How does the switchover between the primary and backup data centers work in Disaster Recovery mode?

Short answer

In a domain in Disaster Recovery mode, the addresses of each record are kept in two groups: Main DC and DR DC; of these two data centers selected in the domain form, one is the local data center and the other is a remote data center defined on the Remote Devices screen. DNS Service normally answers only with the healthy addresses of the Main DC (active-passive). When the condition in the record's Disaster Recovery Condition field occurs (by default, when no healthy address remains in the Main DC), the answers pass to the healthy addresses of the DR DC, and when the condition is cleared, with the default settings they return to the Main DC on their own. The switchover is per record and changes only the DNS answer; its effect on the clients depends on the record's TTL.

How Does It Work?

For each record, the following evaluation is repeated whenever health check, health scenario or data center information changes:

1. Health filtering: Each address in the two groups is considered healthy or unhealthy according to its own HC condition.
2. Switchover decision: If Disaster Recovery Condition is Automatic (when no healthy primary records left), the switchover to DR is made when no healthy address remains in the Main DC; if a health scenario is selected, it is made while the scenario is active (What are the Disaster Recovery conditions; is the switchover automatic or manual?).
3. Answer: The healthy addresses of the selected group are returned in the answer with Balance Algorithm. In DR, if there is no healthy address in the DR DC either, Fail-Safe Records are returned; if there are no Fail-Safe Records, the record passes to the No healthy records status.
4. Return: At the first evaluation in which the condition is cleared, the answers are given from the Main DC again.

Under the default condition, if only some of the addresses in the Main DC are unhealthy, no switchover is made; the answers are given with the remaining healthy addresses and the record appears in the Partially OK (a record is down) status.

Disaster Recovery in TR7

What	Where
Selection of the Main DC and the DR DC	In the domain form, Default Mode = Disaster Recovery; one of the two groups is the local data center. The remote data center is first defined on the Remote Devices screen.
Addresses	The Main DC and DR DC groups in the record form; a separate HC condition for each address (Record form in Disaster Recovery mode).
Switchover condition	Disaster Recovery Condition and Disaster Recovery on No Healthy Records in the record form.
Monitoring	In the Records list, the yellow Status value DR and Disaster recovery is on in the Summary column; the switchover condition and the latest switchovers in the record preview; <name>/<type>: DR is on and <name>/<type>: DR ended on the GTM Logs screen.
Cluster	Each device calculates the status of the record itself; a separate status per device is seen in the list (How does GTM behave in a cluster?).

Common Misconceptions

• "DR switchover moves open connections to the backup data center." GTM changes only the DNS answer; clients go to the new address when the TTL expires and they query again (What does a record's TTL determine; how should it be chosen in GTM?).
• "When an address in the Main DC goes down, the switchover to DR is made." The default condition is that no healthy address at all remains in the Main DC; in a partial failure, the remaining addresses of the Main DC are used.
• "DR DC addresses are also included in the answer under normal conditions." Operation is active-passive; the addresses of the DR DC are returned only under the switchover condition. For distribution to the two data centers together, Datacenter mode is used (How is traffic distributed across data centers in Datacenter mode?).
• "The switchover is made for the whole domain at once." Each record has its own condition; in the same domain, one record can be in DR while another is in the Main DC. To switch several records together, the same health scenario is selected as the condition of these records.

How it is done in the documentation

• Domains · Disaster Recovery
• Records · In the Disaster Recovery Mode
• Records · Disaster Recovery Condition
• Records · The Record Status Values

Related questions

• What are the Disaster Recovery conditions; is the switchover automatic or manual?
• What is the difference between the Standalone, Disaster Recovery and Datacenter modes?
• What is a Remote Device; how does GTM monitor a remote data center?
• For redundancy across data centers, should I use Load Balancer or GTM?