教程:使用 Azure 门户在混合网络中部署和配置 Azure 防火墙Tutorial: Deploy and configure Azure Firewall in a hybrid network using the Azure portal

将本地网络连接到 Azure 虚拟网络以创建混合网络时,必须能够控制对 Azure 网络资源的访问,这是整体安全计划的重要部分。When you connect your on-premises network to an Azure virtual network to create a hybrid network, the ability to control access to your Azure network resources is an important part of an overall security plan.

可以使用 Azure 防火墙通过规则来定义允许的和拒绝的网络流量,以便控制混合网络中的网络访问。You can use Azure Firewall to control network access in a hybrid network using rules that define allowed and denied network traffic.

在本教程中,请创建三个虚拟网络:For this tutorial, you create three virtual networks:

  • VNet-Hub - 防火墙在此虚拟网络中。VNet-Hub - the firewall is in this virtual network.
  • VNet-Spoke - 分支虚拟网络代表 Azure 中的工作负荷。VNet-Spoke - the spoke virtual network represents the workload located on Azure.
  • VNet-Onprem - 本地虚拟网络代表本地网络。VNet-Onprem - The on-premises virtual network represents an on-premises network. 在实际部署中,可以使用 VPN 或 ExpressRoute 来连接它。In an actual deployment, it can be connected by either a VPN or ExpressRoute connection. 为简单起见,本教程将使用 VPN 网关连接,并使用 Azure 中的某个虚拟网络来代表本地网络。For simplicity, this tutorial uses a VPN gateway connection, and an Azure-located virtual network is used to represent an on-premises network.

混合网络中的防火墙

在本教程中,你将了解如何执行以下操作:In this tutorial, you learn how to:

  • 声明变量Declare the variables
  • 创建防火墙中心虚拟网络Create the firewall hub virtual network
  • 创建分支虚拟网络Create the spoke virtual network
  • 创建本地虚拟网络Create the on-premises virtual network
  • 配置和部署防火墙Configure and deploy the firewall
  • 创建并连接 VPN 网关Create and connect the VPN gateways
  • 将中心和分支虚拟网络对等互连Peer the hub and spoke virtual networks
  • 创建路由Create the routes
  • 创建虚拟机Create the virtual machines
  • 测试防火墙Test the firewall

如果要使用 Azure PowerShell 完成此过程,请参阅使用 Azure PowerShell 在混合网络中部署和配置 Azure 防火墙If you want to use Azure PowerShell instead to complete this procedure, see Deploy and configure Azure Firewall in a hybrid network using Azure PowerShell.

先决条件Prerequisites

混合网络使用中心辐射型网络体系结构模型在 Azure VNet 与本地网络之间路由流量。A hybrid network uses the hub-and-spoke architecture model to route traffic between Azure VNets and on-premise networks. 中心辐射型网络体系结构具有以下要求:The hub-and-spoke architecture has the following requirements:

  • 将 VNet-Hub 对等互连到 VNet-Spoke 时设置 AllowGatewayTransitSet AllowGatewayTransit when peering VNet-Hub to VNet-Spoke. 在中心辐射型网络体系结构中,辐射虚拟网络可以通过网关传输共享中心的 VPN 网关,不必在每个辐射虚拟网络中部署 VPN 网关。In a hub-and-spoke network architecture, a gateway transit allows the spoke virtual networks to share the VPN gateway in the hub, instead of deploying VPN gateways in every spoke virtual network.

    此外,通往网关连接的虚拟网络或本地网络的路由会通过网关传输自动传播到对等互连的虚拟网络的路由表。Additionally, routes to the gateway-connected virtual networks or on-premises networks will automatically propagate to the routing tables for the peered virtual networks using the gateway transit. 有关详细信息,请参阅针对虚拟网络对等互连配置 VPN 网关传输For more information, see Configure VPN gateway transit for virtual network peering.

  • 将 VNet-Spoke 对等互连到 VNet-Hub 时设置 UseRemoteGatewaysSet UseRemoteGateways when you peer VNet-Spoke to VNet-Hub. 如果设置了 UseRemoteGateways 并且还在远程对等互连上设置了 AllowGatewayTransit,则辐射虚拟网络使用远程虚拟网络的网关进行传输。If UseRemoteGateways is set and AllowGatewayTransit on remote peering is also set, the spoke virtual network uses gateways of the remote virtual network for transit.

