> Software > Secure > Cleanroom recovery > Cloud-based cleanrooms > Reference

Resources automatically created in your Azure or Commvault subscription for cleanroom recovery

When you use certain cleanroom options, resources are automatically created in your Azure and/or Commvault subscription. For application-aware recovery, these resources also support the workflow that restores the VM and then restores application or database data to the required point in time.

Express configuration for cleanroom runbooks

When you use the express configuration to create an Azure runbook, the following resources and configurations are created in your cleanroom recovery Azure subscription.

Application

The CommvaultCloudAppForCleanroom application requires the following permissions:

Service Permission Type Purpose
Azure Resource Manager user_impersonation Delegated Enables the app to call Azure Resource Manager APIs on behalf of the user.
Microsoft Graph User.Read Delegated Lets the app authenticate the user and read basic profile and organization data.

Resource providers

  • Microsoft.Support
  • Microsoft.Storage
  • Microsoft.SerialConsole
  • Microsoft.ResourceNotifications
  • Microsoft.ResourceGraph
  • Microsoft.Portal
  • Microsoft.OperationalInsights
  • Microsoft.Network
  • Microsoft.MarketplaceOrdering
  • Microsoft.MachineLearning
  • Microsoft.GuestConfiguration
  • Microsoft.Features
  • Microsoft.CostManagement
  • Microsoft.Consumption
  • Microsoft.Compute
  • Microsoft.Commerce
  • Microsoft.CloudShell
  • Microsoft.ClassicSubscription
  • Microsoft.ChangeAnalysis
  • Microsoft.Billing
  • Microsoft.Authorization
  • Microsoft.ADHybridHealthService

Custom role

The Commvault Cleanroom custom role is created and assigned to the CommvaultCloudAppForCleanroom application as a service principal in the subscription.

  • Name: Commvault – Cleanroom__UnixTimeStamp__

  • Description: A Commvault role used for cleanroom recovery

  • Type: Custom role

Create new options for cleanroom sites

Azure resources

When you select Create new option for a cleanroom site setting, the following resources are created in your cleanroom recovery Azure subscription.

Resource Name Created in Purpose Details
Resource group [runbook]-RG Cleanroom recovery Azure subscription Contains all other resources None
Storage account [runbook]-[region] [runbook]-RG Stores recovery VHDs General-purpose v2
Standard performance tier
RA-GRS (read-access geo-redundant storage)
Virtual network (VNet) [runbook]-[region]-VNet [runbook]-RG Provides isolated network environment Default VNet address space: 10.0.0.0/16
Subnet [runbook]-[region]-Subnet [runbook]-RG Provides address space for resources in the VNet Default subnet: 10.0.0.0/17 (configured in the cleanroom site Advanced options)
Network security group (NSG) and rules [runbook]-[region]-NSG [runbook]-RG Controls inbound and outbound traffic Allows only explicitly allowed communication, only within the workload subnet range. For details, see the NSG rules sections on this page.
You can specify additional rules in the cleanroom site Advanced options.
Azure Bastion host [runbook]-[region]-Bastion [runbook]-RG Provides secure RDP/SSH connectivity without public IPs Deploys with a static public IP
Adds the AllowBastionSubnetInBound rule to the NSG for recovered resources
Can be disabled in the cleanroom site Advanced options
Azure Bastion subnet AzureBastionSubnet [runbook]-RG Supports Bastion deployment Address space configured in the cleanroom site Advanced options
Created automatically when Bastion is deployed

NSG rules for subnets

The following NSG rules are created for workload, infrastructure, and Bastion subnets. The rules comply with security policies that require subnets to have associated security groups. Actual restriction of ports is handled by the NSG rules for recovered resources.

