# Resources automatically created in your Azure or Commvault subscription for cleanroom recovery

When you use certain cleanroom options, resources are automatically created in your Azure and/or Commvault subscription. For application-aware recovery, these resources also support the workflow that restores the VM and then restores application or database data to the required point in time.

## Express configuration for cleanroom runbooks

When you use the express configuration to create an Azure runbook, the following resources and configurations are created in your cleanroom recovery Azure subscription.

### Application

The CommvaultCloudAppForCleanroom application requires the following permissions:

Service | Permission | Type | Purpose
--- | --- | --- | ---
Azure Resource Manager | user_impersonation | Delegated | Enables the app to call Azure Resource Manager APIs on behalf of the user.
Microsoft Graph | User.Read | Delegated | Lets the app authenticate the user and read basic profile and organization data.

### Resource providers

- Microsoft.Support
- Microsoft.Storage
- Microsoft.SerialConsole
- Microsoft.ResourceNotifications
- Microsoft.ResourceGraph
- Microsoft.Portal
- Microsoft.OperationalInsights
- Microsoft.Network
- Microsoft.MarketplaceOrdering
- Microsoft.MachineLearning
- Microsoft.GuestConfiguration
- Microsoft.Features
- Microsoft.CostManagement
- Microsoft.Consumption
- Microsoft.Compute
- Microsoft.Commerce
- Microsoft.CloudShell
- Microsoft.ClassicSubscription
- Microsoft.ChangeAnalysis
- Microsoft.Billing
- Microsoft.Authorization
- Microsoft.ADHybridHealthService

### Custom role

The Commvault Cleanroom custom role is created and assigned to the CommvaultCloudAppForCleanroom application as a service principal in the subscription.

- Name: `Commvault – Cleanroom__UnixTimeStamp__`

- Description: A Commvault role used for cleanroom recovery

- Type: Custom role

## Create new options for cleanroom sites

### Azure resources

When you select Create new option for a cleanroom site setting, the following resources are created in your cleanroom recovery Azure subscription.

Resource | Name | Created in | Purpose | Details
--- | --- | --- | --- | ---
Resource group | [runbook]-RG | Cleanroom recovery Azure subscription | Contains all other resources | None
Storage account | [runbook]-[region] | [runbook]-RG | Stores recovery VHDs | General-purpose v2 Standard performance tier RA-GRS (read-access geo-redundant storage)
Virtual network (VNet) | [runbook]-[region]-VNet | [runbook]-RG | Provides isolated network environment | Default VNet address space: 10.0.0.0/16
Subnet | [runbook]-[region]-Subnet | [runbook]-RG | Provides address space for resources in the VNet | Default subnet: 10.0.0.0/17 (configured in the cleanroom site Advanced options)
Network security group (NSG) and rules | [runbook]-[region]-NSG | [runbook]-RG | Controls inbound and outbound traffic | Allows only explicitly allowed communication, only within the workload subnet range. For details, see the NSG rules sections on this page. You can specify additional rules in the cleanroom site Advanced options.
Azure Bastion host | [runbook]-[region]-Bastion | [runbook]-RG | Provides secure RDP/SSH connectivity without public IPs | Deploys with a static public IP Adds the `AllowBastionSubnetInBound` rule to the NSG for recovered resources Can be disabled in the cleanroom site Advanced options
Azure Bastion subnet | AzureBastionSubnet | [runbook]-RG | Supports Bastion deployment | Address space configured in the cleanroom site Advanced options Created automatically when Bastion is deployed

### NSG rules for subnets

The following NSG rules are created for workload, infrastructure, and Bastion subnets. The rules comply with security policies that require subnets to have associated security groups. Actual restriction of ports is handled by the NSG rules for recovered resources.

Direction | Priority | Name | Port | Protocol | Source | Destination | Action | Purpose
--- | --- | --- | --- | --- | --- | --- | --- | ---
Inbound | 192 | AllowAICVTrafficInbound | 135, 139, 443, 445, 8403, 49152-65535 | Any | Any | Any | Allow | Required Commvault communication
Inbound | 194 | AllowInboundFromVPC | Any | Any | VirtualNetwork | VirtualNetwork | Allow | Internal cleanroom communication
Inbound | 4000 | DenyAllInbound | Any | Any | Any | Any | Deny | Block all other inbound traffic
Outbound | 192 | AllowAICVTrafficOutbound | 80, 135, 139, 443, 445, 8403, 49152-65535 | Any | Any | Any | Allow | Required Commvault communication
Outbound | 194 | AllowOutboundToVPC | Any | Any | Any | VirtualNetwork | Allow | Internal cleanroom communication
Outbound | 195 | AllowDNSOutbound | 53 | Any | Any | DNS Server | Allow | DNS resolution
Outbound | 4000 | DenyAllOutbound | Any | Any | Any | Any | Deny | Block all other outbound traffic

### NSG rules for recovered resources

The following NSG rules are created to allow communication between the recovered resources inside cleanroom site, and to allow secure access to these resources using Bastion.

