配置 ExpressRoute 和站点到站点并存连接(经典)Configure ExpressRoute and Site-to-Site coexisting connections (classic)

本文有助于配置可共存的 ExpressRoute 和站点到站点 VPN 连接。This article helps you configure ExpressRoute and Site-to-Site VPN connections that coexist. 能够配置站点到站点 VPN 和 ExpressRoute 具有多项优势。Having the ability to configure Site-to-Site VPN and ExpressRoute has several advantages. 可以将站点到站点 VPN 配置为 ExpressRoute 的安全故障转移路径,或者使用站点到站点 VPN 连接到不是通过 ExpressRoute 进行连接的站点。You can configure Site-to-Site VPN as a secure failover path for ExpressRoute, or use Site-to-Site VPNs to connect to sites that are not connected through ExpressRoute. 我们会在本文中介绍这两种方案的配置步骤。We will cover the steps to configure both scenarios in this article. 本文适用于经典部署模型。This article applies to the classic deployment model. 此配置在门户中不可用。This configuration is not available in the portal.


从 2017 年 3 月 1 日开始,将无法在经典部署模型中创建新的 ExpressRoute 线路。As of March 1, 2017, you can't create new ExpressRoute circuits in the classic deployment model.

  • 可以将现有的 ExpressRoute 线路从经典部署模型移到 Resource Manager 部署模型,不会遇到连接中断问题。You can move an existing ExpressRoute circuit from the classic deployment model to the Resource Manager deployment model without experiencing any connectivity down time. 有关详细信息,请参阅移动现有线路For more information, see Move an existing circuit.
  • allowClassicOperations 设置为 TRUE 即可在经典部署模型中连接到虚拟网络。You can connect to virtual networks in the classic deployment model by setting allowClassicOperations to TRUE.

请使用以下链接在 Resource Manager 部署模型中创建和管理 ExpressRoute 线路:Use the following links to create and manage ExpressRoute circuits in the Resource Manager deployment model:

关于 Azure 部署模型About Azure deployment models

Azure 当前使用两种部署模型:资源管理器部署模型和经典部署模型。Azure currently works with two deployment models: Resource Manager and classic. 这两个模型不是完全兼容的。The two models are not completely compatible with each other. 在开始之前,需要知道所要使用的模型。Before you begin, you need to know which model that you want to work in. 有关部署模型的信息,请参阅了解部署模型For information about the deployment models, see Understanding deployment models. 如果不熟悉 Azure,建议使用 Resource Manager 部署模型。If you are new to Azure, we recommend that you use the Resource Manager deployment model.


按以下说明进行操作之前,必须预先配置ExpressRoute 线路。ExpressRoute circuits must be pre-configured before you follow the instructions below. 在按以下步骤操作之前,请务必遵循相关指南来创建 ExpressRoute 线路配置路由Make sure that you have followed the guides to create an ExpressRoute circuit and configure routing before you follow the steps below.

限制和局限性Limits and limitations

  • 不支持传输路由。Transit routing is not supported. 无法在通过站点到站点 VPN 连接的本地网络与通过 ExpressRoute 连接的本地网络之间进行路由(通过 Azure)。You cannot route (via Azure) between your local network connected via Site-to-Site VPN and your local network connected via ExpressRoute.
  • 不支持点到站点路由。Point-to-site is not supported. 不能启用与连接到 ExpressRoute 的同一 VNet 的点到站点 VPN 连接。You can't enable point-to-site VPN connections to the same VNet that is connected to ExpressRoute. 对于同一 VNet 而言,点到站点 VPN 和 ExpressRoute 不能共存。Point-to-site VPN and ExpressRoute cannot coexist for the same VNet.
  • 不能在站点到站点 VPN 网关上启用强制隧道。Forced tunneling cannot be enabled on the Site-to-Site VPN gateway. 仅可“强制”所有面向 Internet 的流量通过 ExpressRoute 回到本地网络。You can only "force" all Internet-bound traffic back to your on-premises network via ExpressRoute.
  • 不支持基本 SKU 网关。Basic SKU gateway is not supported. 必须为 ExpressRoute 网关VPN 网关使用非基本 SKU 网关。You must use a non-Basic SKU gateway for both the ExpressRoute gateway and the VPN gateway.
  • 仅支持基于路由的 VPN 网关。Only route-based VPN gateway is supported. 必须使用基于路由的 VPN Gateway使用非基本 SKU 网关。You must use a route-based VPN Gateway.
  • 应该为 VPN 网关配置静态路由。Static route should be configured for your VPN gateway. 如果本地网络同时连接到 ExpressRoute 和站点到站点 VPN,则必须在本地网络中配置静态路由,以便将站点到站点 VPN 连接路由到公共 Internet。If your local network is connected to both ExpressRoute and a Site-to-Site VPN, you must have a static route configured in your local network to route the Site-to-Site VPN connection to the public Internet.
  • 必须先配置 ExpressRoute 网关。ExpressRoute gateway must be configured first. 必须先创建 ExpressRoute 网关,才能添加站点到站点 VPN 网关。You must create the ExpressRoute gateway first before you add the Site-to-Site VPN gateway.

