使用 PowerShell 将虚拟网络连接到 ExpressRoute 线路(经典)Connect a virtual network to an ExpressRoute circuit using PowerShell (classic)

本文介绍如何使用 PowerShell 将虚拟网络 (VNet) 链接到 Azure ExpressRoute 线路。This article will help you link virtual networks (VNets) to Azure ExpressRoute circuits using PowerShell. 单个 VNet 可最多连接到 4 条 ExpressRoute 线路。A single VNet can be linked to up to four ExpressRoute circuits. 通过本文中的步骤为正在连接的每条 ExpressRoute 线路创建新链接。Use the steps in this article to create a new link to each ExpressRoute circuit you are connecting to. ExpressRoute 线路可在同一订阅、不同订阅或两者兼有。The ExpressRoute circuits can be in the same subscription, different subscriptions, or a mix of both. 本文适用于使用经典部署模型创建的虚拟网络。This article applies to virtual networks created using the classic deployment model.

最多可以将 10 个虚拟网络链接到 ExpressRoute 线路。You can link up to 10 virtual networks to an ExpressRoute circuit. 所有虚拟网络都必须位于同一地缘政治区域。All virtual networks must be in the same geopolitical region. 如果启用 ExpressRoute 高级外接程序,则可以将更多虚拟网络链接到 ExpressRoute 线路,或者链接其他地缘政治区域中的虚拟网络。You can link a larger number of virtual networks to your ExpressRoute circuit, or link virtual networks that are in other geopolitical regions if you enable the ExpressRoute premium add-on. 有关高级外接程序的更多详细信息,请参阅常见问题解答Check the FAQ for more details about the premium add-on.

Important

从 2017 年 3 月 1 日开始,将无法在经典部署模型中创建新的 ExpressRoute 线路。As of March 1, 2017, you can't create new ExpressRoute circuits in the classic deployment model.

  • 可以将现有的 ExpressRoute 线路从经典部署模型移到 Resource Manager 部署模型,不会遇到连接中断问题。You can move an existing ExpressRoute circuit from the classic deployment model to the Resource Manager deployment model without experiencing any connectivity down time. 有关详细信息,请参阅移动现有线路For more information, see Move an existing circuit.
  • allowClassicOperations 设置为 TRUE 即可在经典部署模型中连接到虚拟网络。You can connect to virtual networks in the classic deployment model by setting allowClassicOperations to TRUE.

请使用以下链接在 Resource Manager 部署模型中创建和管理 ExpressRoute 线路:Use the following links to create and manage ExpressRoute circuits in the Resource Manager deployment model:

关于 Azure 部署模型About Azure deployment models

Azure 当前使用两种部署模型:Resource Manager 部署模型和经典部署模型。Azure currently works with two deployment models: Resource Manager and classic. 这两个模型相互不完全兼容。The two models are not completely compatible with each other. 在开始之前,需要知道所要使用的模型。Before you begin, you need to know which model that you want to work in. 有关部署模型的信息,请参阅了解部署模型For information about the deployment models, see Understanding deployment models. 如果不熟悉 Azure,建议使用 Resource Manager 部署模型。If you are new to Azure, we recommend that you use the Resource Manager deployment model.

配置先决条件Configuration prerequisites

  • 在开始配置之前,请查看先决条件路由要求工作流Review the prerequisites, routing requirements, and workflows before you begin configuration.
  • 必须有一个活动的 ExpressRoute 线路。You must have an active ExpressRoute circuit.
    • 请按说明创建 ExpressRoute 线路,并让连接提供商启用该线路。Follow the instructions to create an ExpressRoute circuit and have your connectivity provider enable the circuit.
    • 确保为线路配置 Azure 专用对等互连。Ensure that you have Azure private peering configured for your circuit. 有关路由说明,请参阅配置路由一文。See the Configure routing article for routing instructions.
    • 确保配置 Azure 专用对等互连,并运行用户网络和 Microsoft 之间的 BGP 对等互连,以便启用端到端连接。Ensure that Azure private peering is configured and the BGP peering between your network and Microsoft is up so that you can enable end-to-end connectivity.
    • 必须已创建并完全预配虚拟网络和虚拟网络网关。You must have a virtual network and a virtual network gateway created and fully provisioned. 请按说明为 ExpressRoute 配置虚拟网络Follow the instructions to configure a virtual network for ExpressRoute.

下载最新的 PowerShell cmdletDownload the latest PowerShell cmdlets

安装最新版本的 Azure 服务管理 (SM) PowerShell 模块和 ExpressRoute 模块。Install the latest versions of the Azure Service Management (SM) PowerShell modules and the ExpressRoute module.

  1. 按照安装服务管理模块一文中的说明安装 Azure 服务管理模块。Use the instructions in the Installing the Service Management module article to install the Azure Service Management Module. 如果已安装 Az 或 RM 模块,请确保使用“-AllowClobber”。If you have the Az or RM module already installed, be sure to use '-AllowClobber'.

  2. 导入已安装的模块。Import the installed modules. 使用以下示例时,请调整路径以反映已安装的 PowerShell 模块的位置和版本。When using the following example, adjust the path to reflect the location and version of your installed PowerShell modules.

    Import-Module 'C:\Program Files\WindowsPowerShell\Modules\Azure\5.3.0\Azure.psd1'
    Import-Module 'C:\Program Files\WindowsPowerShell\Modules\Azure\5.3.0\ExpressRoute\ExpressRoute.psd1'
    
  3. 若要登录到 Azure 帐户,请使用提升的权限打开 PowerShell 控制台,并连接到帐户。To sign in to your Azure account, open your PowerShell console with elevated rights and connect to your account. 使用以下示例帮助你通过服务管理模块进行连接:Use the following example to help you connect using the Service Management module:

    Add-AzureAccount
    

将同一订阅中的虚拟网络连接到线路Connect a virtual network in the same subscription to a circuit

可以使用以下 cmdlet 将虚拟网络链接到 ExpressRoute 线路。You can link a virtual network to an ExpressRoute circuit by using the following cmdlet. 在运行 cmdlet 之前,请确保已创建虚拟网络网关并可将其用于进行链接。Make sure that the virtual network gateway is created and is ready for linking before you run the cmdlet.

New-AzureDedicatedCircuitLink -ServiceKey "*****************************" -VNetName "MyVNet"
Provisioned

可使用以下 cmdlet 删除指向 ExpressRoute 线路的虚拟网络链接。You can remove a virtual network link to an ExpressRoute circuit by using the following cmdlet. 请确保为给定的虚拟网络选择当前订阅。Make sure that the current subscription is selected for the given virtual network.

Remove-AzureDedicatedCircuitLink -ServiceKey "*****************************" -VNetName "MyVNet"

将不同订阅中的虚拟网络连接到线路Connect a virtual network in a different subscription to a circuit

用户可以在多个订阅之间共享 ExpressRoute 线路。You can share an ExpressRoute circuit across multiple subscriptions. 下图是在多个订阅之间共享 ExpressRoute 线路的简单示意图。The following figure shows a simple schematic of how sharing works for ExpressRoute circuits across multiple subscriptions.

大型云中的每个较小云用于表示属于组织中不同部门的订阅。Each of the smaller clouds within the large cloud is used to represent subscriptions that belong to different departments within an organization. 组织内的每个部门可以使用自己的订阅部署其服务,但这些部门可以共享单个 ExpressRoute 线路以连接回本地网络。Each of the departments within the organization can use their own subscription for deploying their services--but the departments can share a single ExpressRoute circuit to connect back to your on-premises network. 一个部门(此示例中为:IT 部门)可以拥有 ExpressRoute 线路。A single department (in this example: IT) can own the ExpressRoute circuit. 组织内的其他订阅可以使用 ExpressRoute 线路。Other subscriptions within the organization can use the ExpressRoute circuit.

Note

将对 ExpressRoute 线路所有者收取专用线路的连接和带宽费用。Connectivity and bandwidth charges for the dedicated circuit will be applied to the ExpressRoute circuit owner. 所有虚拟网络共享相同的带宽。All virtual networks share the same bandwidth.

跨订阅连接

管理Administration

线路所有者 是在其中创建 ExpressRoute 线路的订阅的管理员/共同管理员。The circuit owner is the administrator/coadministrator of the subscription in which the ExpressRoute circuit is created. 线路所有者可以授权其他订阅的管理员/共同管理员(称为 线路用户)使用他们拥有的专用线路。The circuit owner can authorize administrators/coadministrators of other subscriptions, referred to as circuit users, to use the dedicated circuit that they own. 有权使用组织的 ExpressRoute 线路的线路用户,在获得授权后可以将其订阅中的虚拟网络链接到 ExpressRoute 线路。Circuit users who are authorized to use the organization's ExpressRoute circuit can link the virtual network in their subscription to the ExpressRoute circuit after they are authorized.

