将 Azure-SSIS 集成运行时加入虚拟网络Join an Azure-SSIS integration runtime to a virtual network

适用于:是 Azure 数据工厂否 Azure Synapse Analytics(预览版)APPLIES TO: yesAzure Data Factory noAzure Synapse Analytics (Preview)

在 Azure 数据工厂中使用 SQL Server Integration Services (SSIS) 时,对于以下情况,应将 Azure SSIS 集成运行时 (IR) 加入 Azure 虚拟网络:When using SQL Server Integration Services (SSIS) in Azure Data Factory, you should join your Azure-SSIS integration runtime (IR) to an Azure virtual network in the following scenarios:

  • 希望在不配置或管理用作代理的自承载 IR 的情况下,从 Azure-SSIS IR 中运行的 SSIS 包连接到本地数据存储。You want to connect to on-premises data stores from SSIS packages that run on your Azure-SSIS IR without configuring or managing a self-hosted IR as proxy.

  • 想要使用 IP 防火墙规则/虚拟网络服务终结点在 Azure SQL 数据库中托管 SSIS 目录数据库 (SSISDB)。You want to host SSIS catalog database (SSISDB) in Azure SQL Database with IP firewall rules/virtual network service endpoints.

  • 想要从 Azure-SSIS IR 中运行的 SSIS 包连接到配置了虚拟网络服务终结点的 Azure 资源。You want to connect to Azure resources configured with virtual network service endpoints from SSIS packages that run on your Azure-SSIS IR.

  • 想要从 Azure-SSIS IR 中运行的 SSIS 包连接到配置了 IP 防火墙规则的数据存储/资源。You want to connect to data stores/resources configured with IP firewall rules from SSIS packages that run on your Azure-SSIS IR.

使用数据工厂可将 Azure-SSIS IR 加入通过经典部署模型或 Azure 资源管理器部署模型创建的虚拟网络。Data Factory lets you join your Azure-SSIS IR to a virtual network created through the classic deployment model or the Azure Resource Manager deployment model.

重要

经典虚拟网络即将弃用,请改用 Azure 资源管理器虚拟网络。The classic virtual network is being deprecated, so use the Azure Resource Manager virtual network instead. 如果已使用经典虚拟网络,请尽快切换到 Azure 资源管理器虚拟网络。If you already use the classic virtual network, switch to the Azure Resource Manager virtual network as soon as possible.

配置 Azure SQL Server Integration Services (SSIS) 集成运行时 (IR) 以加入虚拟网络教程提供了通过 Azure 门户完成的最少量步骤。The configuring an Azure-SQL Server Integration Services (SSIS) integration runtime (IR) to join a virtual network tutorial shows the minimum steps via Azure portal. 本文对该教程的内容做了补充,介绍如何执行以下所有可选任务:This article expands on the tutorial and describes all the optional tasks:

  • 如果使用的是虚拟网络(经典)。If you are using virtual network (classic).
  • 如果使用自己的 Azure-SSIS IR 公共 IP 地址。If you bring your own public IP addresses for the Azure-SSIS IR.
  • 如果使用自己的域名系统 (DNS) 服务器。If you use your own Domain Name System (DNS) server.
  • 如果在子网中使用网络安全组 (NSG)。If you use a network security group (NSG) on the subnet.
  • 如果使用 Azure ExpressRoute 或用户定义的路由 (UDR)。If you use Azure ExpressRoute or a user-defined route (UDR).
  • 如果使用自定义的 Azure-SSIS IR。If you use customized Azure-SSIS IR.
  • 如果使用 Azure Powershell 预配。If you use Azure Powershell provisioning.

访问本地数据存储Access to on-premises data stores

如果 SSIS 包访问本地数据存储,则你可以将 Azure-SSIS IR 加入已连接到本地网络的虚拟网络。If your SSIS packages access on-premises data stores, you can join your Azure-SSIS IR to a virtual network that is connected to the on-premises network. 或者,可以将自承载 IR 配置为 Azure-SSIS IR 的代理并对其进行管理。Or you can configure and manage a self-hosted IR as proxy for your Azure-SSIS IR. 有关详细信息,请参阅配置自承载 IR 作为 Azure-SSIS IR 的代理For more information, see Configure a self-hosted IR as a proxy for an Azure-SSIS IR.

将 Azure-SSIS IR 加入到虚拟网络时,请记住以下要点:When joining your Azure-SSIS IR to a virtual network, remember these important points:

  • 如果没有任何虚拟网络连接到本地网络,请先创建 Azure-SSIS IR 要加入到的 Azure 资源管理器虚拟网络If no virtual network is connected to your on-premises network, first create an Azure Resource Manager virtual network for your Azure-SSIS IR to join. 然后,配置从该虚拟网络到本地网络的站点到站点 VPN 网关连接ExpressRoute 连接。Then configure a site-to-site VPN gateway connection or ExpressRoute connection from that virtual network to your on-premises network.

  • 如果已有一个 Azure 资源管理器虚拟网络连接到 Azure-SSIS 集成运行时所在同一位置中的本地网络,可将 IR 加入该虚拟网络。If an Azure Resource Manager virtual network is already connected to your on-premises network in the same location as your Azure-SSIS IR, you can join the IR to that virtual network.

  • 如果已有一个经典虚拟网络连接到与 Azure-SSIS IR 所在位置不同的位置中的本地网络,可以创建 Azure-SSIS IR 要加入到的 Azure 资源管理器虚拟网络If a classic virtual network is already connected to your on-premises network in a different location from your Azure-SSIS IR, you can create an Azure Resource Manager virtual network for your Azure-SSIS IR to join. 然后,配置经典到 Azure 资源管理器虚拟网络连接。Then configure a classic-to-Azure Resource Manager virtual network connection.

  • 如果已有一个 Azure 资源管理器虚拟网络连接到与 Azure-SSIS IR 所在位置不同的位置中的本地网络,可以先创建 Azure-SSIS IR 要加入到的 Azure 资源管理器虚拟网络If an Azure Resource Manager virtual network is already connected to your on-premises network in a different location from your Azure-SSIS IR, you can first create an Azure Resource Manager virtual network for your Azure-SSIS IR to join. 然后,配置 Azure 资源管理器到 Azure 资源管理器虚拟网络连接。Then configure an Azure Resource Manager-to-Azure Resource Manager virtual network connection.

在 SQL 数据库中承载 SSIS 目录Hosting the SSIS catalog in SQL Database

如果将 SSIS 目录承载在具有虚拟网络服务终结点的 Azure SQL 数据库中,请确保将 Azure-SSIS IR 加入到同一虚拟网络和子网中。If you host your SSIS catalog in an Azure SQL Database with virtual network service endpoints, make sure that you join your Azure-SSIS IR to the same virtual network and subnet.

对 Azure 服务的访问权限Access to Azure services

如果 SSIS 包访问支持虚拟网络服务终结点的 Azure 资源,并且你想要从 Azure-SSIS IR 保护对这些资源的访问,则可以将 Azure-SSIS IR 加入到配置了虚拟网络服务终结点的虚拟网络子网,然后将虚拟网络规则添加到相关的 Azure 资源,以允许来自同一子网的访问。If your SSIS packages access Azure resources that support virtual network service endpoints and you want to secure access to those resources from Azure-SSIS IR, you can join your Azure-SSIS IR to a virtual network subnet configured for virtual network service endpoints and then add a virtual network rule to the relevant Azure resources to allow access from the same subnet.

访问 IP 防火墙规则保护的数据源Access to data sources protected by IP firewall rule

如果 SSIS 包访问仅允许特定静态公共 IP 地址的数据存储/资源,并且你想要从 Azure-SSIS IR 保护对这些资源的访问,则可以使用自己的 Azure-SSIS IR 公共 IP 地址,同时将其加入虚拟网络,然后将 IP 防火墙规则添加到相关的 Azure 资源,以允许来自这些 IP 地址的访问。If your SSIS packages access data stores/resources that allow only specific static public IP addresses and you want to secure access to those resources from Azure-SSIS IR, you can bring your own public IP addresses for Azure-SSIS IR while joining it to a virtual network and then add an IP firewall rule to the relevant resources to allow access from those IP addresses.

在所有情况下,都只能通过 Azure 资源管理器部署模型部署虚拟网络。In all cases, the virtual network can be deployed only through the Azure Resource Manager deployment model.

以下部分提供了更多详细信息。The following sections provide more details.