  • 若要通过中心防火墙路由分支子网流量,则可使用一个用户定义的路由 (UDR) 指向禁用了“虚拟网关路由传播”选项的防火墙。To route the spoke subnet traffic through the hub firewall, you can use a User Defined route (UDR) that points to the firewall with the Virtual network gateway route propagation option disabled. 禁用了“虚拟网关路由传播”选项可防止将路由分配到分支子网。The Virtual network gateway route propagation disabled option prevents route distribution to the spoke subnets. 这可以防止获知的路由与你的 UDR 冲突。This prevents learned routes from conflicting with your UDR. 如果要保持“虚拟网关路由传播”处于启用状态,请确保定义到防火墙的特定路由,以替代通过 BGP 从本地发布的路由。If you want to keep Virtual network gateway route propagation enabled, make sure to define specific routes to the firewall to override those that are published from on-premises over BGP.

  • 请在中心网关子网上配置一个指向防火墙 IP 地址的 UDR,将其作为通向辐射网络的下一跃点。Configure a UDR on the hub gateway subnet that points to the firewall IP address as the next hop to the spoke networks. 无需在 Azure 防火墙子网中创建 UDR,因为它会从 BGP 探测路由。No UDR is required on the Azure Firewall subnet, as it learns routes from BGP.

请参阅本教程的创建路由部分了解如何创建这些路由。See the Create Routes section in this tutorial to see how these routes are created.

备注

Azure 防火墙必须具有直接的 Internet 连接。Azure Firewall must have direct Internet connectivity. 如果 AzureFirewallSubnet 知道通过 BGP 的本地网络的默认路由,则必须将其替代为 0.0.0.0/0 UDR,将 NextHopType 值设置为 Internet 以保持 Internet 直接连接 。If your AzureFirewallSubnet learns a default route to your on-premises network via BGP, you must override this with a 0.0.0.0/0 UDR with the NextHopType value set as Internet to maintain direct Internet connectivity.

可将 Azure 防火墙配置为支持强制隧道。Azure Firewall can be configured to support forced tunneling. 有关详细信息,请参阅 Azure 防火墙强制隧道For more information, see Azure Firewall forced tunneling.

备注

即使 UDR 指向作为默认网关的 Azure 防火墙,也会直接路由直接对等互连 VNet 之间的流量。Traffic between directly peered VNets is routed directly even if a UDR points to Azure Firewall as the default gateway. 若要在此方案中将子网到子网流量发送到防火墙,UDR 必须在这两个子网上显式地包含目标子网网络前缀。To send subnet to subnet traffic to the firewall in this scenario, a UDR must contain the target subnet network prefix explicitly on both subnets.

如果没有 Azure 订阅,请在开始前创建一个试用订阅If you don't have an Azure subscription, create a Trial Subscription before you begin.

创建防火墙中心虚拟网络Create the firewall hub virtual network

首先,创建用于存储本教程资源的资源组:First, create the resource group to contain the resources for this tutorial:

  1. https://portal.azure.cn 中登录 Azure 门户。Sign in to the Azure portal at https://portal.azure.cn.

  2. 在 Azure 门户主页上,选择“资源组” > “添加” 。On the Azure portal home page, select Resource groups > Add.

  3. 对于“订阅”,请选择自己的订阅。 For Subscription, select your subscription.

  4. 对于“资源组名称”,请键入 FW-Hybrid-TestFor Resource group name, type FW-Hybrid-Test.

  5. 对于“区域”,请选择“中国东部”。 For Region, select China East. 以后创建的所有资源必须位于同一位置。All resources that you create later must be in the same location.

  6. 选择“查看 + 创建”。Select Review + Create.

  7. 选择“创建”。Select Create.

现在创建 VNet:Now, create the VNet:

备注

AzureFirewallSubnet 子网的大小为 /26。The size of the AzureFirewallSubnet subnet is /26. 有关子网大小的详细信息,请参阅 Azure 防火墙常见问题解答For more information about the subnet size, see Azure Firewall FAQ.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在“网络”下,选择“虚拟网络”。 Under Networking, select Virtual network.
  3. 对于“资源组”,请选择“FW-Hybrid-Test”。 For Resource group, select FW-Hybrid-Test.
  4. 对于“名称”,请键入 VNet-hubFor Name, type VNet-hub.
  5. 在完成时选择“下一步:IP 地址”。Select Next: IP Addresses.
  6. 对于“IPv4 地址空间”,请删除默认地址然后键入“10.5.0.0/16” 。For IPv4 Address space, delete the default address and type 10.5.0.0/16.
  7. 在“子网名称”下,选择“添加子网” 。Under Subnet name, select Add subnet.
  8. 对于“子网名称”,键入“AzureFirewallSubnet”。 For Subnet name type AzureFirewallSubnet. 防火墙将位于此子网中,子网名称 必须 是 AzureFirewallSubnet。The firewall will be in this subnet, and the subnet name must be AzureFirewallSubnet.
  9. 对于“子网地址范围”,请键入“10.5.0.0/26” 。For Subnet address range, type 10.5.0.0/26.
  10. 选择 添加Select Add.
  11. 选择“查看 + 创建” 。Select Review + create.
  12. 选择“创建”。Select Create.