线路所有者有权随时修改和撤消授权。The circuit owner has the power to modify and revoke authorizations at any time. 撤消授权会导致从已撤消其访问权限的订阅中删除所有链接。Revoking an authorization will result in all links being deleted from the subscription whose access was revoked.

线路所有者操作Circuit owner operations

创建授权Creating an authorization

线路所有者可授权其他订阅的管理员使用指定的线路。The circuit owner authorizes the administrators of other subscriptions to use the specified circuit. 在下面的示例中,线路 (Contoso IT) 管理员允许另一个订阅(开发-测试)的管理员最多将两个虚拟网络链接到线路。In the following example, the administrator of the circuit (Contoso IT) enables the administrator of another subscription (Dev-Test) to link up to two virtual networks to the circuit. Contoso IT 管理员可以通过指定开发-测试 Microsoft ID 启用此功能。The Contoso IT administrator enables this by specifying the Dev-Test Microsoft ID. 该 cmdlet 不会将电子邮件发送到指定的 Microsoft ID。The cmdlet doesn't send email to the specified Microsoft ID. 线路所有者需要显式通知其他订阅所有者:授权已完成。The circuit owner needs to explicitly notify the other subscription owner that the authorization is complete.

New-AzureDedicatedCircuitLinkAuthorization -ServiceKey "**************************" -Description "Dev-Test Links" -Limit 2 -MicrosoftIds 'devtest@contoso.com'

返回:Return:

Description         : Dev-Test Links
Limit               : 2
LinkAuthorizationId : **********************************
MicrosoftIds        : devtest@contoso.com
Used                : 0

查看授权Reviewing authorizations

线路所有者可以通过运行以下 cmdlet 查看针对特定线路发出的所有授权:The circuit owner can review all authorizations that are issued on a particular circuit by running the following cmdlet:

Get-AzureDedicatedCircuitLinkAuthorization -ServiceKey: "**************************"

返回:Return:

Description         : EngineeringTeam
Limit               : 3
LinkAuthorizationId : ####################################
MicrosoftIds        : engadmin@contoso.com
Used                : 1

Description         : MarketingTeam
Limit               : 1
LinkAuthorizationId : @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
MicrosoftIds        : marketingadmin@contoso.com
Used                : 0

Description         : Dev-Test Links
Limit               : 2
LinkAuthorizationId : &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
MicrosoftIds        : salesadmin@contoso.com
Used                : 2

更新授权Updating authorizations

线路所有者可以使用以下 cmdlet 修改授权:The circuit owner can modify authorizations by using the following cmdlet:

Set-AzureDedicatedCircuitLinkAuthorization -ServiceKey "**************************" -AuthorizationId "&&&&&&&&&&&&&&&&&&&&&&&&&&&&"-Limit 5

返回:Return:

Description         : Dev-Test Links
Limit               : 5
LinkAuthorizationId : &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
MicrosoftIds        : devtest@contoso.com
Used                : 0

删除授权Deleting authorizations

线路所有者可以通过运行以下 cmdlet 撤消/删除对用户的授权:The circuit owner can revoke/delete authorizations to the user by running the following cmdlet:

Remove-AzureDedicatedCircuitLinkAuthorization -ServiceKey "*****************************" -AuthorizationId "###############################"

线路用户操作Circuit user operations

查看授权Reviewing authorizations

线路用户可以使用以下 cmdlet 查看授权:The circuit user can review authorizations by using the following cmdlet:

Get-AzureAuthorizedDedicatedCircuit

返回:Return:

Bandwidth                        : 200
CircuitName                      : ContosoIT
Location                         : Beijing
MaximumAllowedLinks              : 2
ServiceKey                       : &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
ServiceProviderName              : Beijing Telecom Ethernet
ServiceProviderProvisioningState : Provisioned
Status                           : Enabled
UsedLinks                        : 0

兑现链接授权Redeeming link authorizations

线路用户可以通过运行以下 cmdlet 兑现链接授权:The circuit user can run the following cmdlet to redeem a link authorization:

New-AzureDedicatedCircuitLink –servicekey "&&&&&&&&&&&&&&&&&&&&&&&&&&" –VnetName 'SalesVNET1'

返回:Return:

State VnetName
----- --------
Provisioned SalesVNET1

在虚拟网络新链接的订阅中运行此命令:Run this command in the newly linked subscription for the virtual network:

New-AzureDedicatedCircuitLink -ServiceKey "*****************************" -VNetName "MyVNet"

后续步骤Next steps

有关 ExpressRoute 的详细信息,请参阅 ExpressRoute 常见问题For more information about ExpressRoute, see the ExpressRoute FAQ.