虚拟网络配置Virtual network configuration

根据以下要求设置虚拟网络:Set up your virtual network to meet these requirements:

  • 确保 Microsoft.Batch 是承载 Azure-SSIS IR 的虚拟网络子网订阅下的已注册提供程序。Make sure that Microsoft.Batch is a registered provider under the subscription of your virtual network subnet that hosts the Azure-SSIS IR. 如果使用的是经典虚拟网络,请同时将 MicrosoftAzureBatch 加入到该虚拟网络的经典虚拟机参与者角色。If you use a classic virtual network, also join MicrosoftAzureBatch to the Classic Virtual Machine Contributor role for that virtual network.

  • 请确保具有所需的权限。Make sure you have the required permissions. 有关详细信息,请参阅设置权限For more information, see Set up permissions.

  • 选择合适的子网,承载 Azure-SSIS IR。Select the proper subnet to host the Azure-SSIS IR. 有关详细信息,请参阅选择子网For more information, see Select the subnet.

  • 如果使用自己的 Azure-SSIS IR 公共 IP 地址,请参阅选择静态公共 IP 地址If you bring your own public IP addresses for the Azure-SSIS IR, see Select the static public IP addresses

  • 如果在虚拟网络中使用你自己的域名系统 (DNS) 服务器,请参阅设置 DNS 服务器If you use your own Domain Name System (DNS) server on the virtual network, see Set up the DNS server.

  • 如果在子网中使用网络安全组 (NSG),请参阅设置 NSGIf you use a network security group (NSG) on the subnet, see Set up an NSG.

  • 如果使用 Azure ExpressRoute 或用户定义的路由 (UDR),请参阅使用 Azure ExpressRoute 或 UDRIf you use Azure ExpressRoute or a user-defined route (UDR), see Use Azure ExpressRoute or a UDR.

  • 确保虚拟网络的资源组(如果使用自己的公共 IP 地址,则为公共 IP 地址的资源组)可以创建和删除特定的 Azure 网络资源。Make sure the virtual network's resource group (or the public IP addresses' resource group if you bring your own public IP addresses) can create and delete certain Azure network resources. 有关详细信息,请参阅设置资源组For more information, see Set up the resource group.

  • 如果根据 Azure-SSIS IR 的自定义设置中所述自定义 Azure-SSIS IR,则 Azure-SSIS IR 节点将从预定义的范围 172.16.0.0 到 172.31.255.255 中获取专用 IP 地址。If you customize your Azure-SSIS IR as described in Custom setup for Azure-SSIS IR, your Azure-SSIS IR nodes will get private IP addresses from a predefined range of 172.16.0.0 to 172.31.255.255. 因此,请确保虚拟网络或本地网络的专用 IP 地址范围不会与此范围冲突。So make sure that the private IP address ranges of your virtual or on-premises networks don't collide with this range.

下图显示了 Azure-SSIS IR 所需的连接:This diagram shows the required connections for your Azure-SSIS IR:

Azure-SSIS IR

设置权限Set up permissions

创建 Azure-SSIS IR 的用户必须拥有以下权限:The user who creates the Azure-SSIS IR must have the following permissions:

  • 如果要将 SSIS IR 加入 Azure 资源管理器虚拟网络,则有两种选择:If you're joining your SSIS IR to an Azure Resource Manager virtual network, you have two options:

    • 使用内置的“网络参与者”角色。Use the built-in Network Contributor role. 此角色具有 Microsoft.Network/* 权限,具有比所需作用域更大的作用域。This role comes with the Microsoft.Network/* permission, which has a much larger scope than necessary.

    • 创建仅包括必需的 Microsoft.Network/virtualNetworks/*/join/action 权限的一个自定义角色。Create a custom role that includes only the necessary Microsoft.Network/virtualNetworks/*/join/action permission. 如果你还想要使用自己的 Azure-SSIS IR 公共 IP 地址,同时将其加入 Azure 资源管理器虚拟网络,请在角色中包含 Microsoft.Network/publicIPAddresses/*/join/action 权限。If you also want to bring your own public IP addresses for Azure-SSIS IR while joining it to an Azure Resource Manager virtual network, please also include Microsoft.Network/publicIPAddresses/*/join/action permission in the role.

  • 如果要将 SSIS IR 加入经典虚拟网络,我们建议使用内置的“经典虚拟机参与者”角色。If you're joining your SSIS IR to a classic virtual network, we recommend that you use the built-in Classic Virtual Machine Contributor role. 否则,你必须定义包含加入虚拟网络权限的自定义角色。Otherwise you have to define a custom role that includes the permission to join the virtual network.

选择子网Select the subnet

选择子网时:As you choose a subnet:

  • 不要选择 GatewaySubnet 来部署 Azure-SSIS IR。Don't select the GatewaySubnet to deploy an Azure-SSIS IR. GatewaySubnet 专用于虚拟网络网关。It's dedicated for virtual network gateways.

  • 确保选择的子网具有足够的可用地址空间以供 Azure-SSIS IR 使用。Ensure that the subnet you select has enough available address space for the Azure-SSIS IR to use. 将可用 IP 地址数保持为 IR 节点数的至少两倍。Leave available IP addresses for at least two times the IR node number. Azure 会保留每个子网中的某些 IP 地址。Azure reserves some IP addresses within each subnet. 不能使用这些地址。These addresses can't be used. 子网的第一个和最后一个 IP 地址仅为协议一致性而保留,其他三个地址用于 Azure 服务。The first and last IP addresses of the subnets are reserved for protocol conformance, and three more addresses are used for Azure services. 有关详细信息,请参阅使用这些子网中的 IP 地址是否有任何限制?For more information, see Are there any restrictions on using IP addresses within these subnets?

  • 不要使用其他 Azure 服务(例如,SQL 数据库 SQL 托管实例、应用服务等)以独占方式占用的子网。Don't use a subnet that is exclusively occupied by other Azure services (for example, SQL Database SQL Managed Instance, App Service, and so on).

选择静态公共 IP 地址Select the static public IP addresses

若要使用自己的 Azure-SSIS IR 公共 IP 地址,同时将其加入虚拟网络,请确保它们符合以下要求:If you want to bring your own static public IP addresses for Azure-SSIS IR while joining it to a virtual network, make sure they meet the following requirements:

  • 应仅提供尚未与其他 Azure 资源关联的两个未使用的 IP 地址。Exactly two unused ones that are not already associated with other Azure resources should be provided. 当我们定期升级你的 Azure-SSIS IR 时,将使用一个额外的 IP 地址。The extra one will be used when we periodically upgrade your Azure-SSIS IR. 请注意,不能在活动的 Azure SSIS IR 之间共享一个公共 IP 地址。Note that one public IP address cannot be shared among your active Azure-SSIS IRs.

  • 这些 IP 地址应该是标准类型的静态 IP。They should both be static ones of standard type. 有关更多详细信息,请参阅公共 IP 地址的 SKURefer to SKUs of Public IP Address for more details.

  • 它们应该都有 DNS 名称。They should both have a DNS name. 如果在创建 IP 地址时未提供 DNS 名称,可以在 Azure 门户中提供。If you have not provided a DNS name when creating them, you can do so on Azure portal.

Azure-SSIS IR

  • 这些 IP 地址和虚拟网络应位于同一区域中的同一订阅下。They and the virtual network should be under the same subscription and in the same region.

设置 DNS 服务器Set up the DNS server

如果需要在 Azure-SSIS IR 加入的虚拟网络中使用自己的 DNS 服务器来解析专用主机名,请确保该服务器可以解析 Azure 主机名(例如,名为 <your storage account>.blob.core.chinacloudapi.cn 的 Azure 存储 Blob)。If you need to use your own DNS server in a virtual network joined by your Azure-SSIS IR to resolve your private host name, make sure it can resolve Azure host names (for example, an Azure Storage blob named <your storage account>.blob.core.chinacloudapi.cn).

下面是建议的一种方法:One recommended approach is below:

  • 配置自定义 DNS,以将请求转发到 Azure DNS。Configure the custom DNS to forward requests to Azure DNS. 可以在你自己的 DNS 服务器上将未解析的 DNS 记录转发到 Azure 递归解析程序 (168.63.129.16) 的 IP 地址。You can forward unresolved DNS records to the IP address of the Azure recursive resolvers (168.63.129.16) on your own DNS server.

有关详细信息,请参阅使用自己的 DNS 服务器的名称解析For more information, see Name resolution that uses your own DNS server.

