关于 ExpressRoute 的虚拟网络网关About virtual network gateways for ExpressRoute

虚拟网络网关用于在 Azure 虚拟网络和本地位置之间发送网络流量。A virtual network gateway is used to send network traffic between Azure virtual networks and on-premises locations. 可以使用虚拟网络网关发送 ExpressRoute 流量或 VPN 流量。You can use a virtual network gateway for either ExpressRoute traffic, or VPN traffic. 本文重点介绍 ExpressRoute 虚拟网络网关,并且包含了有关 SKU、按 SKU 预估的性能和网关类型的信息。This article focuses on ExpressRoute virtual network gateways and contains information about SKUs, estimated performance by SKU, and gateway types.

网关类型Gateway types

创建虚拟网络网关时,需要指定几项设置。When you create a virtual network gateway, you need to specify several settings. 其中一个必要设置“-GatewayType”指定是否将网关用于 ExpressRoute 或 VPN 流量。One of the required settings, '-GatewayType', specifies whether the gateway is used for ExpressRoute, or VPN traffic. 两种网关类型是:The two gateway types are:

  • Vpn - 若要通过公共 Internet 发送加密流量,请使用网关类型“Vpn”。Vpn - To send encrypted traffic across the public Internet, you use the gateway type 'Vpn'. 这也称为 VPN 网关。This is also referred to as a VPN gateway. 站点到站点、点到站点和 VNet 到 VNet 连接都使用 VPN 网关。Site-to-Site, Point-to-Site, and VNet-to-VNet connections all use a VPN gateway.

  • ExpressRoute - 若要在专用连接上发送网络流量,请使用网关类型“ExpressRoute”。ExpressRoute - To send network traffic on a private connection, you use the gateway type 'ExpressRoute'. 这也称为 ExpressRoute 网关,是配置 ExpressRoute 时使用的网关类型。This is also referred to as an ExpressRoute gateway and is the type of gateway used when configuring ExpressRoute.

对于每种网关类型,每个虚拟网络只能有一个虚拟网络网关。Each virtual network can have only one virtual network gateway per gateway type. 例如,一个虚拟网络网关使用 -GatewayType Vpn,另一个使用 -GatewayType ExpressRoute。For example, you can have one virtual network gateway that uses -GatewayType Vpn, and one that uses -GatewayType ExpressRoute.

网关 SKUGateway SKUs

创建虚拟网络网关时,需要指定要使用的网关 SKU。When you create a virtual network gateway, you need to specify the gateway SKU that you want to use. 如果选择更高级的网关 SKU,则为该网关分配更多的 CPU 和网络带宽,这样使网关能够支持到虚拟网络更高的吞吐量。When you select a higher gateway SKU, more CPUs and network bandwidth are allocated to the gateway, and as a result, the gateway can support higher network throughput to the virtual network.

ExpressRoute 虚拟网络网关可使用以下 SKU:ExpressRoute virtual network gateways can use the following SKUs:

  • 标准Standard
  • HighPerformanceHighPerformance
  • UltraPerformanceUltraPerformance

如果想要将网关升级为功能更强大的网关 SKU,在大多数情况下,可以使用“Resize-AzVirtualNetworkGateway”PowerShell cmdlet。If you want to upgrade your gateway to a more powerful gateway SKU, in most cases you can use the 'Resize-AzVirtualNetworkGateway' PowerShell cmdlet. 此方法适用于升级到 Standard 和 HighPerformance SKU。This will work for upgrades to Standard and HighPerformance SKUs. 但是,若要升级到 UltraPerformance SKU,需要重新创建网关。However, to upgrade to the UltraPerformance SKU, you will need to recreate the gateway. 重新创建网关会导致停机。Recreating a gateway incurs downtime.

预估性能(按网关 SKU)Estimated performances by gateway SKU

下表显示网关类型和估计性能。The following table shows the gateway types and the estimated performances. 此表适用于 Resource Manager 与经典部署模型。This table applies to both the Resource Manager and classic deployment models.

每秒兆位Megabits per second 每秒的数据包数Packets per second 每秒连接数Connections per second VPN 网关和 ExpressRoute 共存VPN Gateway and ExpressRoute coexist
基本 SKU(已弃用)Basic SKU (deprecated) 500500 UnknownUnknown UnknownUnknown No
标准 SKUStandard SKU 1,0001,000 100,000100,000 7,0007,000 Yes
高性能 SKUHigh Performance SKU 2,0002,000 250,000250,000 14,00014,000 Yes
超高性能 SKUUltra Performance SKU 10,00010,000 1,000,0001,000,000 28,00028,000 Yes

重要

应用程序性能取决于多种因素,例如端到端延迟和应用程序打开的流量数。Application performance depends on multiple factors, such as the end-to-end latency, and the number of traffic flows the application opens. 表中的数字表示应用程序在理想环境下理论上可达到的上限。The numbers in the table represent the upper limit that the application can theoretically achieve in an ideal environment.

网关子网Gateway subnet

在创建 ExpressRoute 网关之前,必须创建一个网关子网。Before you create an ExpressRoute gateway, you must create a gateway subnet. 网关子网包含虚拟网络网关 VM 和服务使用的 IP 地址。The gateway subnet contains the IP addresses that the virtual network gateway VMs and services use. 创建虚拟网络网关时,会将网关 VM 部署到网关子网,并使用所需的 ExpressRoute 网关设置进行配置。When you create your virtual network gateway, gateway VMs are deployed to the gateway subnet and configured with the required ExpressRoute gateway settings. 永远不要将任何其他设备(例如,其他 VM)部署到网关子网。Never deploy anything else (for example, additional VMs) to the gateway subnet. 网关子网必须命名为“GatewaySubnet”才能正常工作。The gateway subnet must be named 'GatewaySubnet' to work properly. 将网关子网命名为“GatewaySubnet”,可以让 Azure 知道这就是要将虚拟网络网关 VM 和服务部署到的目标子网。Naming the gateway subnet 'GatewaySubnet' lets Azure know that this is the subnet to deploy the virtual network gateway VMs and services to.