创建分支虚拟网络Create the spoke virtual network

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在“网络”中,选择“虚拟网络” 。In Networking, select Virtual network.
  3. 对于“资源组”,请选择“FW-Hybrid-Test”。 For Resource group, select FW-Hybrid-Test.
  4. 对于“名称”,请键入 VNet-SpokeFor Name, type VNet-Spoke.
  5. 对于“区域”,请选择“中国东部”。 For Region, select China East.
  6. 在完成时选择“下一步:IP 地址”。Select Next: IP Addresses.
  7. 对于“IPv4 地址空间”,请删除默认地址然后键入“10.6.0.0/16” 。For IPv4 address space, delete the default address and type 10.6.0.0/16.
  8. 在“子网名称”下,选择“添加子网” 。Under Subnet name, select Add subnet.
  9. 对于“子网名称”,请键入“SN-Workload” 。For Subnet name type SN-Workload.
  10. 对于“子网地址范围”,请键入“10.6.0.0/24” 。For Subnet address range, type 10.6.0.0/24.
  11. 选择 添加Select Add.
  12. 选择“查看 + 创建” 。Select Review + create.
  13. 选择“创建”。Select Create.

创建本地虚拟网络Create the on-premises virtual network

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在“网络”中,选择“虚拟网络” 。In Networking, select Virtual network.
  3. 对于“资源组”,请选择“FW-Hybrid-Test”。 For Resource group, select FW-Hybrid-Test.
  4. 对于“名称”,请键入 VNet-OnPremFor Name, type VNet-OnPrem.
  5. 对于“区域”,请选择“中国东部”。 For Region, select China East.
  6. 选择“下一步: IP 地址”Select Next : IP Addresses
  7. 对于“IPv4 地址空间”,请删除默认地址然后键入“192.168.0.0/16” 。For IPv4 address space, delete the default address and type 192.168.0.0/16.
  8. 在“子网名称”下,选择“添加子网” 。Under Subnet name, select Add subnet.
  9. 对于“子网名称”,请键入“SN-Corp” 。For Subnet name type SN-Corp.
  10. 对于“子网地址范围”,请键入“192.168.1.0/24” 。For Subnet address range, type 192.168.1.0/24.
  11. 选择 添加Select Add.
  12. 选择“查看 + 创建” 。Select Review + create.
  13. 选择“创建”。Select Create.

现在,为网关创建第二个子网。Now create a second subnet for the gateway.

  1. 在“VNet-Onprem”页上,选择“子网”。 On the VNet-Onprem page, select Subnets.
  2. 选择“+子网”。Select +Subnet.
  3. 对于“名称”,请键入 GatewaySubnetFor Name, type GatewaySubnet.
  4. 对于“子网地址范围”,请键入“192.168.2.0/24” 。For Subnet address range type 192.168.2.0/24.
  5. 选择“确定”。Select OK.

配置和部署防火墙Configure and deploy the firewall

现在,将防火墙部署到防火墙中心虚拟网络中。Now deploy the firewall into the firewall hub virtual network.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.

  2. 在搜索文本框中,键入“防火墙”并按 Enter 键。In the search text box, type Firewall and press Enter key.

  3. 选择“防火墙”,然后选择“创建”。 Select Firewall, and select Create.

  4. 在“创建防火墙”页上,使用下表配置防火墙:On the Create a Firewall page, use the following table to configure the firewall:

    设置Setting “值”Value
    订阅Subscription <your subscription>
    资源组Resource group FW-Hybrid-TestFW-Hybrid-Test
    名称Name AzFW01AzFW01
    区域Region 中国东部China East
    选择虚拟网络Choose a virtual network 使用现有项Use existing:
    VNet-hubVNet-hub
    公共 IP 地址Public IP address 添加新项:Add new:
    fw-pip。fw-pip.
  5. 选择“查看 + 创建”。Select Review + create.