Direction | Priority | Name | Port | Protocol | Source | Destination | Action | Purpose
--- | --- | --- | --- | --- | --- | --- | --- | ---
Inbound | 199 | AllowBastionSubnetInBound | Any | Any | 10.0.192.0/18 | Any | Allow | Allows inbound traffic from the Bastion subnet to enable secure RDP/SSH access
Inbound | 200 | AllowWorkloadSubnetInBound | Any | Any | 10.0.0.0/17 | Any | Allow | Allows communication between resources within the workload subnet
Inbound | 4000 | DenyAllInbound | Any | Any | Any | Any | Deny | Denies all other inbound traffic not explicitly allowed
Inbound | 65000 | AllowVnetInBound | Any | Any | VirtualNetwork | VirtualNetwork | Allow | Allows traffic between resources within the same virtual network
Inbound | 65001 | AllowAzureLoadBalancerInBound | Any | Any | AzureLoadBalancer | Any | Allow | Allows health probe traffic from the Azure load balancer
Inbound | 65500 | DenyAllInBound | Any | Any | Any | Any | Deny | Denies all inbound traffic as a final catch-all rule
Outbound | 200 | AllowWorkloadSubnetOutBound | Any | Any | Any | 10.0.0.0/17 | Allow | Allows outbound communication to resources within the workload subnet
Outbound | 4000 | DenyAllOutbound | Any | Any | Any | Any | Deny | Denies all other outbound traffic not explicitly allowed
Outbound | 65000 | AllowVnetOutBound | Any | Any | VirtualNetwork | VirtualNetwork | Allow | Allows outbound traffic between resources in the same virtual network
Outbound | 65001 | AllowInternetOutBound | Any | Any | Any | Internet | Allow | Allows outbound traffic to the Internet
Outbound | 65500 | DenyAllOutBound | Any | Any | Any | Any | Deny | Denies all outbound traffic as a final catch-all rule

## Workload-specific resources (databases and Active Directory)

Runbooks that include database or Active Directory resources deploy additional resources and update service endpoints and NSG rules to support application-aware recovery.

Note

Example IPs and sample VM names (for example, 4.194.145.4/32 and appgateway) are illustrative only. Use the runbook or the Azure portal for actual IPs and VM names. Port ranges, service endpoints, and NSG rule names are required configuration.

### App gateway

An app gateway is deployed as follows:

- Method: Using the infrastructure options and created in the infrastructure recovery group.

- Name pattern: The VM is created with the prefix `appgateway` and the job ID appended.

- Purpose: Provides gateway connectivity for recovered workload VMs that do not have direct internet access; it enables those VMs to reach the control plane and required Azure services.

- Auto Proxies server group: App gateway VMs are included in the Auto Proxies server group when database or Active Directory workloads are present.

### Subnet service endpoints

Infrastructure subnet service endpoints:

- Microsoft.Storage.Global

Workload subnet service endpoints:

- Microsoft.Storage.Global
- Microsoft.Sql
- Microsoft.AzureActiveDirectory

### Infrastructure NSG rules

The infrastructure NSG is updated with the following additional rules when database or Active Directory workloads are present:

Direction | Priority | Name | Port | Protocol | Source | Destination | Action | Purpose
--- | --- | --- | --- | --- | --- | --- | --- | ---
Inbound | 190 | AllowAllCVTrafficInbound-190 | 8403 | Any | Any | Any | Allow | Allows CVD/cvd port connections required by access nodes and proxies
Inbound | 193 | AllowWorkloadSubnetInboundRule | Any | Any | 10.0.0.0/17 | Any | Allow | Allows inbound connections from the workload subnet
Outbound | 181 | AllowWorkloadSubnetOutboundRule | 135,139,445,49152-65535 | Any | Any | 10.0.0.0/17 | Allow | Allows SMB/RPC/ephemeral ports to the workload subnet

### Workload NSG rules

The workload NSG (recovered resources) is updated with the following additional rules:

Direction | Priority | Name | Port | Protocol | Source | Destination | Action | Purpose
--- | --- | --- | --- | --- | --- | --- | --- | ---
Inbound | 180 | AllowInfraSubnetInbound | 135,139,445,49152-65535 | Any | 10.0.128.0/18 | Any | Allow | Allows SMB/RPC/ephemeral traffic from the infrastructure subnet
Outbound | 190 | NetworkTopologyRule-190 | 8403,443 | Any | Any | 4.194.145.4/32 | Allow | Allows traffic to the App Gateway IP (devtest example)
Outbound | 193 | AllowInfraSubnetOutbound | Any | Any | Any | 10.0.128.0/18 | Allow | Allows outbound access to the infrastructure subnet
Outbound | 198 | AzureNetworkRule | 443 | Any | Any | AzureCloud | Allow | Allows outbound access to AzureCloud services

## Default auto-scaling

When you use default auto-scaling in Commvault, which is recommended in most cases, the following resources are created.

### Azure resources

The following resources are created in your cleanroom recovery Azure subscription.

Resource | Name | Created in | Purpose | Details
--- | --- | --- | --- | ---
Virtual network (VNet) | [runbook]-[region]-VNet | [runbook]-RG | Provides a network container for access nodes | None
Subnet | [runbook]-[region]Infra-Subnet | Workload VNet | Provides address space for infrastructure resources | Allocated from infrastructure range (default 10.0.128.0/18) Configured in the cleanroom site advanced options
Network security group (NSG) and rules | [runbook]-[region]-Infra-NSG | [runbook]-RG | Controls inbound and outbound traffic | Commvault-applied defaults: DenyAllInBound and DenyAllOutBound rules are added to block all inbound and outbound traffic unless explicitly allowed. Exceptions: Allow inbound traffic from the Bastion subnet Allow outbound traffic to Azure Storage and AzureCloud (configured in the cleanroom site advanced options) Includes NetworkTopologyRule to allow cvd port connections (8400–8403) Auto-scaled access nodes are bound to interfaces governed by this NSG
Subnet | AzureBastionSubnet | Workload VNet | Provides address space for infrastructure resources | Allocated from infrastructure range (default 10.0.128.0/18) Configured in the cleanroom site advanced options
NAT gateway | [runbook]-[region]-Infra-NAT | Workload VNet | Provides outbound connectivity | Associated with the infrastructure subnet Uses a public IP for external communication

### NSG rules for infrastructure workloads (auto-scaled access nodes)

The following NSG rules are created to allow secure access in the SaaS for recovering resources into the cleanroom site.

Direction | Priority | Name | Port | Protocol | Source | Destination
--- | --- | --- | --- | --- | --- | ---
Inbound | 199 | AllowBastionSubnetInbound | Any | Any | 10.0.192.0/18 | Any
Inbound | 200 | AllowWithinSubnetInbound | Any | Any | 10.0.128.0/18 | Any
Inbound | 4000 | DenyAllInbound | Any | Any | Any | Any
Inbound | 65000 | AllowVnetInbound | Any | Any | VirtualNetwork | VirtualNetwork
Inbound | 65001 | AllowAzureLoadBalancerInbound | Any | Any | AzureLoadBalancer | Any
Inbound | 65500 | DenyAllInbound | Any | Any | Any | Any
Outbound | 190 | NetworkTopologyRule-190 | 443 | Any | Any | 10.171.3.136
Outbound | 195 | AllowDNSOutbound | 53 | Any | Any | 168.63.129.16
Outbound | 196 | AllowAllOutboundTemporary | 443 | Any | Any | Any
Outbound | 197 | AzureSMBRule | 445 | Any | Any | Storage
Outbound | 198 | AzureNetworkRule | 443 | Any | Any | AzureCloud
Outbound | 200 | AllowWithinSubnetOutbound | Any | Any | 10.0.128.0/18 | Any
Outbound | 4000 | DenyAllOutbound | Any | Any | Any | Any
Outbound | 65000 | AllowVnetOutbound | Any | Any | VirtualNetwork | VirtualNetwork
Outbound | 65001 | AllowInternetOutbound | Any | Any | Any | Internet
Outbound | 65500 | DenyAllOutbound | Any | Any | Any | Any

### Created in Commvault control plane (Commvault software only)

The following resources are created in your Commvault control plane.

Name | Purpose | Details
--- | --- | ---
Control Plane server group | Provides recovery control components | Contains MediaAgents, auto-scaled access nodes, and the control plane.
Auto Proxies server group | Provides temporary access capacity | Runs auto-scaled access nodes deployed during cleanroom recovery.
Network topology | Provides recovery communication | One-way connection from the Auto Proxies server group to the Control Plane server group to support secure communication between the control plane and auto-scaled access nodes.

×

Loading...