快速入门:使用 Azure 应用程序网关定向 Web 流量 - Azure 门户Quickstart: Direct web traffic with Azure Application Gateway - Azure portal

本快速入门介绍如何使用 Azure 门户创建应用程序网关。This quickstart shows you how to use the Azure portal to create an application gateway. 创建应用程序网关后,可对其进行测试,以确保正常工作。After creating the application gateway, you test it to make sure it's working correctly. 使用 Azure 应用程序网关可为端口分配侦听器、创建规则以及向后端池添加资源,以便将应用程序 Web 流量定向到特定资源。With Azure Application Gateway, you direct your application web traffic to specific resources by assigning listeners to ports, creating rules, and adding resources to a backend pool. 为方便演示,本文使用了一种简单的设置,其中包括一个公共前端 IP、一个用于在此应用程序网关上托管单个站点的基本侦听器、两个用于后端池的虚拟机,以及一个基本请求路由规则。For the sake of simplicity, this article uses a simple setup with a public front-end IP, a basic listener to host a single site on this application gateway, two virtual machines used for the backend pool, and a basic request routing rule.

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a Trial before you begin.

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

登录 AzureSign in to Azure

使用 Azure 帐户登录到 Azure 门户Sign in to the Azure portal with your Azure account.

创建应用程序网关Create an application gateway

Azure 需要一个虚拟网络才能在创建的资源之间通信。For Azure to communicate between the resources that you create, it needs a virtual network. 可以创建新的虚拟网络,或者使用现有的虚拟网络。You can either create a new virtual network or use an existing one. 本示例将创建新的虚拟网络。In this example, you'll create a new virtual network. 可以在创建应用程序网关的同时创建虚拟网络。You create a virtual network at the same time that you create the application gateway. 在独立的子网中创建应用程序网关实例。Application Gateway instances are created in separate subnets. 在本示例中创建两个子网:一个用于应用程序网关,另一个用于后端服务器。You create two subnets in this example: one for the application gateway, and another for the backend servers.

  1. 选择 Azure 门户左侧菜单上的“创建资源” 。Select Create a resource on the left menu of the Azure portal. 此时会显示“新建”窗口。 The New window appears.

  2. 选择“网络” ,然后在“特色”列表中选择“应用程序网关” 。Select Networking and then select Application Gateway in the Featured list.

“基本信息”页面Basics page

  1. 在“基本信息”页上,输入这些值作为以下应用程序网关设置: On the Basics page, enter these values for the following application gateway settings:

    • 名称:输入 myAppGateway 作为应用程序网关的名称。Name: Enter myAppGateway for the name of the application gateway.

    • 资源组:选择 myResourceGroupAG 作为资源组。Resource group: Select myResourceGroupAG for the resource group. 如果该资源组不存在,请选择“新建”,创建一个新的 。If it doesn't exist, select Create new to create it.

      新建应用程序网关

  2. 接受其他设置的默认值,然后选择“确定” 。Accept the default values for the other settings and then select OK.

“设置”页Settings page

  1. 在“设置” 页的“子网配置” 下,选择“选择虚拟网络” 。On the Settings page, under Subnet configuration, select Choose a virtual network.

  2. 在“选择虚拟网络”页上,选择“新建”,然后为以下虚拟网络设置输入相应值: On the Choose virtual network page, select Create new, and then enter values for the following virtual network settings:

    • 名称:输入 myVNet 作为虚拟网络的名称。Name: Enter myVNet for the name of the virtual network.

    • 地址空间:输入 10.0.0.0/16 作为虚拟网络地址空间。Address space: Enter 10.0.0.0/16 for the virtual network address space.

    • 子网名称:输入 myAGSubnet 作为子网名称。Subnet name: Enter myAGSubnet for the subnet name.
      应用程序网关子网只能包含应用程序网关。The application gateway subnet can contain only application gateways. 不允许其他资源。No other resources are allowed.

    • 子网地址范围:输入 10.0.0.0/24 作为子网地址范围。Subnet address range: Enter 10.0.0.0/24 for the subnet address range.

      创建虚拟网络

  3. 选择“确定”,返回到“设置”页。 Select OK to return to the Settings page.

  4. 选择“前端 IP 配置”。 Choose the Frontend IP configuration. 在“前端 IP 配置” 下,验证“IP 地址类型” 是否设置为“公共” 。Under Frontend IP configuration, verify IP address type is set to Public. 在“公共 IP 地址”下, 验证是否已选择“新建” 。Under Public IP address, verify Create new is selected.
    可根据用例将前端 IP 配置为公共或专用 IP。You can configure the Frontend IP to be Public or Private as per your use case. 本示例将选择公共前端 IP。In this example, you'll choose a Public Frontend IP.

  5. 输入 myAGPublicIPAddress 作为公共 IP 地址名称。Enter myAGPublicIPAddress for the public IP address name.

