I want to replicate virtual machines that are at client sites to our cluster. Our cluster is 3 hyper-v's clustered together with san as storage. The cluster is in the domain. The replica broker is configured but has the same subnet as the cluster as it picks up only host network.

So is it possible to replicate offsite Vms into our cluster from different domains.

rough setup picture

  • I am worried about creating the VPN between a client site and replica broker subnet as replica broker subnet is the same as my domain subnet and the hyperv hosts in the cluster are in the domain.

Is there any way we can replicate vritual machines from different sites to our cluster without issues?

Is replicating using port 443 a recommended method?


It's possible to replicate offsite VMs, from different domains, into your Cluster. You just have to keep in mind that:

Hyper-V Replica will not function if the source host cannot verify the identity of the target host and vice versa. This is a good thing, but it can also be a bothersome thing. You have two options: Kerberos authentication and certificate-based authentication.

Case 1: If those sites are connected with a VPN tunnel, you could setup TRUSTS between Active Directory domains or Active Directory forests (depending on your situation) and then use Kerberos as an authentication method. In that case, Hyper-V replica traffic will default to port 80 and run unencrypted, but you have a VPN connection so that should be fine.

Case 2: You don’t wanna or can’t set up a Trust relationship between those two domains – Then You use Certificate based authentication, and if so, You shouldn’t use a VPN connection between those two sites for Hyper-V replica, because with Cert. Auth. all traffic is encrypted (As long as the hosts' private keys are adequately protected, it’s as safe as much as anything can be to transmit certificate-based Hyper-V Replica traffic directly across the Internet).

Here is a nice post.

If your replica traffic will directly traverse an unsecured network (the Internet), do not use Kerberos authentication. The source and replica servers will securely authenticate each other’s identities, but the replica traffic is not encrypted. However, if you are using a secure tunnel such as a site-to-site VPN, then feel free to use Kerberos. There is little value in using an encrypted tunnel to carry encrypted traffic. Also, because certificate-based encryption is asymmetrical, the encrypted packets are much larger than the unencrypted source. Double encryption dramatically increases the payload size.

And for the part about VPN and subnets:

I am worried about creating the VPN between a client site and replica broker subnet as the replica broker subnet is the same as my domain subnet and the Hyper-V hosts in the cluster are in the domain.

To create a VPN or not depends on the path you chose. In any case, I don’t see a problem in having a Replica broker on the same subnet as your Domain subnet and the Hyper-V hosts. My only concern would be a Replica traffic bandwidth utilization and its impact on my network. Keep in mind that Hyper-V Replica allows you to perform the initial replication using portable media.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.