通过 Azure PowerShell 使用 SSL 终端创建应用程序网关Create an application gateway with SSL termination using Azure PowerShell

可通过 Azure PowerShell 使用 SSL 终端的证书创建使用虚拟机规模集作为后端服务器的应用程序网关You can use Azure PowerShell to create an application gateway with a certificate for SSL termination that uses a virtual machine scale set for backend servers. 在此示例中,规模集包含两个添加到应用程序网关的默认后端池的虚拟机实例。In this example, the scale set contains two virtual machine instances that are added to the default backend pool of the application gateway.

本教程介绍如何执行下列操作:In this tutorial, you learn how to:

  • 创建自签名证书Create a self-signed certificate
  • 设置网络Set up a network
  • 使用证书创建应用程序网关Create an application gateway with the certificate
  • 使用默认后端池创建虚拟机规模集Create a virtual machine scale set with the default backend pool

如果没有 Azure 订阅,请在开始前创建一个试用帐户If you don't have an Azure subscription, create a Trial Account before you begin.

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

本教程需要 Azure PowerShell 模块 1.0.0 或更高版本。This tutorial requires the Azure PowerShell module version 1.0.0 or later. 运行 Get-Module -ListAvailable Az 即可查找版本。Run Get-Module -ListAvailable Az to find the version. 如果需要升级,请参阅安装 Azure PowerShell 模块If you need to upgrade, see Install Azure PowerShell module. 如果在本地运行 PowerShell,则还需运行 Login-AzAccount -Environment AzureChinaCloud 来创建与 Azure 的连接。If you are running PowerShell locally, you also need to run Login-AzAccount -Environment AzureChinaCloud to create a connection with Azure.

创建自签名证书Create a self-signed certificate

为供生产使用,应导入由受信任的提供程序签名的有效证书。For production use, you should import a valid certificate signed by trusted provider. 对于本教程,请使用 New-SelfSignedCertificate 创建自签名证书。For this tutorial, you create a self-signed certificate using New-SelfSignedCertificate. 可以结合返回的指纹使用 Export-PfxCertificate,从证书导出 pfx 文件。You can use Export-PfxCertificate with the Thumbprint that was returned to export a pfx file from the certificate.

New-SelfSignedCertificate `
  -certstorelocation cert:\localmachine\my `
  -dnsname www.contoso.com

应会显示如下结果所示的内容:You should see something like this result:

PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\my

Thumbprint                                Subject
----------                                -------
E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630  CN=www.contoso.com

使用指纹创建 pfx 文件:Use the thumbprint to create the pfx file:

$pwd = ConvertTo-SecureString -String "Azure123456!" -Force -AsPlainText

Export-PfxCertificate `
  -cert cert:\localMachine\my\E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 `
  -FilePath c:\appgwcert.pfx `
  -Password $pwd

创建资源组Create a resource group

资源组是在其中部署和管理 Azure 资源的逻辑容器。A resource group is a logical container into which Azure resources are deployed and managed. 使用 New-AzResourceGroup 创建名为 myResourceGroupAG 的 Azure 资源组。Create an Azure resource group named myResourceGroupAG with New-AzResourceGroup.

New-AzResourceGroup -Name myResourceGroupAG -Location chinanorth

创建网络资源Create network resources

使用 New-AzVirtualNetworkSubnetConfig 配置名为 myBackendSubnetmyAGSubnet 的子网。Configure the subnets named myBackendSubnet and myAGSubnet using New-AzVirtualNetworkSubnetConfig. 使用 New-AzVirtualNetwork 和子网配置创建名为 myVNet 的虚拟网络。Create the virtual network named myVNet using New-AzVirtualNetwork with the subnet configurations. 最后使用 New-AzPublicIpAddress 创建名为 myAGPublicIPAddress 的公共 IP 地址。And finally, create the public IP address named myAGPublicIPAddress using New-AzPublicIpAddress. 这些资源用于提供与应用程序网关及其关联资源的网络连接。These resources are used to provide network connectivity to the application gateway and its associated resources.

$backendSubnetConfig = New-AzVirtualNetworkSubnetConfig `
  -Name myBackendSubnet `
  -AddressPrefix 10.0.1.0/24

$agSubnetConfig = New-AzVirtualNetworkSubnetConfig `
  -Name myAGSubnet `
  -AddressPrefix 10.0.2.0/24

$vnet = New-AzVirtualNetwork `
  -ResourceGroupName myResourceGroupAG `
  -Location chinanorth `
  -Name myVNet `
  -AddressPrefix 10.0.0.0/16 `
  -Subnet $backendSubnetConfig, $agSubnetConfig

$pip = New-AzPublicIpAddress `
  -ResourceGroupName myResourceGroupAG `
  -Location chinanorth `
  -Name myAGPublicIPAddress `
  -AllocationMethod Dynamic

创建应用程序网关Create an application gateway

创建 IP 配置和前端端口Create the IP configurations and frontend port

使用 New-AzApplicationGatewayIPConfiguration 将前面创建的 myAGSubnet 关联到应用程序网关。Associate myAGSubnet that you previously created to the application gateway using New-AzApplicationGatewayIPConfiguration. 使用 New-AzApplicationGatewayFrontendIPConfigmyAGPublicIPAddress 分配给应用程序网关。Assign myAGPublicIPAddress to the application gateway using New-AzApplicationGatewayFrontendIPConfig.

