教程:使用 Azure 门户诊断网络之间的通信问题Tutorial: Diagnose a communication problem between networks using the Azure portal

虚拟网关将 Azure 虚拟网络连接到本地虚拟网络或其他虚拟网络。A virtual network gateway connects an Azure virtual network to an on-premises, or other virtual network. 本教程介绍如何执行下列操作:In this tutorial, you learn how to:

  • 使用网络观察程序的 VPN 诊断功能诊断虚拟网关的问题Diagnose a problem with a virtual network gateway with Network Watcher's VPN diagnostics capability
  • 诊断网关连接问题Diagnose a problem with a gateway connection
  • 解决网关问题Resolve a problem with a gateway

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

先决条件Prerequisites

若要使用 VPN 诊断,必须有一个现成的正在运行的 VPN 网关。To use VPN diagnostics, you must have an existing, running VPN gateway.

  • 本地安装的 PowerShell:脚本要求使用 AzureRM PowerShell 模块 5.7.0 或更高版本。A local PowerShell installation: The script requires the AzureRM PowerShell module version 5.7.0 or later. 运行 Get-Module -ListAvailable AzureRM 查找已安装的版本。Run Get-Module -ListAvailable AzureRM to find the installed version. 如果需要升级,请参阅安装 Azure PowerShellIf you need to upgrade, see Install Azure PowerShell. 如果在本地运行 PowerShell,则还需运行 Login-AzureRmAccount -EnvironmentName AzureChinaCloud 来创建与 Azure 的连接。If you are running PowerShell locally, you also need to run Login-AzureRmAccount -EnvironmentName AzureChinaCloud to create a connection with Azure.
  • Azure Cloud ShellAzure Cloud Shell 安装并配置了最新版的 PowerShell,并允许登录到 Azure。The Azure Cloud Shell: The Azure Cloud Shell has the latest version of PowerShell installed and configured, and logs you into Azure.

脚本需要大约一小时来创建 VPN 网关。The script takes approximately an hour to create a VPN gateway. 剩余步骤假定要诊断的网关是通过此脚本部署的。The remaining steps assume that the gateway you're diagnosing is the one deployed by this script. 如果改为诊断你自己的现有网关,结果会有所不同。If you diagnose your own existing gateway instead, your results will vary.

登录 AzureSign in to Azure

登录到 Azure 门户Sign in to the Azure portal.

启用网络观察程序Enable Network Watcher

如果已在“中国东部”区域启用网络观察程序,请跳到诊断网关If you already have a network watcher enabled in the China East region, skip to Diagnose a gateway.

  1. 在门户中,选择“所有服务”。In the portal, select All services. 在“筛选器”框中,输入“网络观察程序”。In the Filter box, enter Network Watcher. 结果中出现“网络观察程序”后,将其选中。When Network Watcher appears in the results, select it.

  2. 选择“区域”,以便将其展开,然后选择“中国东部”右侧的“...”,如下图所示:Select Regions, to expand it, and then select ... to the right of China East, as shown in the following picture:

    启用网络观察程序

  3. 选择“启用网络观察程序”。Select Enable Network Watcher.

诊断网关Diagnose a gateway

  1. 在门户左侧选择“所有服务”。On the left side of the portal, select All services.

  2. 首先在“筛选”框中键入“网络观察程序”。Start typing network watcher in the Filter box. 搜索结果中出现“网络观察程序”后,将其选中。When Network Watcher appears in the search results, select it.

  3. 在“网络诊断工具”下选择“VPN 诊断”。Under NETWORK DIAGNOSTIC TOOLS, select VPN Diagnostics.

  4. 选择“存储帐户”,然后选择要向其写入诊断信息的存储帐户。Select Storage account, and then select the storage account you want to write diagnostic information to.

  5. 在“存储帐户”列表中,选择要使用的存储帐户。From the list of Storage accounts, select the storage account you want to use. 如果没有现成的存储帐户,则请选择“+ 存储帐户”,输入或选择所需信息,然后选择“创建”,以便创建一个。If you don't have an existing storage account, select + Storage account, enter, or select the required information, and then select Create, to create one. 如果已使用先决条件中的脚本创建了一个 VPN 网关,则可能需要在该网关所在的资源组 TestRG1 中创建存储帐户。If you created a VPN gateway using the script in prerequisites, you may want to create the storage account in the same resource group, TestRG1, as the gateway.

  6. 从“容器”列表中选择要使用的容器,然后选择“选择”。From the list of Containers, select the container you want to use, and then select Select. 如果没有任何容器,请选择“+ 容器”,输入容器的名称,然后选择“确定”。If you don't have any containers, select + Container, enter a name for the container, then select OK.