备注

请为专用主机名使用完全限定的域名 (FQDN),例如,使用 <your_private_server>.contoso.com 而不是 <your_private_server>,因为 Azure-SSIS IR 不会自动追加你自己的 DNS 后缀。Please use a fully qualified domain name (FQDN) for the your private host name, e.g. use <your_private_server>.contoso.com instead of <your_private_server>, as Azure-SSIS IR won't automatically append your own DNS suffix.

设置 NSGSet up an NSG

如果需要为 Azure-SSIS IR 使用的子网实施 NSG,请允许入站和出站流量通过以下端口:If you need to implement an NSG for the subnet used by your Azure-SSIS IR, allow inbound and outbound traffic through the following ports:

  • Azure-SSIS IR 的入站要求Inbound requirement of Azure-SSIS IR
方向Direction 传输协议Transport protocol SourceSource 源端口范围Source port range 目标Destination 目标端口范围Destination port range 注释Comments
入站Inbound TCPTCP BatchNodeManagementBatchNodeManagement * VirtualNetworkVirtualNetwork 29876、29877(如果将 IR 加入资源管理器虚拟网络)29876, 29877 (if you join the IR to a Resource Manager virtual network)

10100、20100、30100(如果将 IR 加入经典虚拟网络)10100, 20100, 30100 (if you join the IR to a classic virtual network)
数据工厂服务使用这些端口来与虚拟网络中 Azure-SSIS IR 的节点通信。The Data Factory service uses these ports to communicate with the nodes of your Azure-SSIS IR in the virtual network.

无论是否创建子网级 NSG,数据工厂都始终会在附加到托管 Azure-SSIS IR 的虚拟机的网络接口卡 (NIC) 级别配置 NSG。Whether or not you create a subnet-level NSG, Data Factory always configures an NSG at the level of the network interface cards (NICs) attached to the virtual machines that host the Azure-SSIS IR. 此 NIC 级别的 NSG 仅允许来自指定端口上的数据工厂 IP 地址的入站流量。Only inbound traffic from Data Factory IP addresses on the specified ports is allowed by that NIC-level NSG. 即使在子网级别为 Internet 流量打开这些端口,来自 IP 地址(非数据工厂 IP 地址)的流量也会在 NIC 级别被阻止。Even if you open these ports to internet traffic at the subnet level, traffic from IP addresses that aren't Data Factory IP addresses is blocked at the NIC level.
入站Inbound TCPTCP CorpNetSawCorpNetSaw * VirtualNetworkVirtualNetwork 33893389 (可选)仅当 Microsoft 支持人员在高级故障排除期间要求客户打开此端口时,才需要此规则。故障排除后可立即将其关闭。(Optional) This rule is only required when Microsoft supporter ask customer to open for advanced troubleshooting, and can be closed right after troubleshooting. CorpNetSaw 服务标记仅允许 Microsoft 企业网络中的安全访问工作站使用远程桌面。CorpNetSaw service tag permits only secure access workstations on the Microsoft corporate network to use remote desktop. 无法在门户中选择此服务标记,只能通过 Azure PowerShell 或 Azure CLI 选择。And this service tag can't be selected from portal and is only available via Azure PowerShell or Azure CLI.

在 NIC 级别的 NSG 中,端口 3389 默认已打开,你可以在子网级 NSG 中控制端口 3389,同时,出于保护目的,Azure-SSIS IR 默认已在每个 IR 节点上的 Windows 防火墙规则中禁用 3389 出站端口。At NIC level NSG, port 3389 is open by default and we allow you to control port 3389 at subnet level NSG, meanwhile Azure-SSIS IR has disallowed port 3389 outbound by default at windows firewall rule on each IR node for protection.
  • Azure-SSIS IR 的出站要求Outbound requirement of Azure-SSIS IR
方向Direction 传输协议Transport protocol SourceSource 源端口范围Source port range 目标Destination 目标端口范围Destination port range 注释Comments
出站Outbound TCPTCP VirtualNetworkVirtualNetwork * AzureCloudAzureCloud 443443 虚拟网络中 Azure-SSIS IR 的节点使用此端口来访问 Azure 服务,例如 Azure 存储和 Azure 事件中心。The nodes of your Azure-SSIS IR in the virtual network use this port to access Azure services, such as Azure Storage and Azure Event Hubs.
出站Outbound TCPTCP VirtualNetworkVirtualNetwork * InternetInternet 8080 (可选)虚拟网络中的 Azure-SSIS IR 节点使用此端口从 Internet 下载证书吊销列表。(Optional) The nodes of your Azure-SSIS IR in the virtual network use this port to download a certificate revocation list from the internet. 如果阻止此流量,在启动 IR 时可能会出现性能下降,并且无法在证书吊销列表中检查证书的使用情况。If you block this traffic, you might experience performance downgrade when start IR and lose capability to check certificate revocation list for certificate usage. 若要进一步将目标范围缩小为特定的 FQDN,请参阅使用 Azure ExpressRoute 或 UDR 部分If you want to further narrow down destination to certain FQDNs, please refer to Use Azure ExpressRoute or UDR section
出站Outbound TCPTCP VirtualNetworkVirtualNetwork * SqlSql 1433、11000-119991433, 11000-11999 (可选)仅当虚拟网络中 Azure-SSIS IR 的节点访问服务器托管的 SSISDB 时,才需要此规则。(Optional) This rule is only required when the nodes of your Azure-SSIS IR in the virtual network access an SSISDB hosted by your server. 如果服务器连接策略设置为“代理”而不是“重定向”,则只需使用端口 1433。 If your server connection policy is set to Proxy instead of Redirect, only port 1433 is needed.
出站Outbound TCPTCP VirtualNetworkVirtualNetwork * 存储Storage 445445 (可选)仅当你要执行 Azure 文件存储中存储的 SSIS 包时,才需要此规则。(Optional) This rule is only required when you want to execute SSIS package stored in Azure Files.

使用 Azure ExpressRoute 或 UDRUse Azure ExpressRoute or UDR

若要检查来自 Azure-SSIS IR 的出站流量,可以通过 Azure ExpressRoute 强制隧道将 Azure-SSIS IR 发起的流量路由到本地防火墙设备(将 BGP 路由从 0.0.0.0/0 播发到虚拟网络),或者通过 UDR 将此流量路由到充当防火墙或 Azure 防火墙的网络虚拟设备 (NVA)。If you want to inspect outbound traffic from Azure-SSIS IR, you can route traffic initiated from Azure-SSIS IR to on-premises firewall appliance via Azure ExpressRoute force tunneling (advertising a BGP route, 0.0.0.0/0, to the virtual network) or to Network Virtual Appliance (NVA) as a firewall or Azure Firewall via UDRs.

Azure-SSIS IR 的 NVA 方案

需要执行以下操作才能使整个方案正常工作You need to do below things to make whole scenario working

  • 不能通过防火墙设备路由 Azure Batch 管理服务与 Azure-SSIS IR 之间的入站流量。Inbound traffic between Azure Batch management services and the Azure-SSIS IR can't be routed via firewall appliance.
  • 防火墙设备应允许 Azure-SSIS IR 所需的出站流量。The firewall appliance shall allow outbound traffic required by Azure-SSIS IR.

不能将 Azure Batch 管理服务与 Azure-SSIS IR 之间的入站流量路由到防火墙设备,否则流量会由于非对称路由问题而中断。Inbound traffic between Azure Batch management services and the Azure-SSIS IR can't be routed to firewall appliance otherwise the traffic will be broken due to asymmetric routing problem. 必须为入站流量定义路由,使流量能够以其传入时的相同方式做出回复。Routes must be defined for inbound traffic so the traffic can reply back the same way it came in. 可以定义特定的 UDR,在 Azure Batch 管理服务与下一跃点类型为“Internet”的 Azure-SSIS IR 之间路由流量。You can define specific UDRs to route traffic between Azure Batch management services and the Azure-SSIS IR with next hop type as Internet.

备注

此方法会产生额外的维护成本。This approach incurs an additional maintenance cost. 定期检查 IP 范围,并在 UDR 中添加新的 IP 范围,以免中断 Azure-SSIS IR。Regularly check the IP range and add new IP ranges into your UDR to avoid breaking the Azure-SSIS IR. 建议每月检查 IP 范围,因为当新 IP 出现在服务标记中时,该 IP 需要再等一个月才能生效。We recommend checking the IP range monthly because when the new IP appears in the service tag, the IP will take another month go into effect.