$vnet = Get-AzVirtualNetwork `
  -ResourceGroupName myResourceGroupAG `
  -Name myVNet

$subnet=$vnet.Subnets[0]

$gipconfig = New-AzApplicationGatewayIPConfiguration `
  -Name myAGIPConfig `
  -Subnet $subnet

$fipconfig = New-AzApplicationGatewayFrontendIPConfig `
  -Name myAGFrontendIPConfig `
  -PublicIPAddress $pip

$frontendport = New-AzApplicationGatewayFrontendPort `
  -Name myFrontendPort `
  -Port 443

创建后端池和设置Create the backend pool and settings

使用 New-AzApplicationGatewayBackendAddressPool 为应用程序网关创建名为 appGatewayBackendPool 的后端池。Create the backend pool named appGatewayBackendPool for the application gateway using New-AzApplicationGatewayBackendAddressPool. 使用 New-AzApplicationGatewayBackendHttpSettings 配置后端池的设置。Configure the settings for the backend pool using New-AzApplicationGatewayBackendHttpSettings.

$defaultPool = New-AzApplicationGatewayBackendAddressPool `
  -Name appGatewayBackendPool

$poolSettings = New-AzApplicationGatewayBackendHttpSettings `
  -Name myPoolSettings `
  -Port 80 `
  -Protocol Http `
  -CookieBasedAffinity Enabled `
  -RequestTimeout 120

创建默认侦听器和规则Create the default listener and rule

应用程序网关需要侦听器才能适当地将流量路由到后端池。A listener is required to enable the application gateway to route traffic appropriately to the backend pool. 在此示例中,将一个创建基本侦听器以侦听根 URL 上的 HTTPS 流量。In this example, you create a basic listener that listens for HTTPS traffic at the root URL.

使用 New-AzApplicationGatewaySslCertificate 创建证书对象,然后结合前端配置、前端端口和前面创建的证书使用 New-AzApplicationGatewayHttpListener 创建名为 mydefaultListener 的侦听器。Create a certificate object using New-AzApplicationGatewaySslCertificate and then create a listener named mydefaultListener using New-AzApplicationGatewayHttpListener with the frontend configuration, frontend port, and certificate that you previously created. 侦听器需要使用规则来了解哪个后端池使用传入流量。A rule is required for the listener to know which backend pool to use for incoming traffic. 使用 New-AzApplicationGatewayRequestRoutingRule 创建一个名为 rule1 的基本规则。Create a basic rule named rule1 using New-AzApplicationGatewayRequestRoutingRule.

$pwd = ConvertTo-SecureString `
  -String "Azure123456!" `
  -Force `
  -AsPlainText

$cert = New-AzApplicationGatewaySslCertificate `
  -Name "appgwcert" `
  -CertificateFile "c:\appgwcert.pfx" `
  -Password $pwd

$defaultlistener = New-AzApplicationGatewayHttpListener `
  -Name mydefaultListener `
  -Protocol Https `
  -FrontendIPConfiguration $fipconfig `
  -FrontendPort $frontendport `
  -SslCertificate $cert

$frontendRule = New-AzApplicationGatewayRequestRoutingRule `
  -Name rule1 `
  -RuleType Basic `
  -HttpListener $defaultlistener `
  -BackendAddressPool $defaultPool `
  -BackendHttpSettings $poolSettings

使用证书创建应用程序网关Create the application gateway with the certificate

现在已创建所需的支持资源,请使用 New-AzApplicationGatewaySku 为名为 myAppGateway 的应用程序网关指定参数,然后结合证书使用 New-AzApplicationGateway 创建网关。Now that you created the necessary supporting resources, specify parameters for the application gateway named myAppGateway using New-AzApplicationGatewaySku, and then create it using New-AzApplicationGateway with the certificate.

