Configure vSwitch and security group mappings so that your Elastic Compute Service (ECS) instances maintain network connectivity and security policies when they fail over to the disaster recovery (DR) site.
Prerequisites
Before you begin, make sure that you have:
A configured site pair between your production site and DR site (see Step 1: Plan resources and Step 2: Create a site pair)
At least one vSwitch in each VPC (production and DR)
(Optional) Pre-created security groups at the DR site if you do not plan to use automatic creation
Go to the Network & Security tab
Both mapping procedures start from the same location. Complete these steps once, then follow the procedure for each mapping type.
Log on to the Cloud Backup console.
In the left-side navigation pane, choose Disaster Recovery > ECS Disaster Recovery.
If you are not using EBS Async Replication, click Switch to EBS Async Replication.
On the Site Pairs tab, click your site pair, and then click the Network & Security tab.
Add a vSwitch mapping
A vSwitch mapping links a production-site vSwitch to a DR-site vSwitch. During failover, each ECS instance launches into the mapped DR vSwitch.
On the vSwitch Mapping tab, click Add vSwitch Mapping.
In the Add vSwitch Mapping dialog box, select the vSwitches for the production site and the DR site.
Click OK.
The new mapping appears on the vSwitch Mapping tab.
To modify or remove a mapping, click Edit or Delete in the Operation column.
Add a security group mapping
A security group mapping links a production-site security group to a DR-site security group. Security group rules control inbound and outbound traffic for ECS instances, so a correct mapping keeps your access policies consistent across sites.
On the Security Group Mapping tab, click Add Security Group Mapping.
In the Add Security Group Mapping dialog box, configure the following settings:
Setting Description Production Site Security Group The security group used by the ECS instance at the production site. Automatically Create Security Group at DR Site If you turn on the switch, a security group is automatically created at the disaster recovery site. Security Group at DR Site The security group used by the ECS instance at the disaster recovery site. Automatically Sync Rules Turn on this switch to synchronize security group rules from the production site to the DR site. This keeps inbound and outbound rules identical across both sites. 
Click OK.
The new mapping appears on the Security Group Mapping tab.
To modify or remove a mapping, click Edit or Delete in the Operation column.
What to do next
After you configure vSwitch and security group mappings, proceed to Step 4: Create a protection group to begin protecting your ECS instances.