  7. 选择一个网关,然后选择“开始故障排除”。Select a gateway, and then select Start troubleshooting. 如下图所示,测试是针对名为 Vnet1GW 的网关运行的:As shown in the following picture, the test is run against a gateway named Vnet1GW:

    VPN 诊断

  8. 当测试正在运行时,“故障排除状态”列中会显示“正在运行”,而在上图中,该列显示“未启动”。While the test is running, Running appears in the TROUBLESHOOTING STATUS column where Not started is shown, in the previous picture. 测试可能需要数分钟的运行时间。The test may take several minutes to run.

  9. 查看已完成测试的状态。View the status of a completed test. 下图显示已完成的诊断测试的状态结果:The following picture shows the status results of a completed diagnostic test:

    状态

    可以看到“故障排除状态”为“不正常”,还可以在“状态”选项卡上看到问题的“摘要”和“详细信息”。You can see that the TROUBLESHOOTING STATUS is Unhealthy, as well as a Summary and Detail of the problem on the Status tab.

  10. 选择“操作”选项卡时,VPN 诊断会提供其他信息。When you select the Action tab, VPN diagnostics provides additional information. 在下图所示的示例中,VPN 诊断指示应检查每个连接的运行状况:In the example, shown in the following picture, VPN diagnostics lets you know that you should check the health of each connection:

    操作

诊断网关连接Diagnose a gateway connection

网关通过网关连接连接到其他网络。A gateway is connected to other networks via a gateway connection. 网关和网关连接必须都正常才能在虚拟网络和连接的网络之间成功通信。Both the gateway and gateway connections must be healthy for successful communication between a virtual network and a connected network.

  1. 再次完成诊断网关的步骤 7,这次选择一个连接。Complete step 7 of Diagnose a gateway again, this time, selecting a connection. 在以下示例中,对名为 VNet1toSite1 的连接进行了测试:In the following example, a connection named VNet1toSite1 is tested:

    连接

    测试运行时间为数分钟。The test runs for several minutes.

  2. 完成对连接的测试以后,收到的结果类似于下图中显示在“状态”和“操作”选项卡上的结果:After the test of the connection is complete, you receive results similar to the results shown in the following pictures on the Status and Action tabs:

    连接状态

    连接操作

    VPN 诊断会在“状态”选项卡上指示具体错误,并会在“操作”选项卡上根据问题原因提供多项建议。VPN diagnostics informs you what is wrong on the Status tab, and gives you several suggestions for what may be causing the problem on the Action tab.

    如果测试的网关是通过先决条件中的脚本部署的,则“状态”选项卡上的问题和“操作”选项卡上的头两个项就是要找的问题。If the gateway you tested was the one deployed by the script in Prerequisites, then the problem on the Status tab, and the first two items on the Actions tab are exactly what the problem is. 脚本为本地 VPN 网关设备配置了占位符形式的 IP 地址 23.99.221.164。The script configures a placeholder IP address, 23.99.221.164, for the on-premises VPN gateway device.

    若要解决此问题,需确保本地 VPN 网关已正确配置,并将脚本为本地网关配置的 IP 地址更改为本地 VPN 网关的实际公共地址。To resolve the issue, you need to ensure that your on-premises VPN gateway is configured properly, and change the IP address configured by the script for the local network gateway, to the actual public address of your on-premises VPN gateway.

清理资源Clean up resources

如果你使用先决条件中的脚本创建 VPN 网关只是为了完成本教程,完成后就不再需要它,请删除资源组及其包含的所有资源:If you created a VPN gateway using the script in the prerequisites solely to complete this tutorial, and no longer need it, delete the resource group and all of the resources it contains:

  1. 在门户顶部的“搜索”框中输入“TestRG1”。Enter TestRG1 in the Search box at the top of the portal. 在搜索结果中看到 TestRG1 后,请将其选中。When you see TestRG1 in the search results, select it.
  2. 选择“删除资源组”。Select Delete resource group.
  3. 在“键入资源组名称:”字段中输入“TestRG1”,然后选择“删除”。Enter TestRG1 for TYPE THE RESOURCE GROUP NAME: and select Delete.

后续步骤Next steps

本教程介绍了如何诊断虚拟网关的问题。In this tutorial, you learned how to diagnose a problem with a virtual network gateway. 可能需要记录出入 VM 的网络通信,以便通过查看日志来了解异常情况。You may want to log network communication to and from a VM so that you can review the log for anomalies. 若要了解具体操作方法,请转到下一教程。To learn how, advance to the next tutorial.