  6. 查看摘要,然后选择“创建”以创建防火墙。 Review the summary, and then select Create to create the firewall.

    部署过程需要花费几分钟时间。This takes a few minutes to deploy.

  7. 部署完成后,转到“FW-Hybrid-Test”资源组,然后选择“AzFW01”防火墙。 After deployment completes, go to the FW-Hybrid-Test resource group, and select the AzFW01 firewall.

  8. 记下专用 IP 地址。Note the private IP address. 稍后在创建默认路由时需要用到此地址。You'll use it later when you create the default route.

配置网络规则Configure network rules

首先,添加一个网络规则以允许 Web 流量。First, add a network rule to allow web traffic.

  1. 在“AzFW01”页上,选择“规则”。 On the AzFW01 page, Select Rules.
  2. 选择“网络规则集合”选项卡。Select the Network rule collection tab.
  3. 选择“添加网络规则集合”。Select Add network rule collection.
  4. 对于“名称”,请键入 RCNet01For Name, type RCNet01.
  5. 对于“优先级”,请键入 100For Priority, type 100.
  6. 对于“操作”,请选择“允许”。For Action, select Allow.
  7. 在“规则”下,为“名称”键入 AllowWebUnder Rules, for Name, type AllowWeb.
  8. 对于“协议”,请选择“TCP”。 For Protocol, select TCP.
  9. 对于 源类型,请选择“IP 地址”。For Source type, select IP address.
  10. 对于 ,请键入 192.168.1.0/24For Source, type 192.168.1.0/24.
  11. 对于“目标类型”,请选择“IP 地址” 。For Destination type, select IP address.
  12. 对于 目标地址,请键入 10.6.0.0/16For Destination address, type 10.6.0.0/16
  13. 对于“目标端口”,请键入 80For Destination Ports, type 80.

现在添加一个规则以允许 RDP 流量。Now add a rule to allow RDP traffic.

在第二个规则行中键入以下信息:On the second rule row, type the following information:

  1. 对于“名称”,请键入 AllowRDPName, type AllowRDP.
  2. 对于“协议”,请选择“TCP”。 For Protocol, select TCP.
  3. 对于 源类型,请选择“IP 地址”。For Source type, select IP address.
  4. 对于 ,请键入 192.168.1.0/24For Source, type 192.168.1.0/24.
  5. 对于“目标类型”,请选择“IP 地址” 。For Destination type, select IP address.
  6. 对于 目标地址,请键入 10.6.0.0/16For Destination address, type 10.6.0.0/16
  7. 对于“目标端口”,请键入 3389For Destination Ports, type 3389.
  8. 选择 添加Select Add.

创建并连接 VPN 网关Create and connect the VPN gateways

通过 VPN 网关连接中心和本地虚拟网络。The hub and on-premises virtual networks are connected via VPN gateways.

为中心虚拟网络创建 VPN 网关Create a VPN gateway for the hub virtual network

现在,为中心虚拟网络创建 VPN 网关。Now create the VPN gateway for the hub virtual network. 网络到网络配置需要 RouteBased VpnType。Network-to-network configurations require a RouteBased VpnType. 创建 VPN 网关通常需要 45 分钟或更长时间,具体取决于所选 VPN 网关的 SKU。Creating a VPN gateway can often take 45 minutes or more, depending on the selected VPN gateway SKU.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在搜索文本框中,键入“虚拟网络网关”。In the search text box, type virtual network gateway.
  3. 依次选择“虚拟网络网关”、“创建”。Select Virtual network gateway, and select Create.
  4. 对于“名称”,请键入 GW-hubFor Name, type GW-hub.
  5. 对于“区域”,请选择前面使用的同一区域。For Region, select the same region that you used previously.
  6. 对于“网关类型”,请选择“VPN”。 For Gateway type, select VPN.
  7. 对于“VPN 类型”,请选择“基于路由”。For VPN type, select Route-based.
  8. 对于“SKU”,请选择“基本”。For SKU, select Basic.
  9. 对于“虚拟网络”,请选择“VNet-hub”。For Virtual network, select VNet-hub.
  10. 对于“公共 IP 地址”,请选择“新建”,然后键入 VNet-hub-GW-pip 作为名称。For Public IP address, select Create new, and type VNet-hub-GW-pip for the name.
  11. 接受剩余的默认值,然后选择“查看 + 创建”。Accept the remaining defaults and then select Review + create.
  12. 检查配置,然后选择“创建”。Review the configuration, then select Create.