Direction Priority Name Port Protocol Source Destination Action Purpose
Inbound 192 AllowAICVTrafficInbound 135, 139, 443, 445, 8403, 49152-65535 Any Any Any Allow Required Commvault communication
Inbound 194 AllowInboundFromVPC Any Any VirtualNetwork VirtualNetwork Allow Internal cleanroom communication
Inbound 4000 DenyAllInbound Any Any Any Any Deny Block all other inbound traffic
Outbound 192 AllowAICVTrafficOutbound 80, 135, 139, 443, 445, 8403, 49152-65535 Any Any Any Allow Required Commvault communication
Outbound 194 AllowOutboundToVPC Any Any Any VirtualNetwork Allow Internal cleanroom communication
Outbound 195 AllowDNSOutbound 53 Any Any DNS Server Allow DNS resolution
Outbound 4000 DenyAllOutbound Any Any Any Any Deny Block all other outbound traffic

NSG rules for recovered resources

The following NSG rules are created to allow communication between the recovered resources inside cleanroom site, and to allow secure access to these resources using Bastion.

Direction Priority Name Port Protocol Source Destination Action Purpose
Inbound 199 AllowBastionSubnetInBound Any Any 10.0.192.0/18 Any Allow Allows inbound traffic from the Bastion subnet to enable secure RDP/SSH access
Inbound 200 AllowWorkloadSubnetInBound Any Any 10.0.0.0/17 Any Allow Allows communication between resources within the workload subnet
Inbound 4000 DenyAllInbound Any Any Any Any Deny Denies all other inbound traffic not explicitly allowed
Inbound 65000 AllowVnetInBound Any Any VirtualNetwork VirtualNetwork Allow Allows traffic between resources within the same virtual network
Inbound 65001 AllowAzureLoadBalancerInBound Any Any AzureLoadBalancer Any Allow Allows health probe traffic from the Azure load balancer
Inbound 65500 DenyAllInBound Any Any Any Any Deny Denies all inbound traffic as a final catch-all rule
Outbound 200 AllowWorkloadSubnetOutBound Any Any Any 10.0.0.0/17 Allow Allows outbound communication to resources within the workload subnet
Outbound 4000 DenyAllOutbound Any Any Any Any Deny Denies all other outbound traffic not explicitly allowed
Outbound 65000 AllowVnetOutBound Any Any VirtualNetwork VirtualNetwork Allow Allows outbound traffic between resources in the same virtual network
Outbound 65001 AllowInternetOutBound Any Any Any Internet Allow Allows outbound traffic to the Internet
Outbound 65500 DenyAllOutBound Any Any Any Any Deny Denies all outbound traffic as a final catch-all rule

Workload-specific resources (databases and Active Directory)

Runbooks that include database or Active Directory resources deploy additional resources and update service endpoints and NSG rules to support application-aware recovery.

Note

Example IPs and sample VM names (for example, 4.194.145.4/32 and appgateway) are illustrative only. Use the runbook or the Azure portal for actual IPs and VM names. Port ranges, service endpoints, and NSG rule names are required configuration.

App gateway

An app gateway is deployed as follows:

  • Method: Using the infrastructure options and created in the infrastructure recovery group.

  • Name pattern: The VM is created with the prefix appgateway and the job ID appended.

  • Purpose: Provides gateway connectivity for recovered workload VMs that do not have direct internet access; it enables those VMs to reach the control plane and required Azure services.

  • Auto Proxies server group: App gateway VMs are included in the Auto Proxies server group when database or Active Directory workloads are present.

Subnet service endpoints

Infrastructure subnet service endpoints:

  • Microsoft.Storage.Global

Workload subnet service endpoints:

  • Microsoft.Storage.Global
  • Microsoft.Sql
  • Microsoft.AzureActiveDirectory

Infrastructure NSG rules

The infrastructure NSG is updated with the following additional rules when database or Active Directory workloads are present:

Direction Priority Name Port Protocol Source Destination Action Purpose
Inbound 190 AllowAllCVTrafficInbound-190 8403 Any Any Any Allow Allows CVD/cvd port connections required by access nodes and proxies
Inbound 193 AllowWorkloadSubnetInboundRule Any Any 10.0.0.0/17 Any Allow Allows inbound connections from the workload subnet
Outbound 181 AllowWorkloadSubnetOutboundRule 135,139,445,49152-65535 Any Any 10.0.0.0/17 Allow Allows SMB/RPC/ephemeral ports to the workload subnet

Workload NSG rules

The workload NSG (recovered resources) is updated with the following additional rules:

