoft peering, select the following services, regions, and relevant community values:

  • Azure Active Directory (12076:5060)
  • Azure region, according to the location of your Recovery Services vault
  • Azure Storage, according to the location of your Recovery Services vault

Learn more about ExpressRoute routing requirements.

Note

Public peering is deprecated for new circuits.

Private Endpoint support

You can now use Private Endpoints to back up your data securely from servers to your Recovery Services vault. As Azure AD can’t be accessed via private endpoints, you need to allow IPs and FQDNs required for Azure AD for outbound access separately.

When you use the MARS agent to back up your on-premises resources, ensure that your on-premises network (containing your resources to be backed up) is peered with the Azure VNet that contains a private endpoint for the vault. You can then continue to install the MARS agent and configure backup. However, you must ensure all communication for backup happens through the peered network only.

If you remove private endpoints for the vault after a MARS agent has been registered to it, you'll need to re-register the container with the vault. You don't need to stop protection for them. For more information, see Private endpoints for Azure Backup.

Throttling support

Feature Details
Bandwidth control Supported. In the MARS agent, use Change Properties to adjust bandwidth.
Network throttling Not available for backed-up machines that run Windows Server 2008 R2, Windows Server 2008 SP2, or Windows 7.