若要简化 UDR 规则的设置,可以运行以下 Powershell 脚本,为 Azure Batch 管理服务添加 UDR 规则:To make the setup of UDR rules easier, you can run following Powershell script to add UDR rules for Azure Batch management services:

$Location = "[location of your Azure-SSIS IR]"
$RouteTableResourceGroupName = "[name of Azure resource group that contains your Route Table]"
$RouteTableResourceName = "[resource name of your Azure Route Table ]"
$RouteTable = Get-AzRouteTable -ResourceGroupName $RouteTableResourceGroupName -Name $RouteTableResourceName
$ServiceTags = Get-AzNetworkServiceTag -Location $Location
$BatchServiceTagName = "BatchNodeManagement." + $Location
$UdrRulePrefixForBatch = $BatchServiceTagName
if ($ServiceTags -ne $null)
{
    $BatchIPRanges = $ServiceTags.Values | Where-Object { $_.Name -ieq $BatchServiceTagName }
    if ($BatchIPRanges -ne $null)
    {
        Write-Host "Start to add rule for your route table..."
        for ($i = 0; $i -lt $BatchIPRanges.Properties.AddressPrefixes.Count; $i++)
        {
            $UdrRuleName = "$($UdrRulePrefixForBatch)_$($i)"
            Add-AzRouteConfig -Name $UdrRuleName `
                -AddressPrefix $BatchIPRanges.Properties.AddressPrefixes[$i] `
                -NextHopType "Internet" `
                -RouteTable $RouteTable `
                | Out-Null
            Write-Host "Add rule $UdrRuleName to your route table..."
        }
        Set-AzRouteTable -RouteTable $RouteTable
    }
}
else
{
    Write-Host "Failed to fetch service tags, please confirm that your Location is valid."
}

要使防火墙设备允许出站流量,需要根据 NSG 出站规则中的相同要求,允许向以下端口发送出站流量。For firewall appliance to allow outbound traffic, you need to allow outbound to below ports same as requirement in NSG outbound rules.

  • 目标为 Azure 云服务的端口 443。Port 443 with destination as Azure Cloud services.

    如果使用 Azure 防火墙,则可使用 AzureCloud 服务标记指定网络规则。If you use Azure Firewall, you can specify network rule with AzureCloud Service Tag. 对于其他类型的防火墙,可以简单地将端口 443 的目标设置为“全部”,也可以根据 Azure 环境的类型允许以下 FQDN:For firewall of the other types, you can either simply allow destination as all for port 443 or allow below FQDNs based on the type of your Azure environment:

    Azure 环境Azure Environment 终结点Endpoints
    Azure 中国世纪互联Azure China 21Vianet
    • Azure 数据工厂(管理)Azure Data Factory (Management)
      • *.frontend.datamovement.azure.cn*.frontend.datamovement.azure.cn
    • Azure 存储(管理)Azure Storage (Management)
      • *.blob.core.chinacloudapi.cn*.blob.core.chinacloudapi.cn
      • *.table.core.chinacloudapi.cn*.table.core.chinacloudapi.cn
    • Azure 容器注册表(自定义设置)Azure Container Registry (Custom Setup)
      • *.azurecr.cn*.azurecr.cn
    • 事件中心(日志记录)Event Hub (Logging)
      • *servicebus.chinacloudapi.cn*.servicebus.chinacloudapi.cn
    • Microsoft 日志记录服务(内部使用)Microsoft Logging service (Internal Use)
      • mooncake.warmpath.chinacloudapi.cnmooncake.warmpath.chinacloudapi.cn
      • azurewatsonanalysis.chinacloudapp.cnazurewatsonanalysis.chinacloudapp.cn

    至于 Azure 存储、Azure 容器注册表和事件中心的 FQDN,还可以选择为虚拟网络启用以下服务终结点,使发往这些终结点的网络流量通过 Azure 主干网络而不是路由到防火墙设备:As for the FQDNs of Azure Storage, Azure Container Registry and Event Hub, you can also choose to enable the following service endpoints for your virtual network so that network traffic to these endpoints goes through Azure backbone network instead of being routed to your firewall appliance:

    • Microsoft.StorageMicrosoft.Storage
    • Microsoft.ContainerRegistryMicrosoft.ContainerRegistry
    • Microsoft.EventHubMicrosoft.EventHub
  • 目标为 CRL 下载站点的端口 80。Port 80 with destination as CRL download sites.

    应允许以下 FQDN,它们用作证书(用于 Azure-SSIS IR 管理目的)的 CRL(证书吊销列表)下载站点:You shall allow below FQDNs which are used as CRL (Certificate Revocation List) download sites of certificates for Azure-SSIS IR management purpose:

    • crl.microsoft.com:80crl.microsoft.com:80
    • mscrl.microsoft.com:80mscrl.microsoft.com:80
    • crl3.digicert.com:80crl3.digicert.com:80
    • crl4.digicert.com:80crl4.digicert.com:80
    • ocsp.digicert.com:80ocsp.digicert.com:80
    • cacerts.digicert.com:80cacerts.digicert.com:80

    如果使用的证书具有不同的 CRL,我们建议同时包含这些证书。If you are using certificates having different CRL, you are suggested to include them as well. 可以阅读证书吊销列表了解详细信息。You can read this to understand more on Certificate Revocation List.

    如果禁止此流量,在启动 Azure-SSIS IR 时可能会出现性能下降,并且无法在证书吊销列表中检查证书的使用情况,从安全的立场讲,我们不建议将它禁止。If you disallow this traffic, you might experience performance downgrade when start Azure-SSIS IR and lose capability to check certificate revocation list for certificate usage which is not recommended from security point of view.

  • 目标为 Azure SQL 数据库的端口 1433 和端口范围 11000-11999(仅当虚拟网络中 Azure-SSIS IR 的节点访问服务器托管的 SSISDB 时,才需要此规则)。Port 1433, 11000-11999 with destination as Azure SQL Database (only required when the nodes of your Azure-SSIS IR in the virtual network access an SSISDB hosted by your server).

    如果使用 Azure 防火墙,可以使用 Azure SQL 服务标记指定网络规则,否则,可以在防火墙设备中允许将特定的 Azure SQL URL 用作目标。If you use Azure Firewall, you can specify network rule with Azure SQL Service Tag, otherwise you might allow destination as specific azure sql url in firewall appliance.

  • 目标为 Azure 存储的端口 445(仅当执行 Azure 文件存储中存储的 SSIS 包时,才需要此规则)。Port 445 with destination as Azure Storage (only required when you execute SSIS package stored in Azure Files).

    如果使用 Azure 防火墙,可以使用存储服务标记指定网络规则,否则,可以在防火墙设备中允许将特定的 Azure 文件存储 URL 用作目标。If you use Azure Firewall, you can specify network rule with Storage Service Tag, otherwise you might allow destination as specific azure file storage url in firewall appliance.

备注

对于 Azure SQL 和存储,如果在子网中配置虚拟网络服务终结点,则同一区域中 Azure-SSIS IR 和 Azure SQL 与同一区域或配对区域中 Azure 存储之间的流量将直接路由到 Azure 主干网络,而不会路由到防火墙设备。For Azure SQL and Storage, if you configure Virtual Network service endpoints on your subnet, then traffic between Azure-SSIS IR and Azure SQL in same region \ Azure Storage in same region or paired region will be routed to Azure backbone network directly instead of your firewall appliance.

如果你不需要检查 Azure-SSIS IR 出站流量的功能,则可以直接应用路由,以强制所有流量路由到下一跃点类型“Internet”:If you don't need capability of inspecting outbound traffic of Azure-SSIS IR, you can simply apply route to force all traffic to next hop type Internet:

  • 在 Azure ExpressRoute 方案中,可以在承载 Azure-SSIS IR 的子网上应用下一跃点类型为“Internet”的 0.0.0.0/0 路由。In an Azure ExpressRoute scenario, you can apply a 0.0.0.0/0 route with the next hop type as Internet on the subnet that hosts the Azure-SSIS IR.
  • 在 NVA 方案中,可将承载 Azure-SSIS IR 的子网中应用的现有 0.0.0.0/0 路由的下一跃点类型从“虚拟设备”修改为“Internet”。 In a NVA scenario, you can modify the existing 0.0.0.0/0 route applied on the subnet that hosts the Azure-SSIS IR from the next hop type as Virtual appliance to Internet.