Direction Priority Name Port Protocol Source Destination Action Purpose
Inbound 180 AllowInfraSubnetInbound 135,139,445,49152-65535 Any 10.0.128.0/18 Any Allow Allows SMB/RPC/ephemeral traffic from the infrastructure subnet
Outbound 190 NetworkTopologyRule-190 8403,443 Any Any 4.194.145.4/32 Allow Allows traffic to the App Gateway IP (devtest example)
Outbound 193 AllowInfraSubnetOutbound Any Any Any 10.0.128.0/18 Allow Allows outbound access to the infrastructure subnet
Outbound 198 AzureNetworkRule 443 Any Any AzureCloud Allow Allows outbound access to AzureCloud services

Default auto-scaling

When you use default auto-scaling in Commvault, which is recommended in most cases, the following resources are created.

Azure resources

The following resources are created in your cleanroom recovery Azure subscription.

Resource Name Created in Purpose Details
Virtual network (VNet) [runbook]-[region]-VNet [runbook]-RG Provides a network container for access nodes None
Subnet [runbook]-[region]Infra-Subnet Workload VNet Provides address space for infrastructure resources Allocated from infrastructure range (default 10.0.128.0/18)
Configured in the cleanroom site advanced options
Network security group (NSG) and rules [runbook]-[region]-Infra-NSG [runbook]-RG Controls inbound and outbound traffic Commvault-applied defaults: DenyAllInBound and DenyAllOutBound rules are added to block all inbound and outbound traffic unless explicitly allowed.
Exceptions:
Allow inbound traffic from the Bastion subnet
Allow outbound traffic to Azure Storage and AzureCloud (configured in the cleanroom site advanced options)
Includes NetworkTopologyRule to allow cvd port connections (8400–8403)
Auto-scaled access nodes are bound to interfaces governed by this NSG
Subnet AzureBastionSubnet Workload VNet Provides address space for infrastructure resources Allocated from infrastructure range (default 10.0.128.0/18)
Configured in the cleanroom site advanced options
NAT gateway [runbook]-[region]-Infra-NAT Workload VNet Provides outbound connectivity Associated with the infrastructure subnet
Uses a public IP for external communication

NSG rules for infrastructure workloads (auto-scaled access nodes)

The following NSG rules are created to allow secure access in the SaaS for recovering resources into the cleanroom site.

Direction Priority Name Port Protocol Source Destination
Inbound 199 AllowBastionSubnetInbound Any Any 10.0.192.0/18 Any
Inbound 200 AllowWithinSubnetInbound Any Any 10.0.128.0/18 Any
Inbound 4000 DenyAllInbound Any Any Any Any
Inbound 65000 AllowVnetInbound Any Any VirtualNetwork VirtualNetwork
Inbound 65001 AllowAzureLoadBalancerInbound Any Any AzureLoadBalancer Any
Inbound 65500 DenyAllInbound Any Any Any Any
Outbound 190 NetworkTopologyRule-190 443 Any Any 10.171.3.136
Outbound 195 AllowDNSOutbound 53 Any Any 168.63.129.16
Outbound 196 AllowAllOutboundTemporary 443 Any Any Any
Outbound 197 AzureSMBRule 445 Any Any Storage
Outbound 198 AzureNetworkRule 443 Any Any AzureCloud
Outbound 200 AllowWithinSubnetOutbound Any Any 10.0.128.0/18 Any
Outbound 4000 DenyAllOutbound Any Any Any Any
Outbound 65000 AllowVnetOutbound Any Any VirtualNetwork VirtualNetwork
Outbound 65001 AllowInternetOutbound Any Any Any Internet
Outbound 65500 DenyAllOutbound Any Any Any Any

Created in Commvault control plane (Commvault software only)

The following resources are created in your Commvault control plane.

Name Purpose Details
Control Plane server group Provides recovery control components Contains MediaAgents, auto-scaled access nodes, and the control plane.
Auto Proxies server group Provides temporary access capacity Runs auto-scaled access nodes deployed during cleanroom recovery.
Network topology Provides recovery communication One-way connection from the Auto Proxies server group to the Control Plane server group to support secure communication between the control plane and auto-scaled access nodes.
×

Loading...