备注

不支持以 0.0.0.0/0 为目标的用户定义路由和 GatewaySubnet 上的 NSG。User defined routes with a 0.0.0.0/0 destination and NSGs on the GatewaySubnet are not supported. 使用此配置创建的网关将被阻止创建。Gateways created with this configuration will be blocked from creation. 网关需要访问管理控制器才能正常工作。Gateways require access to the management controllers in order to function properly.

创建网关子网时,需指定子网包含的 IP 地址数。When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. 将网关子网中的 IP 地址分配到网关 VM 和网关服务。The IP addresses in the gateway subnet are allocated to the gateway VMs and gateway services. 有些配置需要具有比其他配置更多的 IP 地址。Some configurations require more IP addresses than others.

规划网关子网大小时,请参阅你计划创建的配置的相关文档。When you are planning your gateway subnet size, refer to the documentation for the configuration that you are planning to create. 例如,ExpressRoute/VPN 网关共存配置所需的网关子网大于大多数其他配置。For example, the ExpressRoute/VPN Gateway coexist configuration requires a larger gateway subnet than most other configurations. 此外,可能需要确保网关子网包含足够的 IP 地址,以便应对将来可能会添加的配置。Additionally, you may want to make sure your gateway subnet contains enough IP addresses to accommodate possible future additional configurations. 尽管网关子网最小可创建为 /29,但建议创建 /27 或更大(/27、/26 等)的网关子网(如果你有可用的地址空间来执行此操作)。While you can create a gateway subnet as small as /29, we recommend that you create a gateway subnet of /27 or larger (/27, /26 etc.) if you have the available address space to do so. 这将适合大多数配置。This will accommodate most configurations.

以下 Resource Manager PowerShell 示例显示名为 GatewaySubnet 的网关子网。The following Resource Manager PowerShell example shows a gateway subnet named GatewaySubnet. 可以看到,CIDR 表示法指定了 /27,这可提供足够的 IP 地址供大多数现有配置使用。You can see the CIDR notation specifies a /27, which allows for enough IP addresses for most configurations that currently exist.

Add-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -AddressPrefix 10.0.3.0/27

重要

处理网关子网时,请避免将网络安全组 (NSG) 关联到网关子网。When working with gateway subnets, avoid associating a network security group (NSG) to the gateway subnet. 将网络安全组与此子网关联可能会导致虚拟网络网关(VPN、Express Route 网关)停止按预期方式工作。Associating a network security group to this subnet may cause your Virtual Network gateway(VPN, Express Route gateway) to stop functioning as expected. 有关网络安全组的详细信息,请参阅什么是网络安全组?For more information about network security groups, see What is a network security group?

区域冗余型网关 SKUZone-redundant gateway SKUs

也可以在 Azure 可用性区域中部署 ExpressRoute 网关。You can also deploy ExpressRoute gateways in Azure Availability Zones. 这在物理上和逻辑上将它们分成不同的可用区域,从而保护本地网络与 Azure 的连接免受区域级故障的影响。This physically and logically separates them into different Availability Zones, protecting your on-premises network connectivity to Azure from zone-level failures.

区域冗余型 ExpressRoute 网关

区域冗余型网关使用 ExpressRoute 网关的特定新网关 SKU。Zone-redundant gateways use specific new gateway SKUs for ExpressRoute gateway.

  • ErGw1AZErGw1AZ
  • ErGw2AZErGw2AZ
  • ErGw3AZErGw3AZ

新的网关 SKU 还支持其他部署选项,以最好地满足你的需求。The new gateway SKUs also support other deployment options to best match your needs. 使用新网关 SKU 创建虚拟网络网关时,还可以选择在特定区域中部署网关。When creating a virtual network gateway using the new gateway SKUs, you also have the option to deploy the gateway in a specific zone. 这称为区域网关。This is referred to as a zonal gateway. 部署区域网关时,网关的所有实例都部署在同一可用性区域中。When you deploy a zonal gateway, all the instances of the gateway are deployed in the same Availability Zone.

REST API 和 PowerShell cmdletREST APIs and PowerShell cmdlets

有关将 REST API 和 PowerShell cmdlet 用于虚拟网络网关配置的其他技术资源和特定语法要求,请参阅以下页面:For additional technical resources and specific syntax requirements when using REST APIs and PowerShell cmdlets for virtual network gateway configurations, see the following pages:

经典Classic Resource ManagerResource Manager
PowerShellPowerShell PowerShellPowerShell
REST APIREST API REST APIREST API

后续步骤Next steps

有关可用连接配置的详细信息,请参阅 ExpressRoute 概述See ExpressRoute Overview for more information about available connection configurations.

有关创建 ExpressRoute 网关的详细信息,请参阅创建 ExpressRoute 的虚拟网络网关See Create a virtual network gateway for ExpressRoute for more information about creating ExpressRoute gateways.

有关如何启用 FastPath 的详细信息,请参阅将虚拟网络链接到 ExpressRouteSee Link virtual network to ExpressRoute for more information about how to enable FastPath.