为本地虚拟网络创建 VPN 网关Create a VPN gateway for the on-premises virtual network

现在,为本地虚拟网络创建 VPN 网关。Now create the VPN gateway for the on-premises virtual network. 网络到网络配置需要 RouteBased VpnType。Network-to-network configurations require a RouteBased VpnType. 创建 VPN 网关通常需要 45 分钟或更长时间,具体取决于所选 VPN 网关的 SKU。Creating a VPN gateway can often take 45 minutes or more, depending on the selected VPN gateway SKU.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在搜索文本框中,键入“虚拟网络网关”并按 EnterIn the search text box, type virtual network gateway and press Enter.
  3. 依次选择“虚拟网络网关”、“创建”。Select Virtual network gateway, and select Create.
  4. 对于“名称”,请键入 GW-OnpremFor Name, type GW-Onprem.
  5. 对于“区域”,请选择前面使用的同一区域。For Region, select the same region that you used previously.
  6. 对于“网关类型”,请选择“VPN”。 For Gateway type, select VPN.
  7. 对于“VPN 类型”,请选择“基于路由”。For VPN type, select Route-based.
  8. 对于“SKU”,请选择“基本”。For SKU, select Basic.
  9. 对于“虚拟网络”,请选择“VNet-Onprem”。 For Virtual network, select VNet-Onprem.
  10. 对于“公共 IP 地址”,请选择“新建”,然后键入 VNet-Onprem-GW-pip 作为名称。 For Public IP address, select Create new, and type VNet-Onprem-GW-pip for the name.
  11. 接受剩余的默认值,然后选择“查看 + 创建”。Accept the remaining defaults and then select Review + create.
  12. 检查配置,然后选择“创建”。Review the configuration, then select Create.

创建 VPN 连接Create the VPN connections

现在,可在中心与本地网关之间创建 VPN 连接。Now you can create the VPN connections between the hub and on-premises gateways.

此步骤创建从中心虚拟网络到本地虚拟网络的连接。In this step, you create the connection from the hub virtual network to the on-premises virtual network. 示例中引用了共享密钥。You'll see a shared key referenced in the examples. 可以对共享密钥使用自己的值。You can use your own values for the shared key. 共享密钥必须与两个连接匹配,这一点非常重要。The important thing is that the shared key must match for both connections. 创建连接可能需要简短的一段时间才能完成。Creating a connection can take a short while to complete.

  1. 打开“FW-Hybrid-Test”资源组并选择“GW-hub”网关。Open the FW-Hybrid-Test resource group and select the GW-hub gateway.
  2. 在左栏中选择“连接”。Select Connections in the left column.
  3. 选择 添加Select Add.
  4. 键入 Hub-to-Onprem 作为连接名称。The the connection name, type Hub-to-Onprem.
  5. 选择“VNet 到 VNet”作为“连接类型”。Select VNet-to-VNet for Connection type.
  6. 对于“第二个虚拟网络网关”,请选择“GW-Onprem”。For the Second virtual network gateway, select GW-Onprem.
  7. 对于“共享密钥(PSK)”,请键入 AzureA1b2C3For Shared key (PSK), type AzureA1b2C3.
  8. 选择“确定” 。Select OK.

创建本地到中心虚拟网络连接。Create the on-premises to hub virtual network connection. 此步骤类似于前一步骤,但这次是创建从 VNet-Onprem 到 VNet-hub 的连接。This step is similar to the previous one, except you create the connection from VNet-Onprem to VNet-hub. 确保共享密钥匹配。Make sure the shared keys match. 几分钟后会建立连接。The connection will be established after a few minutes.

  1. 打开“FW-Hybrid-Test”资源组并选择“GW-Onprem”网关。Open the FW-Hybrid-Test resource group and select the GW-Onprem gateway.
  2. 在左栏中选择“连接”。Select Connections in the left column.
  3. 选择 添加Select Add.
  4. 对于“连接名称”,请键入“Onprem-to-Hub”。For the connection name, type Onprem-to-Hub.
  5. 选择“VNet 到 VNet”作为“连接类型”。Select VNet-to-VNet for Connection type.
  6. 对于“第二个虚拟网络网关”,请选择“GW-hub”。For the Second virtual network gateway, select GW-hub.
  7. 对于“共享密钥(PSK)”,请键入 AzureA1b2C3For Shared key (PSK), type AzureA1b2C3.
  8. 选择“确定” 。Select OK.

