As very well explained in this article from the Exchange Team Blog, in Exchange 2013 the CAS Server acts as a stateless proxy to the mailbox database server where the requested mailbox is currently active on. So even if the CAS answering your clients' request is in the DR site, the connection is always proxied to the mailbox servers in the primary site (provided all your database copies are activated in the main site).
If you want to prevent any "random" connections to the CAS in the secondary site, you will have to deploy a "bound" namespace model with separate namespaces for each site.
But if it is ok for you to have about half of your connections be proxied by the DR CAS Server (and since you are using a stretched VLAN, I assume latency and bandwidth are not a big issue) then by keeping the namespace unified you are greatly simplifying your environment.
Alternatively, if you do not want to use the secondary CAS server except for DR and you are willing to update the configuration manually when required, you could point the DNS entry to the CAS server(s) in the main site only, set it with a low TTL and update it to point to the CAS server(s) in the secondary DNS when needed. In this case you might also probably want to prevent the mailbox database in the secondary site to be activated:
Set-MailboxServer <secondary mailbox server> –DatabaseCopyAutoActivationPolicy Blocked
But again, this removes any automation from the failover mechanism, so if you have only one mailbox or CAS servers in the primary site and any of those fail, then your users will not be able to connect until you manually update the configuration.
I would also make sure that all your databases are currently active in the main datacenter only by running:
Get-MailboxDatabaseCopyStatus -Identity <Main Exchange Database Server> | Format-List
If the Status
is different from mounted for any given database then that DB is active on a different server, possible in the secondary site.
Ultimately, it very much depends on how many Exchange Servers you have deployed (and whether they are multi-role or not), the namespace model you are using and the mechanism you have adopted to distribute the load among them (DNS round robin, hardware load balancer, etc.)
As a last note, if you haven't done it already, you should look at configuring Datacenter Activation Coordination Mode