配置用于 Microsoft 对等互连的路由筛选器:PowerShellConfigure route filters for Microsoft peering: PowerShell

路由筛选器是通过 Microsoft 对等互连使用部分受支持服务的一种方法。Route filters are a way to consume a subset of supported services through Microsoft peering. 本文中的步骤可帮助配置和管理 ExpressRoute 线路的路由筛选器。The steps in this article help you configure and manage route filters for ExpressRoute circuits.

可以通过 Microsoft 对等互连访问 Azure 公共服务(如存储和 SQL DB)。Azure public services, such as storage and SQL DB are accessible through Microsoft peering. Azure 公共服务可按区域选择,但不能针对每个公共服务定义。Azure public services are selectable on a per region basis and cannot be defined per public service.

如果在 ExpressRoute 线路中配置了 Microsoft 对等互连并附加了路由筛选器,则会通过建立的 BGP 会话播发为这些服务选择的所有前缀。When Microsoft peering is configured on an ExpressRoute circuit and a route filter is attached, all prefixes that are selected for these services are advertised through the BGP sessions that are established. 每个前缀附加有 BGP 团体值,以标识通过该前缀提供的服务。A BGP community value is attached to every prefix to identify the service that is offered through the prefix. 如需连接所有服务,则应通过 BGP 播发大量前缀。If you require connectivity to all services, a large number of prefixes are advertised through BGP. 这会显著增加网络中路由器所维护路由表的大小。This significantly increases the size of the route tables maintained by routers within your network. 如果打算仅使用通过 Microsoft 对等互连提供的一部分服务,可通过两种方式减少路由表大小。If you plan to consume only a subset of services offered through Microsoft peering, you can reduce the size of your route tables in two ways. 方法:You can:

  • 通过在 BGP 团体上应用路由筛选器,筛选出不需要的前缀。Filter out unwanted prefixes by applying route filters on BGP communities. 这是标准的网络做法,通常在多个网络中使用。This is a standard networking practice and is used commonly within many networks.

  • 定义路由筛选器,并将其应用于 ExpressRoute 线路。Define route filters and apply them to your ExpressRoute circuit. 路由筛选器是一种新资源,可让你选择计划通过 Microsoft 对等互连使用的服务列表。A route filter is a new resource that lets you select the list of services you plan to consume through Microsoft peering. ExpressRoute 路由器仅发送属于路由筛选器中所标识服务的前缀列表。ExpressRoute routers only send the list of prefixes that belong to the services identified in the route filter.

关于路由筛选器About route filters

在 ExpressRoute 线路上配置 Microsoft 对等互连后,Microsoft 网络边缘路由器将与边缘路由器(你的或连接提供商的)建立一对 BGP 会话。When Microsoft peering is configured on your ExpressRoute circuit, the Microsoft network edge routers establish a pair of BGP sessions with the edge routers (yours or your connectivity provider's). 不会将任何路由播发到网络。No routes are advertised to your network. 若要能够将路由播发到网络,必须关联路由筛选器。To enable route advertisements to your network, you must associate a route filter.

使用路由筛选器可标识要通过 ExpressRoute 线路的 Microsoft 对等互连使用的服务。A route filter lets you identify services you want to consume through your ExpressRoute circuit's Microsoft peering. 它实质上是所有 BGP 社区值的允许列表。It is essentially an allow list of all the BGP community values. 定义路由筛选器资源并将其附加到 ExpressRoute 线路后,映射到 BGP 团体值的所有前缀均会播发到网络。Once a route filter resource is defined and attached to an ExpressRoute circuit, all prefixes that map to the BGP community values are advertised to your network.

Important

在 2019 年 10 月 1 日之前配置的 ExpressRoute 线路的 Microsoft 对等互连会通过 Microsoft 对等互连播发所有服务前缀,即使未定义路由筛选器。Microsoft peering of ExpressRoute circuits that were configured prior to October 1, 2019 will have all service prefixes advertised through Microsoft peering, even if route filters are not defined. 在 2019 年 10 月 1 日或之后配置的 ExpressRoute 线路的 Microsoft 对等互连的任何前缀只有在路由筛选器附加到线路之后才会播发。Microsoft peering of ExpressRoute circuits that are configured on or after October 1, 2019 will not have any prefixes advertised until a route filter is attached to the circuit.