创建应用程序网关Create the application gateway

$sku = New-AzApplicationGatewaySku `
  -Name Standard_Medium `
  -Tier Standard `
  -Capacity 2

$appgw = New-AzApplicationGateway `
  -Name myAppGateway `
  -ResourceGroupName myResourceGroupAG `
  -Location chinanorth `
  -BackendAddressPools $defaultPool `
  -BackendHttpSettingsCollection $poolSettings `
  -FrontendIpConfigurations $fipconfig `
  -GatewayIpConfigurations $gipconfig `
  -FrontendPorts $frontendport `
  -HttpListeners $defaultlistener `
  -RequestRoutingRules $frontendRule `
  -Sku $sku `
  -SslCertificates $cert

创建虚拟机规模集Create a virtual machine scale set

在此示例中,将创建虚拟机规模集,以便为应用程序网关的后端池提供服务器。In this example, you create a virtual machine scale set to provide servers for the backend pool in the application gateway. 配置 IP 设置时将规模集分配给后端池。You assign the scale set to the backend pool when you configure the IP settings.

$vnet = Get-AzVirtualNetwork `
  -ResourceGroupName myResourceGroupAG `
  -Name myVNet

$appgw = Get-AzApplicationGateway `
  -ResourceGroupName myResourceGroupAG `
  -Name myAppGateway

$backendPool = Get-AzApplicationGatewayBackendAddressPool `
  -Name appGatewayBackendPool `
  -ApplicationGateway $appgw

$ipConfig = New-AzVmssIpConfig `
  -Name myVmssIPConfig `
  -SubnetId $vnet.Subnets[1].Id `
  -ApplicationGatewayBackendAddressPoolsId $backendPool.Id

$vmssConfig = New-AzVmssConfig `
  -Location chinanorth `
  -SkuCapacity 2 `
  -SkuName Standard_DS2 `
  -UpgradePolicyMode Automatic

Set-AzVmssStorageProfile $vmssConfig `
  -ImageReferencePublisher MicrosoftWindowsServer `
  -ImageReferenceOffer WindowsServer `
  -ImageReferenceSku 2016-Datacenter `
  -ImageReferenceVersion latest `
  -OsDiskCreateOption FromImage

Set-AzVmssOsProfile $vmssConfig `
  -AdminUsername azureuser `
  -AdminPassword "Azure123456!" `
  -ComputerNamePrefix myvmss

Add-AzVmssNetworkInterfaceConfiguration `
  -VirtualMachineScaleSet $vmssConfig `
  -Name myVmssNetConfig `
  -Primary $true `
  -IPConfiguration $ipConfig

New-AzVmss `
  -ResourceGroupName myResourceGroupAG `
  -Name myvmss `
  -VirtualMachineScaleSet $vmssConfig

安装 IISInstall IIS

$publicSettings = @{ "fileUris" = (,"https://raw.githubusercontent.com/Azure/azure-docs-powershell-samples/master/application-gateway/iis/appgatewayurl.ps1"); 
  "commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File appgatewayurl.ps1" }

$vmss = Get-AzVmss -ResourceGroupName myResourceGroupAG -VMScaleSetName myvmss

Add-AzVmssExtension -VirtualMachineScaleSet $vmss `
  -Name "customScript" `
  -Publisher "Microsoft.Compute" `
  -Type "CustomScriptExtension" `
  -TypeHandlerVersion 1.8 `
  -Setting $publicSettings

Update-AzVmss `
  -ResourceGroupName myResourceGroupAG `
  -Name myvmss `
  -VirtualMachineScaleSet $vmss

测试应用程序网关Test the application gateway

可以使用 Get-AzPublicIPAddress 获取应用程序网关的公共 IP 地址。You can use Get-AzPublicIPAddress to get the public IP address of the application gateway. 复制该公共 IP 地址,并将其粘贴到浏览器的地址栏。Copy the public IP address, and then paste it into the address bar of your browser.

Get-AzPublicIPAddress -ResourceGroupName myResourceGroupAG -Name myAGPublicIPAddress

安全警告

若要接受有关使用自签名证书的安全警告,请依次选择“详细信息”和“继续转到网页”。To accept the security warning if you used a self-signed certificate, select Details and then Go on to the webpage. 随即显示受保护的 IIS 网站,如下例所示:Your secured IIS website is then displayed as in the following example:

在应用程序网关中测试基 URL

清理资源Clean up resources

如果不再需要资源组、应用程序网关和所有相关资源,可以使用 Remove-AzResourceGroup 将其删除。When no longer needed, remove the resource group, application gateway, and all related resources using Remove-AzResourceGroup.

Remove-AzResourceGroup -Name myResourceGroupAG

后续步骤Next steps

在本教程中,你已学习了如何执行以下操作:In this tutorial, you learned how to:

  • 创建自签名证书Create a self-signed certificate
  • 设置网络Set up a network
  • 使用证书创建应用程序网关Create an application gateway with the certificate
  • 使用默认后端池创建虚拟机规模集Create a virtual machine scale set with the default backend pool