添加路由

备注

指定下一跃点类型为“Internet”的路由并不意味着流量将通过 Internet 传送。Specify route with next hop type Internet doesn't mean all traffic will go over Internet. 只要目标地址用于 Azure 的某个服务,Azure 就会将流量通过 Azure 的主干网络直接路由到该服务,而不是将流量路由到 Internet。As long as destination address is for one of Azure's services, Azure routes the traffic directly to the service over Azure's backbone network, rather than routing the traffic to the Internet.

设置资源组Set up the resource group

Azure-SSIS IR 需要在与虚拟网络相同的资源组下创建某些网络资源。The Azure-SSIS IR needs to create certain network resources under the same resource group as the virtual network. 这些资源包括:These resources include:

  • Azure 负载均衡器,名为 <Guid>-azurebatch-cloudserviceloadbalancer。An Azure load balancer, with the name <Guid>-azurebatch-cloudserviceloadbalancer.
  • Azure 公共 IP 地址,名为 <Guid>-azurebatch-cloudservicepublicip。An Azure public IP address, with the name <Guid>-azurebatch-cloudservicepublicip.
  • 网络工作安全组,名为 <Guid>-azurebatch-cloudservicenetworksecuritygroup。A network work security group, with the name <Guid>-azurebatch-cloudservicenetworksecuritygroup.

备注

现在,可为 Azure-SSIS IR 提供自己的静态公共 IP 地址。You can now bring your own static public IP addresses for Azure-SSIS IR. 在此方案中,我们只会在与静态公共 IP 地址(而不是虚拟网络)相同的资源组下创建 Azure 负载均衡器和网络安全组。In this scenario, we will create only the Azure load balancer and network security group under the same resource group as your static public IP addresses instead of the virtual network.

当 Azure-SSIS IR 启动时,将创建这些资源。Those resources will be created when your Azure-SSIS IR starts. 当 Azure-SSIS IR 停止时,将删除这些资源。They'll be deleted when your Azure-SSIS IR stops. 如果为 Azure-SSIS IR 提供你自己的静态公共 IP 地址,则当 Azure-SSIS IR 停止时,系统不会删除你自己的静态公共 IP 地址。If you bring your own static public IP addresses for Azure-SSIS IR, your own static public IP addresses won't be deleted when your Azure-SSIS IR stops. 为了避免阻止 Azure-SSIS IR 停止,请不要在其他资源中重复使用这些网络资源。To avoid blocking your Azure-SSIS IR from stopping, don't reuse these network resources in your other resources.

确保虚拟网络/静态公共 IP 地址所属的资源组/订阅中没有任何资源锁。Make sure that you have no resource lock on the resource group/subscription to which the virtual network/your static public IP addresses belong. 如果配置只读/删除锁,则启动和停止 Azure-SSIS IR 将会失败,或者它会停止响应。If you configure a read-only/delete lock, starting and stopping your Azure-SSIS IR will fail, or it will stop responding.

确保没有任何 Azure Policy 分配阻止在虚拟网络/静态公共 IP 地址所属的资源组/订阅下创建以下资源:Make sure that you don't have an Azure Policy assignment that prevents the following resources from being created under the resource group/subscription to which the virtual network/your static public IP addresses belong:

  • Microsoft.Network/LoadBalancersMicrosoft.Network/LoadBalancers
  • Microsoft.Network/NetworkSecurityGroupsMicrosoft.Network/NetworkSecurityGroups
  • Microsoft.Network/PublicIPAddressesMicrosoft.Network/PublicIPAddresses

请确保订阅的资源配额满足上述三种网络资源。Make sure that the resource quota of your subscription is enough for the above three network resources. 具体而言,对于在虚拟网络中创建的每个 Azure-SSIS IR,需要为上述三个网络资源中的每个资源保留两个可用配额。Specifically, for each Azure-SSIS IR created in virtual network, you need to reserve two free quotas for each of the above three network resources. 当我们定期升级你的 Azure-SSIS IR 时,将使用一个额外的配额。The extra one quota will be used when we periodically upgrade your Azure-SSIS IR.

常见问题解答FAQ

  • 如何保护用于入站连接的 Azure-SSIS IR 上公开的公共 IP 地址?How can I protect the public IP address exposed on my Azure-SSIS IR for inbound connection? 是否可以删除公共 IP 地址?Is it possible to remove the public IP address?

    目前,当 Azure-SSIS IR 加入虚拟网络时,会自动创建一个公共 IP 地址。Right now, a public IP address will be automatically created when your Azure-SSIS IR joins a virtual network. 我们确实有一个 NIC 级别的 NSG,它只允许 Azure Batch 管理服务入站连接到 Azure-SSIS IR。We do have an NIC-level NSG to allow only Azure Batch management services to inbound-connect to your Azure-SSIS IR. 你也可以指定子网级别的 NSG 进行入站保护。You can also specify a subnet-level NSG for inbound protection.

    如果你不希望公开任何公共 IP 地址,请考虑将自承载 IR 配置为 Azure-SSIS IR 的代理,而不是将 Azure-SSIS IR 加入虚拟网络(如果这适用于你的方案)。If you don't want any public IP address to be exposed, consider configuring a self-hosted IR as proxy for your Azure-SSIS IR instead of joining your Azure-SSIS IR to a virtual network, if this applies to your scenario.

  • 是否可将 Azure-SSIS IR 的公共 IP 地址添加到数据源的防火墙允许列表?Can I add the public IP address of my Azure-SSIS IR to the firewall's allow list for my data sources?

    现在,可为 Azure-SSIS IR 提供自己的静态公共 IP 地址。You can now bring your own static public IP addresses for Azure-SSIS IR. 在这种情况下,可将 IP 地址添加到数据源的防火墙允许列表。In this case, you can add your IP addresses to the firewall's allow list for your data sources. 还可以根据自己的情况,考虑使用以下其他选项来保护从 Azure-SSIS IR 进行的数据访问:You can also consider other options below to secure data access from your Azure-SSIS IR depending on your scenario:

    • 如果数据源位于本地,在将虚拟网络连接到本地网络并将 Azure-SSIS IR 加入虚拟网络子网之后,可将该子网的专用 IP 地址范围添加到数据源的防火墙允许列表。If your data source is on premises, after connecting a virtual network to your on-premises network and joining your Azure-SSIS IR to the virtual network subnet, you can then add the private IP address range of that subnet to the firewall's allow list for your data source.
    • 如果数据源是支持虚拟网络服务终结点的 Azure 服务,则你可以在虚拟网络子网中配置一个虚拟网络服务终结点,并将 Azure-SSIS IR 加入该子网。If your data source is an Azure service that supports virtual network service endpoints, you can configure a virtual network service endpoint on your virtual network subnet and join your Azure-SSIS IR to that subnet. 然后,可将包含该子网的虚拟网络规则添加到数据源的防火墙。You can then add a virtual network rule with that subnet to the firewall for your data source.
    • 如果数据源是非 Azure 云服务,则你可以使用 UDR 通过静态公共 IP 地址将来自 Azure-SSIS IR 的出站流量路由到 NVA/Azure 防火墙。If your data source is a non-Azure cloud service, you can use a UDR to route outbound traffic from your Azure-SSIS IR to an NVA/Azure Firewall via a static public IP address. 然后,可将 NVA/Azure 防火墙的静态公共 IP 地址添加到数据源的防火墙允许列表。You can then add the static public IP address of your NVA/Azure Firewall to the firewall's allow list for your data source.
    • 如果上述选项都不能满足你的需求,请考虑将自承载 IR 配置为 Azure-SSIS IR 的代理If none of the above options meets your needs, consider configuring a self-hosted IR as proxy for your Azure-SSIS IR. 然后,可将托管自承载 IR 的计算机的静态公共 IP 地址添加到数据源的防火墙允许列表中。You can then add the static public IP address of the machine that hosts your self-hosted IR to the firewall's allow list for your data source.
  • 如果我要为 Azure-SSIS IR 提供静态公共地址,为何需要提供两个?Why do I need to provide two static public addresses if I want to bring my own for Azure-SSIS IR?

    Azure-SSIS IR 将定期自动更新。Azure-SSIS IR is automatically updated on a regular basis. 升级期间将创建新节点,而旧节点将被删除。New nodes are created during upgrade and old ones will be deleted. 但是,为了避免停机,只有在新节点准备就绪之后才会删除旧节点。However, to avoid downtime, the old nodes will not be deleted until the new ones are ready. 因此,旧节点使用的第一个静态公共 IP 地址无法立即释放,我们需要第二个静态公共 IP 地址来创建新节点。Thus, your first static public IP address used by the old nodes cannot be released immediately and we need your second static public IP address to create the new nodes.