工作流Workflow

若要通过 Microsoft 对等互连成功连接服务,必须完成以下配置步骤:To be able to successfully connect to services through Microsoft peering, you must complete the following configuration steps:

  • 必须具备预配了 Microsoft 对等互连的活动 ExpressRoute 线路。You must have an active ExpressRoute circuit that has Microsoft peering provisioned. 可使用以下说明完成这些任务:You can use the following instructions to accomplish these tasks:

    • 继续下一步之前,请创建 ExpressRoute 线路,并让连接提供商启用该线路。Create an ExpressRoute circuit and have the circuit enabled by your connectivity provider before you proceed. ExpressRoute 线路必须处于已预配且已启用状态。The ExpressRoute circuit must be in a provisioned and enabled state.
    • 如果直接管理 BGP 会话,请创建 Microsoft 对等互连Create Microsoft peering if you manage the BGP session directly. 或者,让连接提供商为线路预配 Microsoft 对等互连。Or, have your connectivity provider provision Microsoft peering for your circuit.
  • 必须创建并配置路由筛选器。You must create and configure a route filter.

    • 标识要通过 Microsoft 对等互连使用的服务Identify the services you with to consume through Microsoft peering
    • 标识与服务关联的 BGP 团体值列表Identify the list of BGP community values associated with the services
    • 创建规则以允许前缀列表与 BGP 团体值相匹配Create a rule to allow the prefix list matching the BGP community values
  • 必须将路由筛选器附加到 ExpressRoute 线路。You must attach the route filter to the ExpressRoute circuit.

准备阶段Before you begin

开始配置之前,请确保满足以下条件:Before you begin configuration, make sure you meet the following criteria:

使用 Azure PowerShellWorking with Azure PowerShell

本文中的步骤和示例使用 Azure PowerShell Az 模块。The steps and examples in this article use Azure PowerShell Az modules. 若要在计算机上本地安装 Az 模块,请参阅安装 Azure PowerShellTo install the Az modules locally on your computer, see Install Azure PowerShell. 若要详细了解新 Az 模块,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module, see Introducing the new Azure PowerShell Az module. PowerShell cmdlet 经常更新。PowerShell cmdlets are updated frequently. 如果未运行最新版本,在说明中指定的值可能无法使用。If you are not running the latest version, the values specified in the instructions may fail. 若要在系统上查找已安装的 PowerShell 版本,请使用 Get-Module -ListAvailable Az cmdlet。To find the installed versions of PowerShell on your system, use the Get-Module -ListAvailable Az cmdlet.

登录到 Azure 帐户Log in to your Azure account

在开始此配置之前,必须登录到 Azure 帐户。Before beginning this configuration, you must log in to your Azure account. 该 cmdlet 会提示你提供自己的 Azure 帐户的登录凭据。The cmdlet prompts you for the login credentials for your Azure account. 登录后它会下载帐户设置,供 Azure PowerShell 使用。After logging in, it downloads your account settings so they are available to Azure PowerShell.

使用提升的权限打开 PowerShell 控制台,并连接到帐户。Open your PowerShell console with elevated privileges, and connect to your account. 使用下面的示例来帮助连接。Use the following example to help you connect.

Connect-AzAccount

如果有多个 Azure 订阅,请查看该帐户的订阅。If you have multiple Azure subscriptions, check the subscriptions for the account.

Get-AzSubscription

指定要使用的订阅。Specify the subscription that you want to use.

Select-AzSubscription -SubscriptionName "Replace_with_your_subscription_name"

步骤 1:获取前缀和 BGP 团体值的列表Step 1: Get a list of prefixes and BGP community values

1.获取 BGP 团体值列表1. Get a list of BGP community values

使用以下 cmdlet 获取与通过 Microsoft 对等互连可访问服务相关联的 BGP 团体值列表,以及与之关联的前缀列表:Use the following cmdlet to get the list of BGP community values associated with services accessible through Microsoft peering, and the list of prefixes associated with them:

Get-AzBgpServiceCommunity

2.列出要使用的值2. Make a list of the values that you want to use

列出要在路由筛选器中使用的 BGP 团体值列表。Make a list of BGP community values you want to use in the route filter.

步骤 2:创建路由筛选器和筛选器规则Step 2: Create a route filter and a filter rule

1 个路由筛选器只能有 1 个规则,并且规则类型必须是“允许”。A route filter can have only one rule, and the rule must be of type 'Allow'. 此规则可以有与之关联的 BGP 团体值列表。This rule can have a list of BGP community values associated with it.

