使用 Azure PowerShell 创建 Azure Bastion 主机Create an Azure Bastion host using Azure PowerShell

本文介绍如何使用 PowerShell 创建 Azure Bastion 主机。This article shows you how to create an Azure Bastion host using PowerShell. 在虚拟网络中预配 Azure Bastion 服务后,即可在该虚拟网络中的所有 VM 上获得无缝的 RDP/SSH 体验。Once you provision the Azure Bastion service in your virtual network, the seamless RDP/SSH experience is available to all of the VMs in the same virtual network. Azure Bastion 部署是按虚拟网络进行的,而不是按订阅/帐户或虚拟机进行的。Azure Bastion deployment is per virtual network, not per subscription/account or virtual machine.

或者,可使用 Azure 门户创建 Azure Bastion 主机。Optionally, you can create an Azure Bastion host by using the Azure portal.

先决条件Prerequisites

确保拥有 Azure 订阅。Verify that you have an Azure subscription. 如果还没有 Azure 订阅,可以激活 MSDN 订户权益或注册试用帐户If you don't already have an Azure subscription, you can activate your MSDN subscriber benefits or sign up for a trial account.

可以在计算机本地安装并运行 Azure PowerShell cmdlet。You can install and run the Azure PowerShell cmdlets locally on your computer. PowerShell cmdlet 经常更新。PowerShell cmdlets are updated frequently. 如果尚未安装最新版本,说明中指定的值可能会导致出错。If you have not installed the latest version, the values specified in the instructions may fail. 若要查找计算机上安装的 Azure PowerShell 的版本,请使用 Get-Module -ListAvailable Az cmdlet。To find the versions of Azure PowerShell installed on your computer, use the Get-Module -ListAvailable Az cmdlet. 若要进行安装或更新,请参阅安装 Azure PowerShell 模块To install or update, see Install the Azure PowerShell module.

创建 Bastion 主机Create a bastion host

本部分帮助你使用 Azure PowerShell 创建新的 Azure Bastion 资源。This section helps you create a new Azure Bastion resource using Azure PowerShell.

  1. 创建虚拟网络和 Azure Bastion 子网。Create a virtual network and an Azure Bastion subnet. 必须使用名称值 AzureBastionSubnet 创建 Azure Bastion 子网。You must create the Azure Bastion subnet using the name value AzureBastionSubnet . 此值告知 Azure 要将 Bastion 资源部署到哪个子网。This value lets Azure know which subnet to deploy the Bastion resources to. 这不同于网关子网。This is different than a Gateway subnet. 必须使用至少为 /27 或更大(/27、/26 等)的子网。You must use a subnet of at least /27 or larger subnet (/27, /26, and so on). 创建不包含任何路由表或委托的 AzureBastionSubnet。Create the AzureBastionSubnet without any route tables or delegations. 如果使用 AzureBastionSubnet 上的网络安全组,请参阅使用 NSG 一文。If you use Network Security Groups on the AzureBastionSubnet , refer to the Work with NSGs article.

    $subnetName = "AzureBastionSubnet"
    $subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.0.0/24
    $vnet = New-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myBastionRG" -Location "chinaeast2" -AddressPrefix 10.0.0.0/16 -Subnet $subnet
    
  2. 为 Azure Bastion 创建一个公共 IP 地址。Create a public IP address for Azure Bastion. 此公共 IP 是将在其上访问 RDP/SSH(通过端口 443)的 Bastion 资源的公共 IP 地址。The public IP is the public IP address the Bastion resource on which RDP/SSH will be accessed (over port 443). 公共 IP 地址必须与要创建的 Bastion 资源位于同一区域。The public IP address must be in the same region as the Bastion resource you are creating.

    $publicip = New-AzPublicIpAddress -ResourceGroupName "myBastionRG" -name "myPublicIP" -location "chinaeast2" -AllocationMethod Static -Sku Standard
    
  3. 在虚拟网络的 AzureBastionSubnet 中创建新的 Azure Bastion 资源。Create a new Azure Bastion resource in the AzureBastionSubnet of your virtual network. 创建和部署 Bastion 资源大约需要 5 分钟。It takes about 5 minutes for the Bastion resource to create and deploy.

    $bastion = New-AzBastion -ResourceGroupName "myBastionRG" -Name "myBastion" -PublicIpAddress $publicip -VirtualNetwork $vnet
    

后续步骤Next steps