  6. 接受其他设置的默认值,然后选择“确定” 。Accept the default values for the other settings and then select OK.
    为简单起见,将在本文中选择默认值,但你可以根据用例为其他设置配置自定义值You will choose default values in this article for simplicity but you can configure custom values for the other settings depending on your use case

“摘要”页Summary page

复查摘要页上的设置,然后选择“确定” 以创建虚拟网络、公共 IP 地址和应用程序网关。Review the settings on the Summary page, and then select OK to create the virtual network, the public IP address, and the application gateway. Azure 可能需要数分钟时间来创建应用程序网关。It may take several minutes for Azure to create the application gateway. 请等待部署成功完成,然后再前进到下一部分。Wait until the deployment finishes successfully before moving on to the next section.

添加后端池Add backend pool

后端池用于将请求路由到为请求提供服务的后端服务器。The backend pool is used to route requests to the backend servers that serve the request. 后端池可以包含 NIC、虚拟机规模集、公共 IP、内部 IP、完全限定的域名 (FQDN) 和多租户后端(例如 Azure 应用服务)。Backend pools can be composed of NICs, virtual machine scale sets, public IPs, internal IPs, fully qualified domain names (FQDN), and multi-tenant back-ends like Azure App Service. 会将后端目标添加到后端池。You'll add your backend targets to a backend pool.

本示例将使用虚拟机作为目标后端。In this example, you'll use virtual machines as the target backend. 可以使用现有的虚拟机,或创建新的虚拟机。You can either use existing virtual machines or create new ones. 将创建两个虚拟机,供 Azure 用作应用程序网关的后端服务器。You'll create two virtual machines that Azure uses as backend servers for the application gateway.

为此,将要:To do this, you'll:

  1. 创建新的子网 myBackendSubnet,我们将在该子网中创建新的 VM。Create a new subnet, myBackendSubnet, in which the new VMs will be created.
  2. 创建两个新的 VM(myVM 和 myVM2),用作后端服务器 。Create two new VMs, myVM and myVM2, to be used as backend servers.
  3. 在虚拟机上安装 IIS,以验证是否成功创建了应用程序网关。Install IIS on the virtual machines to verify that the application gateway was created successfully.
  4. 将后端服务器添加到后端池。Add the backend servers to the backend pool.

添加子网Add a subnet

按以下步骤将子网添加到已创建的虚拟网络:Add a subnet to the virtual network you created by following these steps:

  1. 在 Azure 门户的左侧菜单上选择“所有资源”,在搜索框中输入 myVNet,然后从搜索结果中选择 myVNetSelect All resources on the left menu of the Azure portal, enter myVNet in the search box, and then select myVNet from the search results.

  2. 从左侧菜单选择“子网” ,然后选择“+ 子网”。 Select Subnets from the left menu and then select + Subnet.

    创建子网

  3. 在“添加子网”页中输入 myBackendSubnet 作为子网的名称,然后选择“确定”。 From the Add subnet page, enter myBackendSubnet for the Name of the subnet, and then select OK.

创建虚拟机Create a virtual machine

  1. 在 Azure 门户中,选择“创建资源”。 On the Azure portal, select Create a resource. 此时会显示“新建”窗口。 The New window appears.

  2. 选择“计算”,然后在“特色”列表中选择“Windows Server 2016 Datacenter”。 Select Compute and then select Windows Server 2016 Datacenter in the Featured list. 此时会显示“创建虚拟机”页。 The Create a virtual machine page appears.
    应用程序网关可将流量路由到其后端池中使用的任何类型的虚拟机。Application Gateway can route traffic to any type of virtual machine used in its backend pool. 本示例使用 Windows Server 2016 Datacenter。In this example, you use a Windows Server 2016 Datacenter.

  3. 对于以下虚拟机设置,请在“基本信息”选项卡中输入相应值: Enter these values in the Basics tab for the following virtual machine settings:

    • 资源组:选择 myResourceGroupAG 作为资源组名称。Resource group: Select myResourceGroupAG for the resource group name.
    • 虚拟机名称:输入 myVM 作为虚拟机的名称。Virtual machine name: Enter myVM for the name of the virtual machine.
    • 用户名:输入 azureuser 作为管理员用户名。Username: Enter azureuser for the administrator user name.
    • 密码:输入 Azure123456!Password: Enter Azure123456! 作为管理员密码。for the administrator password.
  4. 接受其他默认值,然后选择“下一步:磁盘”Accept the other defaults and then select Next: Disks.

  5. 接受“磁盘”选项卡的默认值,然后选择“下一步:网络”Accept the Disks tab defaults and then select Next: Networking.

  6. 在“网络” 选项卡上,验证是否已选择 myVNet 作为虚拟网络,以及是否已将“子网” 设置为 myBackendSubnetOn the Networking tab, verify that myVNet is selected for the Virtual network and the Subnet is set to myBackendSubnet. 接受其他默认值,然后选择“下一步:管理”Accept the other defaults and then select Next: Management.
    应用程序网关可与其所在的虚拟网络外部的实例进行通信,但需要确保已建立 IP 连接。Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.