1.创建路由筛选器1. Create a route filter

首先,创建路由筛选器。First, create the route filter. 命令“New-AzRouteFilter”只创建路由筛选器资源。The command 'New-AzRouteFilter' only creates a route filter resource. 创建资源后,必须创建规则并将其附加到路由筛选器对象。After you create the resource, you must then create a rule and attach it to the route filter object. 运行以下命令来创建路由筛选器资源:Run the following command to create a route filter resource:

New-AzRouteFilter -Name "MyRouteFilter" -ResourceGroupName "MyResourceGroup" -Location "China East"

2.创建筛选器规则2. Create a filter rule

可将一组 BGP 团体指定为逗号分隔列表,如示例所示。You can specify a set of BGP communities as a comma-separated list, as shown in the example. 运行以下命令来创建新规则:Run the following command to create a new rule:

$rule = New-AzRouteFilterRuleConfig -Name "Allow-EXO-D365" -Access Allow -RouteFilterRuleType Community -CommunityList 12076:5010,12076:5040

3.将规则添加到路由筛选器3. Add the rule to the route filter

运行以下命令将筛选器规则添加到路由筛选器:Run the following command to add the filter rule to the route filter:

$routefilter = Get-AzRouteFilter -Name "RouteFilterName" -ResourceGroupName "ExpressRouteResourceGroupName"
$routefilter.Rules.Add($rule)
Set-AzRouteFilter -RouteFilter $routefilter

步骤 3:将路由筛选器附加到 ExpressRoute 线路Step 3: Attach the route filter to an ExpressRoute circuit

运行以下命令将路由筛选器附加到 ExpressRoute 线路,假设你只有 Microsoft 对等互连:Run the following command to attach the route filter to the ExpressRoute circuit, assuming you have only Microsoft peering:

$ckt = Get-AzExpressRouteCircuit -Name "ExpressRouteARMCircuit" -ResourceGroupName "ExpressRouteResourceGroup"
$ckt.Peerings[0].RouteFilter = $routefilter 
Set-AzExpressRouteCircuit -ExpressRouteCircuit $ckt

常见任务Common tasks

获取路由筛选器的属性To get the properties of a route filter

若要获取路由筛选器的属性,请使用以下步骤:To get the properties of a route filter, use the following steps:

  1. 运行以下命令来获取路由筛选器资源:Run the following command to get the route filter resource:

    $routefilter = Get-AzRouteFilter -Name "RouteFilterName" -ResourceGroupName "ExpressRouteResourceGroupName"
    
  2. 通过运行以下命令获取路由筛选器资源的路由筛选器规则:Get the route filter rules for the route-filter resource by running the following command:

    $routefilter = Get-AzRouteFilter -Name "RouteFilterName" -ResourceGroupName "ExpressRouteResourceGroupName"
    $rule = $routefilter.Rules[0]
    

更新路由筛选器的属性To update the properties of a route filter

如果路由筛选器已附加到线路,则 BGP 社区列表的更新会通过建立的 BGP 会话自动传播相应的前缀播发更改。If the route filter is already attached to a circuit, updates to the BGP community list automatically propagate appropriate prefix advertisement changes through the established BGP sessions. 可使用以下命令更新路由筛选器的 BGP 团体列表:You can update the BGP community list of your route filter using the following command:

$routefilter = Get-AzRouteFilter -Name "RouteFilterName" -ResourceGroupName "ExpressRouteResourceGroupName"
$routefilter.rules[0].Communities = "12076:5030", "12076:5040"
Set-AzRouteFilter -RouteFilter $routefilter

从 ExpressRoute 线路分离路由筛选器To detach a route filter from an ExpressRoute circuit

从 ExpressRoute 线路分离路由筛选器后,BGP 会话不会播发任何前缀。Once a route filter is detached from the ExpressRoute circuit, no prefixes are advertised through the BGP session. 可使用以下命令从 ExpressRoute 线路分离路由筛选器:You can detach a route filter from an ExpressRoute circuit using the following command:

$ckt.Peerings[0].RouteFilter = $null
Set-AzExpressRouteCircuit -ExpressRouteCircuit $ckt

删除路由筛选器To delete a route filter

只有在路由筛选器未附加到任何线路时,才能将其删除。You can only delete a route filter if it is not attached to any circuit. 尝试删除路由筛选器之前,请确保其未附加到任何线路。Ensure that the route filter is not attached to any circuit before attempting to delete it. 可使用以下命令删除路由筛选器:You can delete a route filter using the following command:

Remove-AzRouteFilter -Name "MyRouteFilter" -ResourceGroupName "MyResourceGroup"

后续步骤Next Steps

有关 ExpressRoute 的详细信息,请参阅 ExpressRoute 常见问题For more information about ExpressRoute, see the ExpressRoute FAQ.