  • 我已经为 Azure-SSIS IR 提供了自己的静态公共 IP 地址,但为何它仍然无法访问我的数据源?I have brought my own static public IP addresses for Azure-SSIS IR, but why it still cannot access my data sources?

    • 确认两个静态公共 IP 地址都已添加到数据源的防火墙允许列表。Confirm that the two static public IP addresses are both added to the firewall's allow list for your data sources. 每次升级 Azure-SSIS IR 时,其静态公共 IP 地址将在提供的两个地址之间切换。Each time your Azure-SSIS IR is upgraded, its static public IP address is switched between the two brought by you. 如果只将其中的一个地址添加到允许列表,则升级后,Azure-SSIS IR 的数据访问将会中断。If you add only one of them to the allow list, data access for your Azure-SSIS IR will be broken after its upgrade.
    • 如果数据源是 Azure 服务,请检查是否已为它配置虚拟网络服务终结点。If your data source is an Azure service, please check whether you have configured it with virtual network service endpoints. 如果已配置,则从 Azure-SSIS IR 发往数据源的流量将切换为使用 Azure 服务管理的专用 IP 地址,并且在将你自己的静态公共 IP 地址添加到数据源的防火墙允许列表后,这些地址不会生效。If that's the case, the traffic from Azure-SSIS IR to your data source will switch to use the private IP addresses managed by Azure services and adding your own static public IP addresses to the firewall's allow list for your data source will not take effect.

Azure 门户(数据工厂 UI)Azure portal (Data Factory UI)

本部分介绍如何使用 Azure 门户和数据工厂 UI 如何将现有的 Azure SSIS IR 加入虚拟网络(经典或 Azure 资源管理器)。This section shows you how to join an existing Azure-SSIS IR to a virtual network (classic or Azure Resource Manager) by using the Azure portal and Data Factory UI.

在将 Azure-SSIS IR 加入虚拟网络之前,需要正确配置虚拟网络。Before joining your Azure-SSIS IR to the virtual network, you need to properly configure the virtual network. 请遵循适用于你的虚拟网络类型(经典或 Azure 资源管理器)的部分中的步骤操作。Follow the steps in the section that applies to your type of virtual network (classic or Azure Resource Manager). 然后,遵循第三部分中的步骤将 Azure SSIS IR 加入虚拟网络。Then follow the steps in the third section to join your Azure-SSIS IR to the virtual network.

配置 Azure 资源管理器虚拟网络Configure an Azure Resource Manager virtual network

使用门户配置一个 Azure 资源管理器虚拟网络,然后尝试将 Azure-SSIS IR 加入其中。Use the portal to configure an Azure Resource Manager virtual network before you try to join an Azure-SSIS IR to it.

  1. 启动 Microsoft Edge 或 Google Chrome。Start Microsoft Edge or Google Chrome. 目前只有这些 Web 浏览器支持数据工厂 UI。Currently, only these web browsers support the Data Factory UI.

  2. 登录到 Azure 门户Sign in to the Azure portal.

  3. 选择“更多服务”。Select More services. 筛选并选择“虚拟网络”。Filter for and select Virtual networks.

  4. 在列表中筛选并选择自己的虚拟网络。Filter for and select your virtual network in the list.

  5. 在“虚拟网络”页中选择“属性”。 On the Virtual network page, select Properties.

  6. 选择“资源 ID”对应的复制按钮,将虚拟网络的资源 ID 复制到剪贴板。Select the copy button for RESOURCE ID to copy the resource ID for the virtual network to the clipboard. 将剪贴板中的 ID 保存到 OneNote 或某个文件中。Save the ID from the clipboard in OneNote or a file.

  7. 在左侧菜单中选择“子网”。On the left menu, select Subnets. 确保可用地址数大于 Azure-SSIS IR 中的节点数。Ensure that the number of available addresses is greater than the nodes in your Azure-SSIS IR.

  8. 验证是否已将 Azure Batch 提供程序注册到包含虚拟网络的 Azure 订阅中。Verify that the Azure Batch provider is registered in the Azure subscription that has the virtual network. 或者注册 Azure Batch 提供程序。Or register the Azure Batch provider. 如果订阅中已包含 Azure Batch 帐户,则已经为 Azure Batch 注册了订阅。If you already have an Azure Batch account in your subscription, your subscription is registered for Azure Batch. (如果在数据工厂门户中创建 Azure-SSIS IR,将自动注册 Azure Batch 提供程序。)(If you create the Azure-SSIS IR in the Data Factory portal, the Azure Batch provider is automatically registered for you.)

    1. 在 Azure 门户的左侧菜单中选择“订阅”。In the Azure portal, on the left menu, select Subscriptions.

    2. 选择订阅。Select your subscription.

    3. 在左侧选择“资源提供程序”,确认 Microsoft.Batch 是注册的提供程序。On the left, select Resource providers, and confirm that Microsoft.Batch is a registered provider.

    确认“已注册”状态

    如果列表中未出现 Microsoft.Batch,若要注册该提供程序,请在订阅中创建一个空的 Azure Batch 帐户If you don't see Microsoft.Batch in the list, to register it, create an empty Azure Batch account in your subscription. 稍后可以删除该帐户。You can delete it later.

配置经典虚拟网络Configure a classic virtual network

使用门户配置一个经典虚拟网络,然后尝试将 Azure-SSIS IR 加入其中。Use the portal to configure a classic virtual network before you try to join an Azure-SSIS IR to it.

  1. 启动 Microsoft Edge 或 Google Chrome。Start Microsoft Edge or Google Chrome. 目前只有这些 Web 浏览器支持数据工厂 UI。Currently, only these web browsers support the Data Factory UI.

  2. 登录到 Azure 门户Sign in to the Azure portal.

  3. 选择“更多服务”。Select More services. 筛选并选择“虚拟网络(经典)”。Filter for and select Virtual networks (classic).

  4. 在列表中筛选并选择自己的虚拟网络。Filter for and select your virtual network in the list.

  5. 在“虚拟网络(经典)”页中选择“属性”。 On the Virtual network (classic) page, select Properties.

    经典虚拟网络资源 ID

  6. 选择“资源 ID”对应的复制按钮,将经典网络的资源 ID 复制到剪贴板。Select the copy button for RESOURCE ID to copy the resource ID for the classic network to the clipboard. 将剪贴板中的 ID 保存到 OneNote 或某个文件中。Save the ID from the clipboard in OneNote or a file.

  7. 在左侧菜单中选择“子网”。On the left menu, select Subnets. 确保可用地址数大于 Azure-SSIS IR 中的节点数。Ensure that the number of available addresses is greater than the nodes in your Azure-SSIS IR.

    虚拟网络中的可用地址数

  8. MicrosoftAzureBatch 加入虚拟网络的“经典虚拟机参与者”角色。Join MicrosoftAzureBatch to the Classic Virtual Machine Contributor role for the virtual network.

    1. 在左侧菜单中选择“访问控制(IAM)”,然后选择“角色分配”选项卡。 On the left menu, select Access control (IAM), and select the Role assignments tab.

      “访问控制”和“添加”按钮

    2. 选择“添加角色分配”。Select Add role assignment.

    3. 在“添加角色分配”页中,为“角色”选择“经典虚拟机参与者”。 On the Add role assignment page, for Role, select Classic Virtual Machine Contributor. 在“选择”框中粘贴 ddbf3205-c6bd-46ae-8127-60eb93363864,然后从搜索结果列表中选择“Microsoft Azure Batch”。 In the Select box, paste ddbf3205-c6bd-46ae-8127-60eb93363864, and then select Microsoft Azure Batch from the list of search results.

      在“添加角色分配”页上搜索结果

    4. 选择“保存”以保存设置并关闭页面。Select Save to save the settings and close the page.

      保存访问设置

    5. 确认参与者列表中出现了“Microsoft Azure Batch”。Confirm that you see Microsoft Azure Batch in the list of contributors.

      确认 Azure Batch 访问权限

  9. 验证是否已将 Azure Batch 提供程序注册到包含虚拟网络的 Azure 订阅中。Verify that the Azure Batch provider is registered in the Azure subscription that has the virtual network. 或者注册 Azure Batch 提供程序。Or register the Azure Batch provider. 如果订阅中已包含 Azure Batch 帐户,则已经为 Azure Batch 注册了订阅。If you already have an Azure Batch account in your subscription, your subscription is registered for Azure Batch. (如果在数据工厂门户中创建 Azure-SSIS IR,将自动注册 Azure Batch 提供程序。)(If you create the Azure-SSIS IR in the Data Factory portal, the Azure Batch provider is automatically registered for you.)