配置设计Configuration designs

将站点到站点 VPN 配置为 ExpressRoute 的故障转移路径Configure a Site-to-Site VPN as a failover path for ExpressRoute

可以将站点到站点 VPN 连接配置为 ExpressRoute 的备份。You can configure a Site-to-Site VPN connection as a backup for ExpressRoute. 这仅适用于链接到 Azure 专用对等路径的虚拟网络。This applies only to virtual networks linked to the Azure private peering path. 对于可通过 Azure 公共线路和 Microsoft 对等线路访问的服务,没有基于 VPN 的故障转移解决方案。There is no VPN-based failover solution for services accessible through Azure public and Microsoft peerings. ExpressRoute 线路始终是主链接。The ExpressRoute circuit is always the primary link. 仅当 ExpressRoute 线路失败时,数据才会流经站点到站点 VPN 路径。Data will flow through the Site-to-Site VPN path only if the ExpressRoute circuit fails.


虽然在两个路由相同的情况下 ExpressRoute 线路优先于站点到站点 VPN,Azure 仍会使用最长的前缀匹配来选择指向数据包目标的路由。While ExpressRoute circuit is preferred over Site-to-Site VPN when both routes are the same, Azure will use the longest prefix match to choose the route towards the packet's destination.


配置站点到站点 VPN,以便连接到不通过 ExpressRoute 进行连接的站点Configure a Site-to-Site VPN to connect to sites not connected through ExpressRoute

可以对网络进行配置,使得部分站点通过站点到站点 VPN 直接连接到 Azure,部分站点通过 ExpressRoute 进行连接。You can configure your network where some sites connect directly to Azure over Site-to-Site VPN, and some sites connect through ExpressRoute.



不能将虚拟网络配置为转换路由器。You cannot a configure a virtual network as a transit router.

选择要使用的步骤Selecting the steps to use

若要配置能够共存的连接,有两组不同的过程可供选择。There are two different sets of procedures to choose from in order to configure connections that can coexist. 选择的配置过程将取决于有要连接到的现有虚拟网络,还是要创建新的虚拟网络。The configuration procedure that you select will depend on whether you have an existing virtual network that you want to connect to, or you want to create a new virtual network.

  • 我没有 VNet,需要创建一个。I don't have a VNet and need to create one.

    如果用户还没有虚拟网络,此过程将指导用户使用经典部署模型创建新的虚拟网络,并创建新的 ExpressRoute 和站点到站点 VPN 连接。If you don’t already have a virtual network, this procedure will walk you through creating a new virtual network using the classic deployment model and creating new ExpressRoute and Site-to-Site VPN connections. 若要配置,请按照本文中 创建新的虚拟网络和并存连接部分中的步骤操作。To configure, follow the steps in the article section To create a new virtual network and coexisting connections.

  • 我已有一个经典部署模型 VNet。I already have a classic deployment model VNet.

    可能已在具有现有站点到站点 VPN 连接或 ExpressRoute 连接的位置拥有虚拟网络。You may already have a virtual network in place with an existing Site-to-Site VPN connection or ExpressRoute connection. 本文的 为现有的 VNet 配置并存连接 部分指导删除网关,并创建新的 ExpressRoute 连接和站点到站点 VPN 连接。The article section To configure coexsiting connections for an already existing VNet will walk you through deleting the gateway, and then creating new ExpressRoute and Site-to-Site VPN connections. 请注意,在创建新连接时,必须按照非常特定的顺序完成步骤。Note that when creating the new connections, the steps must be completed in a very specific order. 不要按照其他文章中的说明来创建网关和连接。Don't use the instructions in other articles to create your gateways and connections.

    在此过程中,创建可以共存的连接将需要用户删除网关,并配置新网关。In this procedure, creating connections that can coexist will require you to delete your gateway, and then configure new gateways. 这意味着,在删除并重新创建网关和连接时,跨界连接会停止工作,但你无需将任何 VM 或服务迁移到新的虚拟网络。This means you will have downtime for your cross-premises connections while you delete and recreate your gateway and connections, but you will not need to migrate any of your VMs or services to a new virtual network. 在配置网关时,如果进行了相应配置,VM 和服务仍可以通过负载均衡器与外界通信。Your VMs and services will still be able to communicate out through the load balancer while you configure your gateway if they are configured to do so.

