# Move the VM: lift with a replica, or rebuild on purpose Source: https://ai.techclick.in/blog_migrate_vm_lift_vs_rebuild Markdown: https://ai.techclick.in/blog_migrate_vm_lift_vs_rebuild.md Publisher: Techclick Infosec Pvt Ltd Azure Migrate or AWS MGN for lift. Rebuild rotting OS. Test IP, DNS, cert. Do not change all three one night. ## The ticket OS on pay-api is still supportable. Junior wants to “use the move to upgrade to Ubuntu, change the hostname, issue a new cert, and point DNS at 10.41.1.40” in one change. That is three migrations wearing a rehost badge. The replica is fine. The plan is not. Quick interview answer Lift = Azure Migrate (agentless or agent-based) or AWS Application Migration Service (MGN) continuous block replication, test instance, then cutover. Rebuild when the OS is out of support, the image is unclean, or the target is PaaS (App Service, ECS/Fargate). On cutover you prove one of IP / DNS / auth at a time, with a written rollback. Do not change IP and DNS and auth in the same night without that rollback. Hero · replica not rewrite A healthy replica is not permission to redesign the app. Lab data · dummy only On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40 . ## Mental model Path Tool pay-api Lift / rehost Azure Migrate or AWS MGN Wave-1 — same OS, same svc-pay Rebuild Image + pipeline / App Service / ECS When OS is rotting or you want PaaS Test instance Migrate test / MGN launch test 10.41.1.40 or 10.51.1.40 — isolated name Cutover Planned failover / MGN cutover After test. One variable + rollback. Two doors, one wave - pay-api 10.20.30.40 Lift · Migrate/MGN wave-1 Rebuild / PaaS later or if OS is dead 10.41.1.40 / 10.51.1.40 test name + cert not prod DNS yet Test instance uses a test FQDN. Production DNS flips in the cutover lesson. https://console.aws.amazon.com/mgn/home Training mock · not live AWS console Organizations VPC IAM Identity Center Application Migration Security Hub Application Migration Service → Source servers ### pay-api Source 10.20.30.40 · agent installed · healthy replication Staging subnet in hub/app — not a public /28 leftover Launch test 10.51.1.40 · sg-web · isolated Ready for cutover After test: HTTP 200 on test name, cert SAN matches test name Azure twin Azure Migrate: same idea, target 10.41.1.40 in spoke Cancel Save AWS MGN. Training mock. Azure Migrate is the twin tool. ## How to choose Signal Lift Rebuild OS in support, app is a black box Yes — this lab No 2008 R2 / SMBv1 / no owner of the image Only as a temporary jail Yes Target is App Service / ECS No — that is not a VM lift Yes — different program You want a new hostname + new IdP tonight Stop That is three changes — sequence them ## Runbook #### Side A — replicate Azure Migrate appliance or MGN agent on 10.20.30.40 . Wait until lag is boring. Do not “cut over to see.” - #### Side B — test launch Launch into spoke 10.41.1.40 or app 10.51.1.40 . Test FQDN pay-api-test.techclick-lab.in . Cert SAN = that name. Do not touch the production A record. - #### Side C — one variable If test IP works and test name works, you have earned a cutover window. You have not earned a domain leave + new cert CN + DNS flip in the same change. test prove · dummy # Azure az migrate show --name pay-api --resource-group rg-migrate # replicationHealth: Healthy # AWS aws mgn describe-source-servers --filters "sourceServerIDs=s-payapi" # dataReplicationInfo.lagDuration: PT0S lifeCycle.state: READY_FOR_TEST curl -sk --resolve pay-api-test.techclick-lab.in:443:10.41.1.40 https://pay-api-test.techclick-lab.in/health # 200 · do not flip pay-api.techclick-lab.in yet ## Four failures ### 1 · Rotting OS lift as a strategy You just paid to host an incident. Rebuild, or rehost into a jail with a 30-day rebuild date. ### 2 · Test cutover using production DNS Half the clients follow the low TTL. You are in production without a window. ### 3 · IP + DNS + auth same night Three failures, one rollback story. Change one. Keep the other two stable. ### 4 · No rollback disk On-prem VM powered off and deleted “to save license.” You now have a one-way door. ## How to prove it Close only when 1) Replication healthy. 2) Test instance answers on a test name. 3) Cert SAN matches that name. 4) Production A record is still 10.20.30.40 . 5) On-prem VM is still intact. ## Traps Tool says You still check Ready for cutover Did a human hit the test URL? Test VM running IP, name, cert — which of the three did you prove? Agent healthy Is the landing zone the target, or a dirty sub? ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Wave-1 tool for a supportable pay-api OS? Azure Migrate or AWS MGN Rebuild to App Service tonight Export-VM to a USB ExpressRoute first Correct: a . Lift. Q2 Rebuild is the right first move when… The VM pings The OS is rotting or the target is PaaS You have a VPN DNS TTL is 300 Correct: b . Choose. Q3 Test instance DNS should be… The production name immediately A test FQDN; leave pay-api.techclick-lab.in on 10.20.30.40 Only an IP in a wiki A new Entra password Correct: b . Failure 2. Q4 Changing IP, DNS, and auth the same night is… Efficient Three variables — refuse without sequenced rollback Required by MGN The 6 R “retain” Correct: b . Ticket. Q5 Dummy Azure lift address in this lab? 10.41.1.40 10.20.30.40 203.0.113.50 10.50.0.4 Correct: a . Spoke. Q6 After a test launch, production on-prem VM should be… Deleted to save a license Intact — you have not cut over Rebuilt in place Promoted to dc02 Correct: b . Failure 4. Check answers Reset On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview ## Sources - Azure Migrate — services overview . - AWS Application Migration Service (MGN) . - Azure CAF — Migrate . - AWS migration strategy — rehost vs replatform vs refactor . Related: Azure landing zone · AWS Org / OU . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt