Azure Stack Hub 数据中心 DNS 集成Azure Stack Hub datacenter DNS integration

若要能够从 Azure Stack Hub 外部访问 Azure Stack Hub 终结点(例如门户adminportal管理adminmanagement),需将 Azure Stack Hub DNS 服务与托管 DNS 区域(要在 Azure Stack Hub 中使用)的 DNS 服务器集成。To be able to access Azure Stack Hub endpoints such as portal, adminportal, management, and adminmanagement from outside Azure Stack Hub, you need to integrate the Azure Stack Hub DNS services with the DNS servers that host the DNS zones you want to use in Azure Stack Hub.

Azure Stack Hub DNS 命名空间Azure Stack Hub DNS namespace

部署 Azure Stack Hub 时,必须提供与 DNS 相关的一些重要信息。You're required to provide some important information related to DNS when you deploy Azure Stack Hub.

字段Field 说明Description 示例Example
区域Region Azure Stack Hub 部署的地理位置。The geographic location of your Azure Stack Hub deployment. east
外部域名External Domain Name 需要用于 Azure Stack Hub 部署的区域的名称。The name of the zone you want to use for your Azure Stack Hub deployment. cloud.fabrikam.com
内部域名Internal Domain Name 在 Azure Stack Hub 中用于基础结构服务的内部区域的名称。The name of the internal zone that's used for infrastructure services in Azure Stack Hub. 它是目录服务集成的和专用的(无法从 Azure Stack Hub 部署外部访问)。It's Directory Service-integrated and private (not reachable from outside the Azure Stack Hub deployment). azurestack.local
DNS 转发器DNS Forwarders 一种 DNS 服务器,用于转发托管在 Azure Stack Hub 外部的 DNS 查询、DNS 区域和记录,不管是在公司 Intranet 上还是公共 Internet 上。DNS servers that are used to forward DNS queries, DNS zones, and records that are hosted outside Azure Stack Hub, either on the corporate intranet or public internet. 部署后,可以使用 Set-AzSDnsForwarder cmdlet 编辑 DNS 转发器值。You can edit the DNS Forwarder value with the Set-AzSDnsForwarder cmdlet after deployment.
命名前缀(可选)Naming Prefix (Optional) 需要在 Azure Stack Hub 基础结构角色实例计算机名称中使用的命名前缀。The naming prefix you want your Azure Stack Hub infrastructure role instance machine names to have. 如果不提供,则默认值为 azsIf not provided, the default is azs. azs

Azure Stack Hub 部署和终结点的完全限定域名 (FQDN) 是区域参数和外部域名参数的组合。The fully qualified domain name (FQDN) of your Azure Stack Hub deployment and endpoints is the combination of the Region parameter and the External Domain Name parameter. 使用上表中示例的值时,此 Azure Stack Hub 部署的 FQDN 将是以下名称:Using the values from the examples in the previous table, the FQDN for this Azure Stack Hub deployment would be the following name:

east.cloud.fabrikam.com

同样,此部署的部分终结点的示例将如以下 URL 所示:As such, examples of some of the endpoints for this deployment would look like the following URLs:

https://portal.east.cloud.fabrikam.com

https://adminportal.east.cloud.fabrikam.com

若要使用 Azure Stack Hub 部署的这个示例 DNS 命名空间,需要满足以下条件:To use this example DNS namespace for an Azure Stack Hub deployment, the following conditions are required:

  • 区域 fabrikam.com 已注册到域注册机构和/或公司内部 DNS 服务器,具体取决于名称解析要求。The zone fabrikam.com is registered either with a domain registrar, an internal corporate DNS server, or both, depending on your name resolution requirements.
  • 子域 cloud.fabrikam.com 存在于区域 fabrikam.com 下。The child domain cloud.fabrikam.com exists under the zone fabrikam.com.
  • 托管区域 fabrikam.comcloud.fabrikam.com 的 DNS 服务器可以从 Azure Stack Hub 部署访问。The DNS servers that host the zones fabrikam.com and cloud.fabrikam.com can be reached from the Azure Stack Hub deployment.

若要从 Azure Stack Hub 外部解析 Azure Stack Hub 终结点和实例的 DNS 名称,需将为 Azure Stack Hub 托管外部 DNS 区域的 DNS 服务器与托管需要使用的父区域的 DNS 服务器集成。To be able to resolve DNS names for Azure Stack Hub endpoints and instances from outside Azure Stack Hub, you need to integrate the DNS servers that host the external DNS zone for Azure Stack Hub with the DNS servers that host the parent zone you want to use.

DNS 名称标签DNS name labels

Azure Stack Hub 支持向公共 IP 地址添加 DNS 名称标签,以允许对公共 IP 地址进行名称解析。Azure Stack Hub supports adding a DNS name label to a public IP address to allow name resolution for public IP addresses. DNS 标签是一种方便用户通过名称访问 Azure Stack Hub 中托管的应用和服务的方法。DNS labels are a convenient way for users to reach apps and services hosted in Azure Stack Hub by name. DNS 名称标签使用的命名空间与基础结构终结点略有不同。The DNS name label uses a slightly different namespace than the infrastructure endpoints. 按照前面的示例命名空间,DNS 名称标签的命名空间如下所示:Following the previous example namespace, the namespace for DNS name labels appears as follows:

*.east.cloudapp.cloud.fabrikam.com

因此,如果租户在公共 IP 地址资源的 DNS 名称标签字段中指定值 Myapp,则会在 Azure Stack Hub 外部 DNS 服务器上的 east.cloudapp.cloud.fabrikam.com 区域中为 myapp 创建一条 A 记录。Therefore, if a tenant indicates a value Myapp in the DNS name label field of a public IP address resource, it creates an A record for myapp in the zone east.cloudapp.cloud.fabrikam.com on the Azure Stack Hub external DNS server. 生成的完全限定域名如下所示:The resulting fully qualified domain name appears as follows:

myapp.east.cloudapp.cloud.fabrikam.com

如果要利用此功能并使用此命名空间,则必须将托管 Azure Stack Hub 的外部 DNS 区域的 DNS 服务器与托管也要使用的父区域的 DNS 服务器集成。If you want to leverage this functionality and use this namespace, you must integrate the DNS servers that host the external DNS zone for Azure Stack Hub with the DNS servers that host the parent zone you want to use as well. 这是一个与 Azure Stack Hub 服务终结点的命名空间不同的命名空间,因此你必须创建一个额外的委托或条件转发规则。This is a different namespace than the namespace for the Azure Stack Hub service endpoints, so you must create an additional delegation or conditional forwarding rule.

有关 DNS 名称标签的工作原理的详细信息,请参阅在 Azure Stack Hub 中使用 DNSFor more information about how the DNS Name label works, see Using DNS in Azure Stack Hub.

解析和委托Resolution and delegation

有两种类型的 DNS 服务器:There are two types of DNS servers:

  • 权威 DNS 服务器托管 DNS 区域。An authoritative DNS server hosts DNS zones. 它只应答这些区域中的 DNS 记录查询。It answers DNS queries for records in those zones only.
  • 递归 DNS 服务器不托管 DNS 区域。A recursive DNS server doesn't host DNS zones. 它调用权威 DNS 服务器来收集所需的数据,以应答所有 DNS 查询。It answers all DNS queries by calling authoritative DNS servers to gather the data it needs.

Azure Stack Hub 包括权威 DNS 服务器和递归 DNS 服务器。Azure Stack Hub includes both authoritative and recursive DNS servers. 递归服务器用于解析所有项的名称,该 Azure Stack Hub 部署的内部专用区域和外部公用 DNS 区域除外。The recursive servers are used to resolve names of everything except for the internal private zone and the external public DNS zone for that Azure Stack Hub deployment.

Azure Stack Hub DNS 体系结构

通过 Azure Stack Hub 解析外部 DNS 名称Resolving external DNS names from Azure Stack Hub

若要解析 Azure Stack Hub 外部终结点的 DNS 名称(例如:www.bing.com),需提供可供 Azure Stack Hub 用来转发 DNS 请求的 DNS 服务器(Azure Stack Hub 对这些请求来说并不权威)。To resolve DNS names for endpoints outside Azure Stack Hub (for example: www.bing.com), you need to provide DNS servers that Azure Stack Hub can use to forward DNS requests for which Azure Stack Hub isn't authoritative. 进行部署时,DNS 服务器(Azure Stack Hub 向其转发请求)在部署工作表(位于“DNS 转发器”字段中)中是必需的。For deployment, DNS servers that Azure Stack Hub forwards requests to are required in the Deployment Worksheet (in the DNS Forwarder field). 请在此字段中提供至少两个服务器,目的是容错。Provide at least two servers in this field for fault tolerance. 没有这些值,Azure Stack Hub 部署会失败。Without these values, Azure Stack Hub deployment fails. 部署后,可以使用 Set-AzSDnsForwarder cmdlet 编辑 DNS 转发器值。You can edit the DNS Forwarder values with the Set-AzSDnsForwarder cmdlet after deployment.

配置条件性 DNS 转发Configure conditional DNS forwarding

重要

这仅适用于 AD FS 部署。This only applies to an AD FS deployment.

若要通过现有的 DNS 基础结构启用名称解析,请配置条件性转发。To enable name resolution with your existing DNS infrastructure, configure conditional forwarding.

若要添加条件性转发器,必须使用特权终结点。To add a conditional forwarder, you must use the privileged endpoint.

对于此过程,请使用能够与 Azure Stack Hub 中的特权终结点通信的数据中心网络中的计算机。For this procedure, use a computer in your datacenter network that can communicate with the privileged endpoint in Azure Stack Hub.

  1. 打开提升了权限的 Windows PowerShell 会话(以管理员身份运行),连接到特权终结点的 IP 地址。Open an elevated Windows PowerShell session (run as administrator), and connect to the IP address of the privileged endpoint. 使用进行 CloudAdmin 身份验证的凭据。Use the credentials for CloudAdmin authentication.

    $cred=Get-Credential 
    Enter-PSSession -ComputerName <IP Address of ERCS> -ConfigurationName PrivilegedEndpoint -Credential $cred
    
  2. 连接到特权终结点后,运行以下 PowerShell 命令。After you connect to the privileged endpoint, run the following PowerShell command. 将提供的示例值替换为要使用的 DNS 服务器的域名和 IP 地址。Substitute the sample values provided with your domain name and IP addresses of the DNS servers you want to use.

    Register-CustomDnsServer -CustomDomainName "contoso.com" -CustomDnsIPAddresses "192.168.1.1","192.168.1.2"
    

从 Azure Stack Hub 外部解析 Azure Stack Hub DNS 名称Resolving Azure Stack Hub DNS names from outside Azure Stack Hub

权威服务器是指保存了外部 DNS 区域信息以及任何用户创建的区域的服务器。The authoritative servers are the ones that hold the external DNS zone information, and any user-created zones. 与这些服务器集成即可启用区域委托或条件性转发,以便从 Azure Stack Hub 外部解析 Azure Stack Hub DNS 名称。Integrate with these servers to enable zone delegation or conditional forwarding to resolve Azure Stack Hub DNS names from outside Azure Stack Hub.

获取 DNS 服务器外部终结点信息Get DNS Server external endpoint information

若要将 Azure Stack Hub 部署与 DNS 基础结构集成,需提供以下信息:To integrate your Azure Stack Hub deployment with your DNS infrastructure, you need the following information:

  • DNS 服务器 FQDNDNS server FQDNs
  • DNS 服务器 IP 地址DNS server IP addresses

Azure Stack Hub DNS 服务器的 FQDN 具有以下格式:The FQDNs for the Azure Stack Hub DNS servers have the following format:

<NAMINGPREFIX>-ns01.<REGION>.<EXTERNALDOMAINNAME>

<NAMINGPREFIX>-ns02.<REGION>.<EXTERNALDOMAINNAME>

使用示例值时,DNS 服务器的 FQDN 如下所示:Using the sample values, the FQDNs for the DNS servers are:

azs-ns01.east.cloud.fabrikam.com

azs-ns02.east.cloud.fabrikam.com

在名为 AzureStackStampInformation.json 的文件中,此信息也会在所有 Azure Stack Hub 部署的末尾创建。This information is also created at the end of all Azure Stack Hub deployments in a file named AzureStackStampInformation.json. 该文件位于部署虚拟机的 C:\CloudDeployment\logs 文件夹中。This file is located in the C:\CloudDeployment\logs folder of the Deployment virtual machine. 如果不确定对 Azure Stack Hub 部署使用了什么值,可以从该文件中获取这些值。If you're not sure what values were used for your Azure Stack Hub deployment, you can get the values from here.