安装 PowerShell cmdletInstall PowerShell cmdlets

安装最新版本的 Azure 服务管理 (SM) PowerShell 模块和 ExpressRoute 模块。Install the latest versions of the Azure Service Management (SM) PowerShell modules and the ExpressRoute module.

  1. 按照安装服务管理模块一文中的说明安装 Azure 服务管理模块。Use the instructions in the Installing the Service Management module article to install the Azure Service Management Module. 如果已安装 Az 或 RM 模块,请确保使用“-AllowClobber”。If you have the Az or RM module already installed, be sure to use '-AllowClobber'.

  2. 导入已安装的模块。Import the installed modules. 使用以下示例时,请调整路径以反映已安装的 PowerShell 模块的位置和版本。When using the following example, adjust the path to reflect the location and version of your installed PowerShell modules.

    Import-Module 'C:\Program Files\WindowsPowerShell\Modules\Azure\5.3.0\Azure.psd1'
    Import-Module 'C:\Program Files\WindowsPowerShell\Modules\Azure\5.3.0\ExpressRoute\ExpressRoute.psd1'
  3. 若要登录到 Azure 帐户,请使用提升的权限打开 PowerShell 控制台,并连接到帐户。To sign in to your Azure account, open your PowerShell console with elevated rights and connect to your account. 使用以下示例帮助你通过服务管理模块进行连接:Use the following example to help you connect using the Service Management module:


创建新的虚拟网络和并存连接To create a new virtual network and coexisting connections

本过程指导创建 VNet,以及创建将共存的站点到站点连接和 ExpressRoute 连接。This procedure will walk you through creating a VNet and create Site-to-Site and ExpressRoute connections that will coexist.

  1. 需要安装 Azure PowerShell cmdlet 的最新版本。You'll need to install the latest version of the Azure PowerShell cmdlets. 有关安装 PowerShell cmdlet 的详细信息,请参阅 如何安装和配置 Azure PowerShellSee How to install and configure Azure PowerShell for more information about installing the PowerShell cmdlets. 请注意,针对此配置使用的 cmdlet 可能与你熟悉的 cmdlet 稍有不同。Note that the cmdlets that you'll use for this configuration may be slightly different than what you might be familiar with. 请务必使用说明内容中指定的 cmdlet。Be sure to use the cmdlets specified in these instructions.

  2. 创建虚拟网络的架构。Create a schema for your virtual network. 有关配置架构的详细信息,请参阅 Azure 虚拟网络配置架构For more information about the configuration schema, see Azure Virtual Network configuration schema.

    在创建架构时,请确保使用以下值:When you create your schema, make sure you use the following values:

    • 虚拟网络的网关子网必须是 /27 或更短的前缀(例如 /26 或 /25)。The gateway subnet for the virtual network must be /27 or a shorter prefix (such as /26 or /25).

    • 网关连接类型为“专用”。The gateway connection type is "Dedicated".

          <VirtualNetworkSite name="MyAzureVNET" Location="Central US">
              <Subnet name="Subnet-1">
              <Subnet name="GatewaySubnet">
                <LocalNetworkSiteRef name="MyLocalNetwork">
                  <Connection type="Dedicated" />
  3. 在创建并配置 xml 架构文件之后,上传文件。After creating and configuring your xml schema file, upload the file. 这会创建虚拟网络。This will create your virtual network.

    使用以下 cmdlet 上传文件,并将值替换成自己的值。Use the following cmdlet to upload your file, replacing the value with your own.

     Set-AzureVNetConfig -ConfigurationPath 'C:\NetworkConfig.xml'
  4. 创建 ExpressRoute 网关。Create an ExpressRoute gateway. 请务必将 GatewaySKU 指定为 StandardHighPerformanceUltraPerformance,并将 GatewayType 指定为 DynamicRoutingBe sure to specify the GatewaySKU as Standard, HighPerformance, or UltraPerformance and the GatewayType as DynamicRouting.

    使用以下示例,将值替换成自己的值。Use the following sample, substituting the values for your own.

     New-AzureVNetGateway -VNetName MyAzureVNET -GatewayType DynamicRouting -GatewaySKU HighPerformance
  5. 将 ExpressRoute 网关连接到 ExpressRoute 线路。Link the ExpressRoute gateway to the ExpressRoute circuit. 完成此步骤后,则已通过 ExpressRoute 建立本地网络与 Azure 之间的连接。After this step has been completed, the connection between your on-premises network and Azure, through ExpressRoute, is established.