    1. 在 Azure 门户的左侧菜单中选择“订阅”。In the Azure portal, on the left menu, select Subscriptions.

    2. 选择订阅。Select your subscription.

    3. 在左侧选择“资源提供程序”,确认 Microsoft.Batch 是注册的提供程序。On the left, select Resource providers, and confirm that Microsoft.Batch is a registered provider.

    确认“已注册”状态

    如果列表中未出现 Microsoft.Batch,若要注册该提供程序,请在订阅中创建一个空的 Azure Batch 帐户If you don't see Microsoft.Batch in the list, to register it, create an empty Azure Batch account in your subscription. 稍后可以删除该帐户。You can delete it later.

将 Azure-SSIS IR 加入虚拟网络Join the Azure-SSIS IR to a virtual network

配置 Azure 资源管理器虚拟网络或经典虚拟网络后,可将 Azure-SSIS IR 加入该虚拟网络:After you've configured your Azure Resource Manager virtual network or classic virtual network, you can join the Azure-SSIS IR to the virtual network:

  1. 启动 Microsoft Edge 或 Google Chrome。Start Microsoft Edge or Google Chrome. 目前只有这些 Web 浏览器支持数据工厂 UI。Currently, only these web browsers support the Data Factory UI.

  2. Azure 门户的左侧菜单中选择“数据工厂”。In the Azure portal, on the left menu, select Data factories. 如果菜单中未显示“数据工厂”,请选择“更多服务”,然后在“智能 + 分析”部分选择“数据工厂”。 If you don't see Data factories on the menu, select More services, and then in the INTELLIGENCE + ANALYTICS section, select Data factories.

    数据工厂列表

  3. 在列表中选择包含 Azure-SSIS IR 的数据工厂。Select your data factory with the Azure-SSIS IR in the list. 随后会显示该数据工厂的主页。You see the home page for your data factory. 选择“创作和监视”磁贴。Select the Author & Monitor tile. 单独的选项卡中会显示数据工厂 UI。You see the Data Factory UI on a separate tab.

    数据工厂主页

  4. 在数据工厂 UI 中切换到“编辑”选项卡,选择“连接”,然后切换到“集成运行时”选项卡。 In the Data Factory UI, switch to the Edit tab, select Connections, and switch to the Integration Runtimes tab.

    “集成运行时”选项卡

  5. 如果 Azure SSIS IR 正在运行,请在“集成运行时”列表中的“操作”列内,选择 Azure SSIS IR 对应的“停止”按钮。 If your Azure-SSIS IR is running, in the Integration Runtimes list, in the Actions column, select the Stop button for your Azure-SSIS IR. 只有在停止 Azure-SSIS IR 之后才能对其进行编辑。You can't edit your Azure-SSIS IR until you stop it.

    停止 IR

  6. 在“集成运行时”列表中的“操作”列内,选择 Azure SSIS IR 对应的“编辑”按钮。 In the Integration Runtimes list, in the Actions column, select the Edit button for your Azure-SSIS IR.

    编辑集成运行时

  7. 在集成运行时设置面板上,选择“下一步”按钮进入“常规设置”和“SQL 设置”部分。 On the integration runtime setup panel, advance through the General Settings and SQL Settings sections by selecting the Next button.

  8. 在“高级设置”部分:On the Advanced Settings section:

    1. 选中“选择 Azure-SSIS Integration Runtime 要加入的 VNet,允许 ADF 创建特定网络资源,或者选择引入自己的静态公共 IP 地址”复选框。Select the Select a VNet for your Azure-SSIS Integration Runtime to join, allow ADF to create certain network resources, and optionally bring your own static public IP addresses check box.

    2. 对于“订阅”,请选择包含你的虚拟网络的 Azure 订阅。For Subscription, select the Azure subscription that has your virtual network.

    3. 对于“位置”,系统已选择集成运行时所在的位置。For Location, the same location of your integration runtime is selected.

    4. 对于“类型”,请选择虚拟网络的类型:“经典”或“Azure 资源管理器”。For Type, select the type of your virtual network: classic or Azure Resource Manager. 我们建议选择 Azure 资源管理器虚拟网络,因为经典虚拟网络在不久后将被弃用。We recommend that you select an Azure Resource Manager virtual network, because classic virtual networks will be deprecated soon.

    5. 对于“VNet 名称”,请选择虚拟网络的名称。For VNet Name, select the name of your virtual network. 它应该与使用虚拟网络服务终结点来托管 SSISDB 的 SQL 数据库所用的相同。It should be the same one used for SQL Database with virtual network service endpoints to host SSISDB. 或者,它应该是连接到本地网络的同一个虚拟网络。Or it should be the same one connected to your on-premises network. 否则,它可以是为 Azure-SSIS IR 提供你自己的静态公共 IP 地址的任何虚拟网络。Otherwise, it can be any virtual network to bring your own static public IP addresses for Azure-SSIS IR.

    6. 对于“子网名称”,请选择虚拟网络的子网名称。For Subnet Name, select the name of subnet for your virtual network. 它应该与使用虚拟网络服务终结点来托管 SSISDB 的 SQL 数据库所用的相同。It should be the same one used for SQL Database with virtual network service endpoints to host SSISDB. 否则,它可以是为 Azure-SSIS IR 提供你自己的静态公共 IP 地址的任何子网。Otherwise, it can be any subnet to bring your own static public IP addresses for Azure-SSIS IR.

    7. 选中“为 Azure-SSIS Integration Runtime 提供静态公共 IP 地址”复选框,以选择是否要为 Azure-SSIS IR 提供自己的静态公共 IP 地址,以便可以在数据源的防火墙中允许这些地址。Select the Bring static public IP addresses for your Azure-SSIS Integration Runtime check box to choose whether you want to bring your own static public IP addresses for Azure-SSIS IR, so you can allow them on the firewall for your data sources.

      如果选中该复选框,请完成以下步骤。If you select the check box, complete the following steps.

      1. 对于“第一个静态公共 IP 地址”,请选择符合 Azure-SSIS IR 的要求的第一个静态公共 IP 地址。For First static public IP address, select the first static public IP address that meets the requirements for your Azure-SSIS IR. 如果没有任何符合要求的 IP 地址,请单击“新建”链接以在 Azure 门户中创建静态公共 IP 地址,然后单击此处的刷新按钮,以便可以选择创建的地址。If you don't have any, click Create new link to create static public IP addresses on Azure portal and then click the refresh button here, so you can select them.

      2. 对于“第二个静态公共 IP 地址”,请选择符合 Azure-SSIS IR 的要求的第二个静态公共 IP 地址。For Second static public IP address, select the second static public IP address that meets the requirements for your Azure-SSIS IR. 如果没有任何符合要求的 IP 地址,请单击“新建”链接以在 Azure 门户中创建静态公共 IP 地址,然后单击此处的刷新按钮,以便可以选择创建的地址。If you don't have any, click Create new link to create static public IP addresses on Azure portal and then click the refresh button here, so you can select them.

    8. 选择“VNet 验证”。Select VNet Validation. 如果验证成功,请选择“继续”。If the validation is successful, select Continue.

    使用虚拟网络的高级设置

  9. 在“摘要”部分,复查 Azure-SSIS IR 的所有设置。On the Summary section, review all settings for your Azure-SSIS IR. 然后选择“更新”。Then select Update.

  10. 在 Azure-SSIS IR 的“操作”列中选择“启动”按钮以启动 Azure-SSIS IR。 Start your Azure-SSIS IR by selecting the Start button in the Actions column for your Azure-SSIS IR. 启动要加入虚拟网络的 Azure-SSIS IR 需要花费大约 20 到 30 分钟。It takes about 20 to 30 minutes to start the Azure-SSIS IR that joins a virtual network.