验证连接Verify the connection

大约五分钟后,这两个连接的状态应显示为“已连接”。After about five minutes or so, the status of both connections should be Connected.

网关连接

将中心和分支虚拟网络对等互连Peer the hub and spoke virtual networks

现在,将中心和分支虚拟网络对等互连。Now peer the hub and spoke virtual networks.

  1. 打开“FW-Hybrid-Test”资源组并选择“VNet-hub”虚拟网络。Open the FW-Hybrid-Test resource group and select the VNet-hub virtual network.

  2. 在左栏中选择“对等互连”。In the left column, select Peerings.

  3. 选择 添加Select Add.

  4. 在“此虚拟网络”下:Under This virtual network:

    设置名称Setting name Value
    对等互连链接名称Peering link name HubtoSpokeHubtoSpoke
    到远程虚拟网络的流量Traffic to remote virtual network 允许(默认)Allow (default)
    从远程虚拟网络转接的流量Traffic forwarded from remote virtual network 允许(默认)Allow (default)
    虚拟网络网关Virtual network gateway 使用此虚拟网络的网关Use this virtual network's gateway
  5. 在“远程虚拟网络”下:Under Remote virtual network:

    设置名称Setting name Value
    对等互连链接名称Peering link name SpoketoHubSpoketoHub
    虚拟网络部署模型Virtual network deployment model 资源管理器Resource manager
    订阅Subscription <your subscription>
    虚拟网络Virtual network VNet-SpokeVNet-Spoke
    到远程虚拟网络的流量Traffic to remote virtual network 允许(默认)Allow (default)
    从远程虚拟网络转接的流量Traffic forwarded from remote virtual network 允许(默认)Allow (default)
    虚拟网络网关Virtual network gateway 使用此远程虚拟网络的网关Use the remote virtual network's gateway
  6. 选择 添加Select Add.

    VNet 对等互连

创建路由Create the routes

接下来创建一对路由:Next, create a couple routes:

  • 通过防火墙 IP 地址从中心网关子网连接到分支子网的路由A route from the hub gateway subnet to the spoke subnet through the firewall IP address
  • 通过防火墙 IP 地址从分支子网连接的默认路由A default route from the spoke subnet through the firewall IP address
  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.

  2. 在搜索文本框中,键入“路由表”并按 EnterIn the search text box, type route table and press Enter.

  3. 选择“路由表”。Select Route table.

  4. 选择“创建”。Select Create.

  5. 选择“FW-Hybrid-Test”作为资源组。Select the FW-Hybrid-Test for the resource group.

  6. 对于“位置”,请选择前面使用的同一位置。 For Location, select the same location that you used previously.

  7. 对于“名称”,请键入 UDR-Hub-SpokeFor the name, type UDR-Hub-Spoke.

  8. 选择“查看 + 创建” 。Select Review + Create.

  9. 选择“创建”。Select Create.

  10. 创建路由表后,请选择它以打开路由表页。After the route table is created, select it to open the route table page.

  11. 在左栏中选择“路由”。Select Routes in the left column.

  12. 选择 添加Select Add.

  13. 键入 ToSpoke 作为路由名称。For the route name, type ToSpoke.

  14. 键入 10.6.0.0/16 作为地址前缀。For the address prefix, type 10.6.0.0/16.

  15. 选择“虚拟设备”作为下一跃点类型。For next hop type, select Virtual appliance.

  16. 键入前面记下的防火墙专用 IP 地址作为下一跃点地址。For next hop address, type the firewall's private IP address that you noted earlier.

  17. 选择“确定” 。Select OK.

现在,将路由关联到子网。Now associate the route to the subnet.

  1. 在“UDR-Hub-Spoke - 路由”页上,选择“子网”。On the UDR-Hub-Spoke - Routes page, select Subnets.
  2. 选择“关联”。Select Associate.
  3. 在“虚拟网络”下,选择“VNet-hub”。Under Virtual network, select VNet-hub.
  4. 在“子网”下,选择“GatewaySubnet”。Under Subnet, select GatewaySubnet.
  5. 选择“确定”。Select OK.

现在,创建从辐射子网的默认路由。Now create the default route from the spoke subnet.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.

  2. 在搜索文本框中,键入“路由表”并按 EnterIn the search text box, type route table and press Enter.

  3. 选择“路由表”。Select Route table.

  4. 选择“创建”。Select Create.

  5. 选择“FW-Hybrid-Test”作为资源组。Select the FW-Hybrid-Test for the resource group.