     New-AzureDedicatedCircuitLink -ServiceKey <service-key> -VNetName MyAzureVNET
  6. 接下来,创建站点到站点 VPN 网关。Next, create your Site-to-Site VPN gateway. GatewaySKU 必须为 StandardHighPerformanceUltraPerformance,GatewayType 必须为 DynamicRoutingThe GatewaySKU must be Standard, HighPerformance, or UltraPerformance and the GatewayType must be DynamicRouting.

     New-AzureVirtualNetworkGateway -VNetName MyAzureVNET -GatewayName S2SVPN -GatewayType DynamicRouting -GatewaySKU  HighPerformance

    若要检索虚拟网络网关设置(包括网关 ID 和公共 IP),请使用 Get-AzureVirtualNetworkGateway cmdlet。To retrieve the virtual network gateway settings, including the gateway ID and the public IP, use the Get-AzureVirtualNetworkGateway cmdlet.

     GatewayId            : 348ae011-ffa9-4add-b530-7cb30010565e
     GatewayName          : S2SVPN
     LastEventData        :
     GatewayType          : DynamicRouting
     LastEventTimeStamp   : 5/29/2015 4:41:41 PM
     LastEventMessage     : Successfully created a gateway for the following virtual network: GNSDesMoines
     LastEventID          : 23002
     State                : Provisioned
     VIPAddress           : 104.43.x.y
     DefaultSite          :
     GatewaySKU           : HighPerformance
     Location             :
     VnetId               : 979aabcf-e47f-4136-ab9b-b4780c1e1bd5
     SubnetId             :
     EnableBgp            : False
     OperationDescription : Get-AzureVirtualNetworkGateway
     OperationId          : 42773656-85e1-a6b6-8705-35473f1e6f6a
     OperationStatus      : Succeeded
  7. 创建一个本地站点 VPN 网关实体。Create a local site VPN gateway entity. 此命令不会配置本地 VPN 网关,This command doesn’t configure your on-premises VPN gateway. 而是允许提供本地网关设置(如公共 IP 和本地地址空间),以便 Azure VPN 网关可以连接到它。Rather, it allows you to provide the local gateway settings, such as the public IP and the on-premises address space, so that the Azure VPN gateway can connect to it.


    netcfg 中未定义站点到站点 VPN 的本地站点。The local site for the Site-to-Site VPN is not defined in the netcfg. 而是,必须使用此 cmdlet 指定本地站点参数。Instead, you must use this cmdlet to specify the local site parameters. 不能使用门户或 netcfg 文件定义它。You cannot define it using either portal, or the netcfg file.

    使用下面的示例,并将值替换成自己的值。Use the following sample, replacing the values with your own.

     New-AzureLocalNetworkGateway -GatewayName MyLocalNetwork -IpAddress <MyLocalGatewayIp> -AddressSpace <MyLocalNetworkAddress>


    如果你的本地网络具有多个路由,可以通过数组的形式将其全部传入。If your local network has multiple routes, you can pass them all in as an array. $MyLocalNetworkAddress = @("","","")$MyLocalNetworkAddress = @("","","")

    若要检索虚拟网络网关设置(包括网关 ID 和公共 IP),请使用 Get-AzureVirtualNetworkGateway cmdlet。To retrieve the virtual network gateway settings, including the gateway ID and the public IP, use the Get-AzureVirtualNetworkGateway cmdlet. 请参阅以下示例。See the following example.

     GatewayId            : 532cb428-8c8c-4596-9a4f-7ae3a9fcd01b
     GatewayName          : MyLocalNetwork
     IpAddress            : 23.39.x.y
     AddressSpace         : {}
     OperationDescription : Get-AzureLocalNetworkGateway
     OperationId          : ddc4bfae-502c-adc7-bd7d-1efbc00b3fe5
     OperationStatus      : Succeeded
  8. 配置本地 VPN 设备以连接到新网关。Configure your local VPN device to connect to the new gateway. 配置 VPN 设备时,使用在步骤 6 中检索到的信息。Use the information that you retrieved in step 6 when configuring your VPN device. 有关 VPN 设备配置的详细信息,请参阅 VPN 设备配置For more information about VPN device configuration, see VPN Device Configuration.

  9. 将 Azure 上的站点到站点 VPN 网关连接到本地网关。Link the site-to-site VPN gateway on Azure to the local gateway.

