ASR A2A Connectivity Requirements

The Azure VMs you replicate need outbound connectivity. Site Recovery never needs inbound connectivity to the VM.

Outbound connectivity (URLs)

If outbound access for VMs is controlled with URLs, allow these URLs.

URL	Details
*.blob.core.windows.net	Allows data to be written from the VM to the cache storage account in the source region.
login.microsoftonline.com	Provides authorization and authentication to Site Recovery service URLs.
*.hypervrecoverymanager.windowsazure.com	Allows the VM to communicate with the Site Recovery service.
*.servicebus.windows.net	Allows the VM to write Site Recovery monitoring and diagnostics data.

Outbound connectivity for IP address ranges

To control outbound connectivity for VMs using IP addresses, allow these addresses.

Source region rules

Rule	Details	Service tag
Allow HTTPS outbound: port 443	Allow ranges that correspond to storage accounts in the source region	Storage.<region-name>.
Allow HTTPS outbound: port 443	Allow ranges that correspond to Azure Active Directory (Azure AD). If Azure AD addresses are added in future you need to create new Network Security Group (NSG) rules.	AzureActiveDirectory
Allow HTTPS outbound: port 443	Allow access to Site Recovery endpoints that correspond to the target location.

Target region rules

Rule	Details	Service tag
Allow HTTPS outbound: port 443	Allow ranges that correspond to storage accounts in the target region.	Storage.<region-name>.
Allow HTTPS outbound: port 443	Allow ranges that correspond to Azure AD. If Azure AD addresses are added in future you need to create new NSG rules.	AzureActiveDirectory
Allow HTTPS outbound: port 443	Allow access to Site Recovery endpoints that correspond to the source location.

NSG rules for the source Azure region should allow outbound access for replication traffic.

For ASR replication process and policy check below link :

https://pachehra.blogspot.com/2019/06/asr-rep.html

https://pachehra.blogspot.com/2019/06/rp.html