Azure PowerShellAzure PowerShell

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

定义变量Define the variables

$ResourceGroupName = "[your Azure resource group name]"
$DataFactoryName = "[your data factory name]"
$AzureSSISName = "[your Azure-SSIS IR name]"
# Virtual network info: Classic or Azure Resource Manager
$VnetId = "[your virtual network resource ID or leave it empty]" # REQUIRED if you use SQL Database with IP firewall rules/virtual network service endpoints to host SSISDB, or if you require access to on-premises data without configuring a self-hosted IR. We recommend an Azure Resource Manager virtual network, because classic virtual networks will be deprecated soon.
$SubnetName = "[your subnet name or leave it empty]" # WARNING: Use the same subnet as the one used for SQL Database with virtual network service endpoints
# Public IP address info: OPTIONAL to provide two standard static public IP addresses with DNS name under the same subscription and in the same region as your virtual network
$FirstPublicIP = "[your first public IP address resource ID or leave it empty]"
$SecondPublicIP = "[your second public IP address resource ID or leave it empty]"

配置虚拟网络Configure a virtual network

在将 Azure-SSIS IR 加入虚拟网络之前,需要先配置该虚拟网络。Before you can join your Azure-SSIS IR to a virtual network, you need to configure the virtual network. 若要自动配置需加入虚拟网络的 Azure-SSIS IR 的权限和设置,请添加以下脚本:To automatically configure virtual network permissions and settings for your Azure-SSIS IR to join the virtual network, add the following script:

# Make sure to run this script against the subscription to which the virtual network belongs.
if(![string]::IsNullOrEmpty($VnetId) -and ![string]::IsNullOrEmpty($SubnetName))
{
    # Register to the Azure Batch resource provider
    $BatchApplicationId = "ddbf3205-c6bd-46ae-8127-60eb93363864"
    $BatchObjectId = (Get-AzADServicePrincipal -ServicePrincipalName $BatchApplicationId).Id
    Register-AzResourceProvider -ProviderNamespace Microsoft.Batch
    while(!(Get-AzResourceProvider -ProviderNamespace "Microsoft.Batch").RegistrationState.Contains("Registered"))
    {
    Start-Sleep -s 10
    }
    if($VnetId -match "/providers/Microsoft.ClassicNetwork/")
    {
        # Assign the VM contributor role to Microsoft.Batch
        New-AzRoleAssignment -ObjectId $BatchObjectId -RoleDefinitionName "Classic Virtual Machine Contributor" -Scope $VnetId
    }
}

创建 Azure-SSIS IR 并将其加入虚拟网络Create an Azure-SSIS IR and join it to a virtual network

可以创建 Azure-SSIS IR,并将其加入虚拟网络。You can create an Azure-SSIS IR and join it to a virtual network at the same time. 有关完整的脚本和说明,请参阅创建 Azure-SSIS IRFor the complete script and instructions, see Create an Azure-SSIS IR.

将现有 Azure-SSIS IR 加入虚拟网络Join an existing Azure-SSIS IR to a virtual network

创建 Azure-SSIS IR 一文介绍了如何在同一个脚本中创建 Azure-SSIS IR 并将其加入虚拟网络。The Create an Azure-SSIS IR article shows you how to create an Azure-SSIS IR and join it to a virtual network in the same script. 如果你已有一个 Azure-SSIS IR,请执行以下步骤将其加入虚拟网络:If you already have an Azure-SSIS IR, follow these steps to join it to the virtual network:

  1. 停止 Azure-SSIS IR。Stop the Azure-SSIS IR.
  2. 将 Azure-SSIS IR 配置为加入虚拟网络。Configure the Azure-SSIS IR to join the virtual network.
  3. 启动 Azure-SSIS IR。Start the Azure-SSIS IR.

停止 Azure-SSIS IRStop the Azure-SSIS IR

必须先停止 Azure-SSIS IR,然后才能将它加入虚拟网络。You have to stop the Azure-SSIS IR before you can join it to a virtual network. 此命令释放该运行时的所有节点并停止计费:This command releases all of its nodes and stops billing:

Stop-AzDataFactoryV2IntegrationRuntime -ResourceGroupName $ResourceGroupName `
    -DataFactoryName $DataFactoryName `
    -Name $AzureSSISName `
    -Force 

为要加入的 Azure-SSIS IR 配置虚拟网络设置Configure virtual network settings for the Azure-SSIS IR to join

若要配置 Azure-SSIS 要加入到的虚拟网络的设置,请使用此脚本:To configure settings for the virtual network that the Azure-SSIS will join, use this script:

# Make sure to run this script against the subscription to which the virtual network belongs.
if(![string]::IsNullOrEmpty($VnetId) -and ![string]::IsNullOrEmpty($SubnetName))
{
    # Register to the Azure Batch resource provider
    $BatchApplicationId = "ddbf3205-c6bd-46ae-8127-60eb93363864"
    $BatchObjectId = (Get-AzADServicePrincipal -ServicePrincipalName $BatchApplicationId).Id
    Register-AzResourceProvider -ProviderNamespace Microsoft.Batch
    while(!(Get-AzResourceProvider -ProviderNamespace "Microsoft.Batch").RegistrationState.Contains("Registered"))
    {
        Start-Sleep -s 10
    }
    if($VnetId -match "/providers/Microsoft.ClassicNetwork/")
    {
        # Assign VM contributor role to Microsoft.Batch
        New-AzRoleAssignment -ObjectId $BatchObjectId -RoleDefinitionName "Classic Virtual Machine Contributor" -Scope $VnetId
    }
}

配置 Azure-SSIS IRConfigure the Azure-SSIS IR

若将 Azure-SSIS IR 加入虚拟网络,请运行 Set-AzDataFactoryV2IntegrationRuntime 命令:To join your Azure-SSIS IR to a virtual network, run the Set-AzDataFactoryV2IntegrationRuntime command:

Set-AzDataFactoryV2IntegrationRuntime -ResourceGroupName $ResourceGroupName `
    -DataFactoryName $DataFactoryName `
    -Name $AzureSSISName `
    -VnetId $VnetId `
    -Subnet $SubnetName

# Add public IP address parameters if you bring your own static public IP addresses
if(![string]::IsNullOrEmpty($FirstPublicIP) -and ![string]::IsNullOrEmpty($SecondPublicIP))
{
    $publicIPs = @($FirstPublicIP, $SecondPublicIP)
    Set-AzDataFactoryV2IntegrationRuntime -ResourceGroupName $ResourceGroupName `
        -DataFactoryName $DataFactoryName `
        -Name $AzureSSISName `
        -PublicIPs $publicIPs
}

启动 Azure-SSIS IRStart the Azure-SSIS IR

若要启动 Azure-SSIS IR,请运行以下命令:To start the Azure-SSIS IR, run the following command:

Start-AzDataFactoryV2IntegrationRuntime -ResourceGroupName $ResourceGroupName `
    -DataFactoryName $DataFactoryName `
    -Name $AzureSSISName `
    -Force

此命令需要 20 到 30 分钟才能完成。This command takes 20 to 30 minutes to finish.

后续步骤Next steps

有关 Azure-SSIS IR 的详细信息,请参阅以下文章:For more information about Azure-SSIS IR, see the following articles:

  • Azure-SSIS IRAzure-SSIS IR. 此文提供有关 IR(包括 Azure-SSIS IR)的一般概念性信息。This article provides general conceptual information about IRs, including Azure-SSIS IR.
  • 教程:将 SSIS 包部署到 Azure 中的分步说明创建一个。Tutorial: Deploy SSIS packages to Azure. 此教程提供有关创建 Azure-SSIS IR 的分步说明。This tutorial provides step-by-step instructions to create your Azure-SSIS IR. 它使用 Azure SQL 数据库来托管 SSIS 目录。It uses Azure SQL Database to host the SSIS catalog.
  • 创建 Azure-SSIS IRCreate an Azure-SSIS IR. 此文对本教程的内容做了扩充。This article expands on the tutorial. 其中说明了如何使用包含虚拟网络服务终结点的 Azure SQL 数据库来承载 SSIS 目录。It provides instructions about using Azure SQL Database with virtual network service endpoints to host the SSIS catalog. 此外,它介绍了如何将 Azure-SSIS IR 加入虚拟网络。It shows how to join your Azure-SSIS IR to a virtual network.
  • 监视 Azure-SSIS IRMonitor an Azure-SSIS IR. 此文介绍如何获取有关 Azure-SSIS IR 的信息。This article shows you how to get information about your Azure-SSIS IR. 其中提供了返回的信息的状态说明。It provides status descriptions for the returned information.
  • 管理 Azure-SSIS IRManage an Azure-SSIS IR. 此文介绍如何停止、启动或删除 Azure-SSIS IR。This article shows you how to stop, start, or delete your Azure-SSIS IR. 此外,介绍如何通过添加节点来扩展 Azure-SSIS IR。It also shows you how to scale out your Azure-SSIS IR by adding nodes.