  7. 在“管理” 选项卡上,将“启动诊断” 设置为“关闭”。 On the Management tab, set Boot diagnostics to Off. 接受其他默认值,然后选择“复查 + 创建”。 Accept the other defaults and then select Review + create.

  8. 在“复查 + 创建”选项卡上复查设置,更正任何验证错误,然后选择“创建”。 On the Review + create tab, review the settings, correct any validation errors, and then select Create.

  9. 等待虚拟机创建完成,然后再继续操作。Wait for the virtual machine creation to complete before continuing.

安装 IIS 用于测试Install IIS for testing

本示例在虚拟机上安装 IIS,只为验证 Azure 是否已成功创建应用程序网关。In this example, you install IIS on the virtual machines only to verify Azure created the application gateway successfully.

  1. 在 PowerShell 中使用以下命令登录到 Azure 门户:Log in to the Azure portal in powershell with command below:

    Connect-AzAccount -Environment AzureChinaCloud
    
  2. 运行以下命令以在虚拟机上安装 IIS:Run the following command to install IIS on the virtual machine:

    Set-AzVMExtension `
      -ResourceGroupName myResourceGroupAG `
      -ExtensionName IIS `
      -VMName myVM `
      -Publisher Microsoft.Compute `
      -ExtensionType CustomScriptExtension `
      -TypeHandlerVersion 1.4 `
      -SettingString '{"commandToExecute":"powershell Add-WindowsFeature Web-Server; powershell Add-Content -Path \"C:\\inetpub\\wwwroot\\Default.htm\" -Value $($env:computername)"}' `
      -Location ChinaNorth
    
  3. 使用以前完成的步骤创建第二个虚拟机并安装 IIS。Create a second virtual machine and install IIS by using the steps that you previously completed. 使用 myVM2 作为虚拟机名称,以及作为 Set-AzVMExtension cmdlet 的 VMName 设置。Use myVM2 for the virtual machine name and for the VMName setting of the Set-AzVMExtension cmdlet.

将后端服务器添加到后端池Add backend servers to backend pool

  1. 选择“所有资源”,然后选择“myAppGateway”。 Select All resources, and then select myAppGateway.

  2. 从左侧菜单中选择“后端池”。 Select Backend pools from the left menu. 当你创建应用程序网关时,Azure 自动创建了默认池 appGatewayBackendPoolAzure automatically created a default pool, appGatewayBackendPool, when you created the application gateway.

  3. 选择“appGatewayBackendPool” 。Select appGatewayBackendPool.

  4. 在“目标” 下,从下拉列表中选择“虚拟机”。 Under Targets, select Virtual machine from the drop-down list.

  5. 在“虚拟机”和“网络接口” 下,从下拉列表中选择 myVMmyVM2 虚拟机及其关联的网络接口。Under VIRTUAL MACHINE and NETWORK INTERFACES, select the myVM and myVM2 virtual machines and their associated network interfaces from the drop-down lists.

    添加后端服务器

  6. 选择“其他安全性验证” 。Select Save.

测试应用程序网关Test the application gateway

虽然不需 IIS 即可创建应用程序网关,但本快速入门中安装了它,用来验证 Azure 是否已成功创建应用程序网关。Although IIS isn't required to create the application gateway, you installed it in this quickstart to verify whether Azure successfully created the application gateway. 使用 IIS 测试应用程序网关:Use IIS to test the application gateway:

  1. 在“概览”页上找到应用程序网关的公共 IP 地址。 Find the public IP address for the application gateway on its Overview page.

    记下应用程序网关的公共 IP 地址

    或者,可以选择“所有资源”,在搜索框中输入“myAGPublicIPAddress” ,然后在搜索结果中将其选中 。Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure 会在“概览”页上显示公共 IP 地址。 Azure displays the public IP address on the Overview page.

  2. 复制该公共 IP 地址,并将其粘贴到浏览器的地址栏。Copy the public IP address, and then paste it into the address bar of your browser.

  3. 检查响应。Check the response. 有效响应验证应用程序网关是否已成功创建,以及是否能够成功连接后端。A valid response verifies that the application gateway was successfully created and can successfully connect with the backend.

    测试应用程序网关

清理资源Clean up resources

如果不再需要通过应用程序网关创建的资源,请删除资源组。When you no longer need the resources that you created with the application gateway, remove the resource group. 删除资源组时,也会删除应用程序网关和及其所有的相关资源。By removing the resource group, you also remove the application gateway and all its related resources.

若要删除资源组,请执行以下操作:To remove the resource group:

  1. 在 Azure 门户的左侧菜单上选择“资源组” 。On the left menu of the Azure portal, select Resource groups.
  2. 在“资源组”页的列表中搜索“myResourceGroupAG”,然后将其选中。 On the Resource groups page, search for myResourceGroupAG in the list, then select it.
  3. 在“资源组”页上,选择“删除资源组” 。On the Resource group page, select Delete resource group.
  4. 在“键入资源组名称”字段中输入“myResourceGroupAG”,然后选择“删除” Enter myResourceGroupAG for TYPE THE RESOURCE GROUP NAME and then select Delete

后续步骤Next steps