Failover & Failback

This guide covers recovering a VM on the recovery site and returning it home. All actions are on the VM's Replication tab under ACTIONS ▾.

Choose the operation that fits your situation:

Operation	When to use	Data loss
Test failover	Rehearse recovery without touching production.	None (production keeps running).
Planned failover	Scheduled maintenance / clean relocation, source still healthy.	None.
Unplanned failover	Primary site is down or unreachable.	Up to your RPO.

---

Test failover (DR drill)

Verifies the replica boots — without disrupting production or pausing replication.

1. ACTIONS ▾ → Test Failover → keep power-on enabled → Start Drill.
2. Cockpit clones the latest recovery point on the recovery site and boots it on an isolated ("bubble") network, so it can't conflict with the running production VM.
3. Open the recovered VM's console and verify the OS and services.
4. ACTIONS ▾ → Stop Test Failover — powers off the sandbox VM and deletes the temporary clones.

TIP

Run a drill periodically to confirm recovery points are bootable and your network/guest-re-addressing settings are correct.

---

Planned failover (graceful switchover)

Zero-data-loss relocation when the source is still healthy.

1. ACTIONS ▾ → Planned Migration / Failover → choose whether to power on at the target → Start.
2. Cockpit: gracefully shuts down the source VM → runs a final catch-up sync → boots the VM on the recovery site (applying your network map and guest re-addressing).
3. The source registration is marked inactive.

---

Unplanned failover (disaster)

When the primary site is offline.

1. On the recovery site, open the VM's Replication tab → ACTIONS ▾ → Emergency / Unplanned Failover → confirm.
2. Cockpit skips source shutdown and the final sync, boots the VM on the recovery site from the last successful recovery point, and applies the network map + guest re-addressing.

Large VMs may report a timeout while still recovering

For a large disk, the failover can take several minutes and the request may return a timeout even though the recovery VM booted successfully. Before retrying, check the recovery site — if the recovered VM is running, the failover completed. (Tracked for a fix so the operation returns immediately and finishes in the background.)

---

Reprotect & failback

After an unplanned failover, the workload runs at the recovery site with no protection. Reverse the direction, then return home when the primary site is healthy.

1. Reprotect (reverse replication)

1. On the site now running the VM, open the VM's Replication tab → ACTIONS ▾ → Reprotect.
2. Cockpit reverses the endpoints and starts replicating from the current site back toward the original site. Wait for the reverse baseline to finish; health returns to OK.

Reverse pairing

Reprotect/failback need the reverse site pair to exist (recovery → primary). If you only paired primary → recovery, add the reverse pair first (see Configure replication).

2. Failback (return to the original site)

1. Once the reverse replication is caught up, run a Planned Failover from the recovery site back to the original site (clean shutdown → final sync → boot at origin).
2. Optionally Reprotect again from the original site to restore the normal primary → recovery direction.