Security rules in Active Passive Panorama

[Ramakrishnan]

Hi There, 

I have two A/A firewall pairs in Primary Azure locations (WEU) and two A/A firewall pair in DR azure location(NEU).

And I have setup Panorama in Active & Passive mode.

In DR scenario I am aware that, WEU Panorama failover and fall back to NEU Panorama to Manage WEU location firewall pair. 

In another DR scenario as described below diagram if its a partial DR failover (Only App2 ) switch over to DR site how I could effective place the rule..? Is that something Am missing best practice 

For App1 <--> App2 communication Creating Address group like below 

ADGrp_App1 (10.10.0.1 & 10.20.0.1) and ADGrp_App2 (10.10.0.2 & 10.20.0.2)

In Security Policy Source: ADGrp_App1 Destination: ADGrp_App2