  6. 对于“位置”,请选择前面使用的同一位置。 For Location, select the same location that you used previously.

  7. 键入 UDR-DG 作为名称。For the name, type UDR-DG.

  8. 对于“传播网关路由”,请选择“禁用” 。For Propagate gateway routes, select Disabled.

  9. 选择“创建”。Select Create.

  10. 创建路由表后,请选择它以打开路由表页。After the route table is created, select it to open the route table page.

  11. 在左栏中选择“路由”。Select Routes in the left column.

  12. 选择 添加Select Add.

  13. 键入“ToHub”作为路由名称。For the route name, type ToHub.

  14. 键入 0.0.0.0/0 作为地址前缀。For the address prefix, type 0.0.0.0/0.

  15. 选择“虚拟设备”作为下一跃点类型。For next hop type, select Virtual appliance.

  16. 键入前面记下的防火墙专用 IP 地址作为下一跃点地址。For next hop address, type the firewall's private IP address that you noted earlier.

  17. 选择“确定” 。Select OK.

现在,将路由关联到子网。Now associate the route to the subnet.

  1. 在“UDR-DG - 路由”页上,选择“子网”。On the UDR-DG - Routes page, select Subnets.
  2. 选择“关联”。Select Associate.
  3. 在“虚拟网络”下,选择“VNet-spoke”。Under Virtual network, select VNet-spoke.
  4. 在“子网”下,选择“SN-Workload”。Under Subnet, select SN-Workload.
  5. 选择“确定”。Select OK.

创建虚拟机Create virtual machines

现在,创建分支工作负荷与本地虚拟机,并将其放入相应的子网。Now create the spoke workload and on-premises virtual machines, and place them in the appropriate subnets.

创建工作负荷虚拟机Create the workload virtual machine

在分支虚拟网络中,创建运行 IIS 且不使用公共 IP 地址的虚拟机。Create a virtual machine in the spoke virtual network, running IIS, with no public IP address.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在“常用”下,选择“Windows Server 2016 Datacenter”。 Under Popular, select Windows Server 2016 Datacenter.
  3. 输入虚拟机的以下值:Enter these values for the virtual machine:
    • 资源组 - 选择“FW-Hybrid-Test”。Resource group - Select FW-Hybrid-Test.
    • 虚拟机名称VM-Spoke-01Virtual machine name: VM-Spoke-01.
    • 区域 - 前面使用的同一区域。Region - Same region that you're used previously.
    • 用户名:<type a user name>。User name: <type a user name>.
    • 密码:<type a password>Password: <type a password>
  4. 对“公共入站端口”,请选择“允许所选端口”,然后选择“HTTP (80)”和“RDP (3389)”。For Public inbound ports, select Allow selected ports, and then select HTTP (80), and RDP (3389)
  5. 选择“下一步:磁盘” 。Select Next:Disks.
  6. 接受默认设置,然后选择“下一步:网络”。Accept the defaults and select Next: Networking.
  7. 选择“VNet-Spoke”作为虚拟网络;子网为“SN-Workload”。Select VNet-Spoke for the virtual network and the subnet is SN-Workload.
  8. 对于“公共 IP”,请选择“无”。For Public IP, select None.
  9. 选择“下一步: 管理”。Select Next:Management.
  10. 对于“启动诊断”,请选择“禁用” 。For Boot diagnostics, Select Disable.
  11. 选择“查看 + 创建”,检查摘要页上的设置,然后选择“创建”。Select Review+Create, review the settings on the summary page, and then select Create.

安装 IISInstall IIS

  1. 使用管理员打开 PowerShell 控制台,然后使用你的帐户登录。Open the PowerShell console with administrator, then login with your account.

  2. 运行以下命令以在虚拟机上安装 IIS 并根据需要更改位置:Run the following command to install IIS on the virtual machine and change the location if necessary:

    Set-AzVMExtension `
           -ResourceGroupName FW-Hybrid-Test `
           -ExtensionName IIS `
           -VMName VM-Spoke-01 `
           -Publisher Microsoft.Compute `
           -ExtensionType CustomScriptExtension `
           -TypeHandlerVersion 1.4 `
           -SettingString '{"commandToExecute":"powershell Add-WindowsFeature Web-Server; powershell      Add-Content -Path \"C:\\inetpub\\wwwroot\\Default.htm\" -Value $($env:computername)"}' `
           -Location ChinaEast
    

创建本地虚拟机Create the on-premises virtual machine

你将使用此虚拟机通过远程桌面连接到公共 IP 地址。This is a virtual machine that you use to connect using Remote Desktop to the public IP address. 然后,请在该虚拟机中通过防火墙连接到本地服务器。From there, you then connect to the on-premises server through the firewall.