    在此示例中,connectedEntityId 是本地网关 ID,可以通过运行 Get-AzureLocalNetworkGateway来查找它。In this example, connectedEntityId is the local gateway ID, which you can find by running Get-AzureLocalNetworkGateway. 可以通过使用 Get-AzureVirtualNetworkGateway cmdlet 查找 virtualNetworkGatewayId。You can find virtualNetworkGatewayId by using the Get-AzureVirtualNetworkGateway cmdlet. 完成此步骤后,已通过站点到站点 VPN 连接建立本地网络与 Azure 之间的连接。After this step, the connection between your local network and Azure via the site-to-site VPN connection is established.

     New-AzureVirtualNetworkGatewayConnection -connectedEntityId <local-network-gateway-id> -gatewayConnectionName Azure2Local -gatewayConnectionType IPsec -sharedKey abc123 -virtualNetworkGatewayId <azure-s2s-vpn-gateway-id>

为现有的 VNet 配置并存连接To configure coexisting connections for an already existing VNet

如果已经有了一个虚拟网络,请检查网关子网大小。If you have an existing virtual network, check the gateway subnet size. 如果网关子网为 /28 或 /29,则必须先删除虚拟网络网关,然后增加网关子网大小。If the gateway subnet is /28 or /29, you must first delete the virtual network gateway and increase the gateway subnet size. 本部分的步骤说明如何这样做。The steps in this section will show you how to do that.

如果网关子网为 /27 或更大,且虚拟网络是通过 ExpressRoute 连接的,则可跳过下面的步骤,转到前一部分的 “步骤 6 - 创建站点到站点 VPN 网关”If the gateway subnet is /27 or larger and the virtual network is connected via ExpressRoute, you can skip the steps below and proceed to "Step 6 - Create a Site-to-Site VPN gateway" in the previous section.


如果你删除的是现有网关,则当你进行此配置时,本地系统将失去与虚拟网络建立的连接。When you delete the existing gateway, your local premises will lose the connection to your virtual network while you are working on this configuration.

  1. 需要安装最新版本的 Azure Resource Manager PowerShell cmdlet。You'll need to install the latest version of the Azure Resource Manager PowerShell cmdlets. 有关安装 PowerShell cmdlet 的详细信息,请参阅 如何安装和配置 Azure PowerShellSee How to install and configure Azure PowerShell for more information about installing the PowerShell cmdlets. 请注意,针对此配置使用的 cmdlet 可能与你熟悉的 cmdlet 稍有不同。Note that the cmdlets that you'll use for this configuration may be slightly different than what you might be familiar with. 请务必使用说明内容中指定的 cmdlet。Be sure to use the cmdlets specified in these instructions.

  2. 删除现有的 ExpressRoute 或站点到站点 VPN 网关。Delete the existing ExpressRoute or Site-to-Site VPN gateway. 使用下面的 cmdlet,并将值替换成自己的值。Use the following cmdlet, replacing the values with your own.

     Remove-AzureVNetGateway -VnetName MyAzureVNET
  3. 导出虚拟网络架构。Export the virtual network schema. 使用下面的 PowerShell cmdlet,并将值替换成自己的值。Use the following PowerShell cmdlet, replacing the values with your own.

     Get-AzureVNetConfig -ExportToFile "C:\NetworkConfig.xml"
  4. 编辑网络配置文件架构,使网关子网为 /27 或更短的前缀(例如 /26 或 /25)。Edit the network configuration file schema so that the gateway subnet is /27 or a shorter prefix (such as /26 or /25). 请参阅以下示例。See the following example.


    如果因为虚拟网络中没有剩余足够的 IP 地址而无法增加网关子网大小,则需增加 IP 地址空间。If you don't have enough IP addresses left in your virtual network to increase the gateway subnet size, you need to add more IP address space. 有关配置架构的详细信息,请参阅 Azure 虚拟网络配置架构For more information about the configuration schema, see Azure Virtual Network configuration schema.

       <Subnet name="GatewaySubnet">
  5. 如果以前的网关是站点到站点 VPN,则还必须将连接类型更改为 “专用” 。If your previous gateway was a Site-to-Site VPN, you must also change the connection type to Dedicated.

                 <LocalNetworkSiteRef name="MyLocalNetwork">
                   <Connection type="Dedicated" />
  6. 此时,将拥有不带网关的虚拟网络。At this point, you'll have a VNet with no gateways. 若要创建新网关并完成连接,可以转到 步骤 4 - 创建 ExpressRoute 网关(可以在前一组步骤中找到)。To create new gateways and complete your connections, you can proceed with Step 4 - Create an ExpressRoute gateway, found in the preceding set of steps.

后续步骤Next steps

有关 ExpressRoute 的详细信息,请参阅 ExpressRoute 常见问题For more information about ExpressRoute, see the ExpressRoute FAQ