通过 Azure CLI 使用应用程序网关管理 Web 流量Manage web traffic with an application gateway using the Azure CLI

应用程序网关用于管理和保护传入你维护的服务器的 Web 流量。Application gateway is used to manage and secure web traffic to servers that you maintain. 可以使用 Azure CLI 创建使用虚拟机规模集作为后端服务器的应用程序网关You can use the Azure CLI to create an application gateway that uses a virtual machine scale set for backend servers. 在此示例中,规模集包含两个虚拟机实例。In this example, the scale set contains two virtual machine instances. 规模集将添加到应用程序网关的默认后端池。The scale set is added to the default backend pool of the application gateway.

在本文中,学习如何:In this article, you learn how to:

  • 设置网络Set up the network
  • 创建应用程序网关Create an application gateway
  • 使用默认后端池创建虚拟机规模集Create a virtual machine scale set with the default backend pool

如果需要,可以使用 Azure PowerShell 完成此过程。If you prefer, you can complete this procedure using Azure PowerShell.

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a Trial before you begin.

如果选择在本地安装并使用 CLI,本快速入门要求运行 Azure CLI 2.0.4 或更高版本。If you choose to install and use the CLI locally, this quickstart requires you to run the Azure CLI version 2.0.4 or later. 若要查找版本,请运行 az --versionTo find the version, run az --version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

创建资源组Create a resource group

资源组是在其中部署和管理 Azure 资源的逻辑容器。A resource group is a logical container into which Azure resources are deployed and managed. 使用 az group create 创建资源组。Create a resource group using az group create.

以下示例在“chinanorth” 位置创建名为“myResourceGroupAG” 的资源组。The following example creates a resource group named myResourceGroupAG in the chinanorth location.

az group create --name myResourceGroupAG --location chinanorth

创建网络资源Create network resources

使用 az network vnet create 创建名为 myVNet 的虚拟网络和名为 myAGSubnet 的子网。Create the virtual network named myVNet and the subnet named myAGSubnet using az network vnet create. 然后,可以使用 az network vnet subnet create 添加后端服务器所需的名为 myBackendSubnet 的子网。You can then add the subnet named myBackendSubnet that's needed by the backend servers using az network vnet subnet create. 使用 az network public-ip create 创建名为 myAGPublicIPAddress 的公共 IP 地址。Create the public IP address named myAGPublicIPAddress using az network public-ip create.

az network vnet create `
  --name myVNet `
  --resource-group myResourceGroupAG `
  --location chinanorth `
  --address-prefix 10.0.0.0/16 `
  --subnet-name myAGSubnet `
  --subnet-prefix 10.0.1.0/24

az network vnet subnet create `
  --name myBackendSubnet `
  --resource-group myResourceGroupAG `
  --vnet-name myVNet `
  --address-prefix 10.0.2.0/24

az network public-ip create `
  --resource-group myResourceGroupAG `
  --name myAGPublicIPAddress

创建应用程序网关Create an application gateway

使用 az network application-gateway create 创建名为 myAppGateway 的应用程序网关。Use az network application-gateway create to create the application gateway named myAppGateway. 使用 Azure CLI 创建应用程序网关时,请指定配置信息,例如容量、sku 和 HTTP 设置。When you create an application gateway using the Azure CLI, you specify configuration information, such as capacity, sku, and HTTP settings. 将应用程序网关分配给之前创建的 myAGSubnetmyPublicIPAddressThe application gateway is assigned to myAGSubnet and myPublicIPAddress that you previously created.

az network application-gateway create `
  --name myAppGateway `
  --location chinanorth `
  --resource-group myResourceGroupAG `
  --vnet-name myVNet `
  --subnet myAGsubnet `
  --capacity 2 `
  --sku Standard_Medium `
  --http-settings-cookie-based-affinity Disabled `
  --frontend-port 80 `
  --http-settings-port 80 `
  --http-settings-protocol Http `
  --public-ip-address myAGPublicIPAddress

创建应用程序网关可能需要几分钟时间。It may take several minutes for the application gateway to be created. 创建应用程序网关后,会看到以下新功能:After the application gateway is created, you'll see these new features:

  • appGatewayBackendPool - 应用程序网关必须至少具有一个后端地址池。appGatewayBackendPool - An application gateway must have at least one backend address pool.
  • appGatewayBackendHttpSettings - 指定将端口 80 和 HTTP 协议用于通信。appGatewayBackendHttpSettings - Specifies that port 80 and an HTTP protocol is used for communication.
  • appGatewayHttpListener - 与 appGatewayBackendPool 关联的默认侦听器。appGatewayHttpListener - The default listener associated with appGatewayBackendPool.
  • appGatewayFrontendIP - 将 myAGPublicIPAddress 分配给 appGatewayHttpListenerappGatewayFrontendIP - Assigns myAGPublicIPAddress to appGatewayHttpListener.
  • rule1 - 与 appGatewayHttpListener 关联的默认路由规则。rule1 - The default routing rule that is associated with appGatewayHttpListener.

创建虚拟机规模集Create a Virtual Machine Scale Set

在此示例中,将创建虚拟机规模集,以便为应用程序网关的后端池提供服务器。In this example, you create a virtual machine scale set that provides servers for the backend pool in the application gateway. 规模集中的虚拟机与 myBackendSubnetappGatewayBackendPool 相关联。The virtual machines in the scale set are associated with myBackendSubnet and appGatewayBackendPool. 若要创建规模集,请使用 az vmss createTo create the scale set, use az vmss create.

az vmss create `
  --name myvmss `
  --resource-group myResourceGroupAG `
  --image UbuntuLTS `
  --admin-username azureuser `
  --admin-password Azure123456! `
  --instance-count 2 `
  --vnet-name myVNet `
  --subnet myBackendSubnet `
  --vm-sku Standard_DS2 `
  --upgrade-policy-mode Automatic `
  --app-gateway myAppGateway `
  --backend-pool-name appGatewayBackendPool

安装 NGINXInstall NGINX

现在,可以在虚拟机规模集上安装 NGINX,以便测试与后端池的 HTTP 连接。Now you can install NGINX on the virtual machine scale set so you can test HTTP connectivity to the backend pool.

az vmss extension set `
  --publisher Microsoft.Azure.Extensions `
  --version 2.0 `
  --name CustomScript `
  --resource-group myResourceGroupAG `
  --vmss-name myvmss `
  --settings '{ "fileUris": ["https://raw.githubusercontent.com/Azure/azure-docs-powershell-samples/master/application-gateway/iis/install_nginx.sh"], "commandToExecute": "./install_nginx.sh" }'

测试应用程序网关Test the application gateway

若要获取应用程序网关的公共 IP 地址,请使用 az network public-ip showTo get the public IP address of the application gateway, use az network public-ip show. 复制该公共 IP 地址,并将其粘贴到浏览器的地址栏。Copy the public IP address, and then paste it into the address bar of your browser.

az network public-ip show `
  --resource-group myResourceGroupAG `
  --name myAGPublicIPAddress `
  --query [ipAddress] `
  --output tsv

在应用程序网关中测试基 URL

清理资源Clean up resources

当不再需要资源组、应用程序网关以及所有相关资源时,请将其删除。When no longer needed, remove the resource group, application gateway, and all related resources.

az group delete --name myResourceGroupAG --location chinanorth

后续步骤Next steps

使用 Web 应用程序防火墙限制 Web 流量Restrict web traffic with a web application firewall