  1. 在 Azure 门户主页上,选择“创建资源”。From the Azure portal home page, select Create a resource.
  2. 在“常用”下,选择“Windows Server 2016 Datacenter”。 Under Popular, select Windows Server 2016 Datacenter.
  3. 输入虚拟机的以下值:Enter these values for the virtual machine:
    • 资源组 - 选择现有资源组,然后选择“FW-Hybrid-Test”。Resource group - Select existing, and then select FW-Hybrid-Test.
    • 虚拟机名称 - VM-OnpremVirtual machine name - VM-Onprem.
    • 区域 - 前面使用的同一区域。Region - Same region that you're used previously.
    • 用户名:<type a user name>。User name: <type a user name>.
    • 密码:<type a user password>。Password: <type a user password>.
  4. 对“公共入站端口”,请选择“允许所选端口”,然后选择“RDP (3389)”。 For Public inbound ports, select Allow selected ports, and then select RDP (3389)
  5. 选择“下一步:磁盘” 。Select Next:Disks.
  6. 接受默认值,然后选择“下一步: 网络”。Accept the defaults and select Next:Networking.
  7. 选择“VNet-Onprem”作为虚拟网络;子网为“SN-Corp”。 Select VNet-Onprem for virtual network and the subnet is SN-Corp.
  8. 选择“下一步: 管理”。Select Next:Management.
  9. 对于“启动诊断”,请选择“禁用” 。For Boot diagnostics, Select Disable.
  10. 选择“查看 + 创建”,检查摘要页上的设置,然后选择“创建”。Select Review+Create, review the settings on the summary page, and then select Create.

测试防火墙Test the firewall

  1. 首先,记下“VM-spoke-01”虚拟机的专用 IP 地址。First, note the private IP address for VM-spoke-01 virtual machine.

  2. 在 Azure 门户中,连接到 VM-Onprem 虚拟机。From the Azure portal, connect to the VM-Onprem virtual machine.

  3. 在 VM-Onprem 上打开 Web 浏览器并浏览到 http://<VM-spoke-01 private IP>。Open a web browser on VM-Onprem, and browse to http://<VM-spoke-01 private IP>.

    应会看到“VM-spoke-01”网页: You should see the VM-spoke-01 web page:

    VM-Spoke-01 网页

  4. 在“VM-Onprem”虚拟机中,打开远程桌面并连接到 VM-spoke-01 的专用 IP 地址。From the VM-Onprem virtual machine, open a remote desktop to VM-spoke-01 at the private IP address.

    应可成功连接,并且可以登录。Your connection should succeed, and you should be able to sign in.

现已验证防火墙规则可正常工作:So now you've verified that the firewall rules are working:

  • 可以浏览分支虚拟网络中的 Web 服务器。You can browse web server on the spoke virtual network.
  • 可以使用 RDP 连接到分支虚拟网络中的服务器。You can connect to the server on the spoke virtual network using RDP.

接下来,将防火墙网络规则集合操作更改为“拒绝”,以验证防火墙规则是否按预期工作。 Next, change the firewall network rule collection action to Deny to verify that the firewall rules work as expected.

  1. 选择“AzFW01”防火墙。Select the AzFW01 firewall.
  2. 选择“规则”。Select Rules.
  3. 选择“网络规则集合”选项卡,然后选择“RCNet01”规则集合。 Select the Network rule collection tab and select the RCNet01 rule collection.
  4. 对于“操作”,请选择“拒绝”。 For Action, select Deny.
  5. 选择“保存”。Select Save.

在测试更改的规则之前,请关闭所有现有的远程桌面。Close any existing remote desktops before testing the changed rules. 现在再次运行测试。Now run the tests again. 这一次,这些规则应该全部失败。They should all fail this time.

清理资源Clean up resources

可以保留防火墙资源以便在下一篇教程中使用。不再需要时,请删除 FW-Hybrid-Test 资源组,以删除与防火墙相关的所有资源。You can keep your firewall resources for the next tutorial, or if no longer needed, delete the FW-Hybrid-Test resource group to delete all firewall-related resources.

后续步骤Next steps

接下来,可以监视 Azure 防火墙日志。Next, you can monitor the Azure Firewall logs.