如果部署虚拟机不再可用或无法访问,则可连接到特权终结点并运行 Get-AzureStackStampInformation PowerShell cmdlet,以便获取这些值。If the Deployment virtual machine is no longer available or is inaccessible, you can obtain the values by connecting to the privileged endpoint and running the Get-AzureStackStampInformation PowerShell cmdlet. 有关详细信息,请参阅特权终结点For more information, see privileged endpoint.

设置到 Azure Stack Hub 的条件性转发Setting up conditional forwarding to Azure Stack Hub

若要将 Azure Stack Hub 与 DNS 基础结构集成,最简单也最安全的方式是将区域从托管父区域的服务器进行条件性转发。The simplest and most secure way to integrate Azure Stack Hub with your DNS infrastructure is to do conditional forwarding of the zone from the server that hosts the parent zone. 如果可以直接控制为 Azure Stack Hub 外部 DNS 命名空间托管父区域的 DNS 服务器,建议使用此方法。This approach is recommended if you have direct control over the DNS servers that host the parent zone for your Azure Stack Hub external DNS namespace.

如果你不熟悉如何使用 DNS 进行条件转发,请参阅以下 TechNet 文章:为域名分配条件转发器,或特定于 DNS 解决方案的文档。If you're not familiar with how to do conditional forwarding with DNS, see the following TechNet article: Assign a Conditional Forwarder for a Domain Name, or the documentation specific to your DNS solution.

如果已将外部 Azure Stack Hub DNS 区域指定为类似公司域名的子域那样,则无法使用条件性转发。In scenarios where you specified your external Azure Stack Hub DNS Zone to look like a child domain of your corporate domain name, conditional forwarding can't be used. 必须配置 DNS 委托。DNS delegation must be configured.

示例:Example:

  • 公司 DNS 域名:contoso.comCorporate DNS Domain Name: contoso.com
  • Azure Stack Hub 外部 DNS 域名:azurestack.contoso.comAzure Stack Hub External DNS Domain Name: azurestack.contoso.com

编辑 DNS 转发器 IPEditing DNS Forwarder IPs

DNS 转发器 IP 是在 Azure Stack Hub 部署期间设置的。DNS Forwarder IPs are set during deployment of Azure Stack Hub. 但是,如果由于任何原因需要更新转发器 IP,则可以通过连接到特权终结点并运行 Get-AzSDnsForwarderSet-AzSDnsForwarder [[-IPAddress] <IPAddress[]>] PowerShell cmdlet 来编辑值。However, if the Forwarder IPs need to be updated for any reason, you can edit the values by connecting to the privileged endpoint and running the Get-AzSDnsForwarder and Set-AzSDnsForwarder [[-IPAddress] <IPAddress[]>] PowerShell cmdlets. 有关详细信息,请参阅特权终结点For more information, see privileged endpoint.

将外部 DNS 区域委托到 Azure Stack HubDelegating the external DNS zone to Azure Stack Hub

若要从 Azure Stack Hub 部署外部来解析 DNS 名称,需设置 DNS 委托。For DNS names to be resolvable from outside an Azure Stack Hub deployment, you need to set up DNS delegation.

每个注册机构都有自身的 DNS 管理工具,可以更改域的名称服务器记录。Each registrar has their own DNS management tools to change the name server records for a domain. 在注册机构的 DNS 管理页中,请编辑 NS 记录并将区域的 NS 记录替换为 Azure Stack Hub 中的相应记录。In the registrar's DNS management page, edit the NS records and replace the NS records for the zone with the ones in Azure Stack Hub.

大多数 DNS 注册机构要求至少提供两个 DNS 服务器才能完成委托。Most DNS registrars require you to provide a minimum of two DNS servers to complete the delegation.

后续步骤Next steps

防火墙集成Firewall integration