使用网络观察程序故障排除功能监视 VPN 网关Monitor VPN gateways with Network Watcher troubleshooting

若要向客户提供可靠的服务,获取网络性能的深入见解至关重要。Gaining deep insights on your network performance is critical to provide reliable services to customers. 因此,必须能够快速检测网络中断状态,并采取纠正措施来缓解中断状态。It is therefore critical to detect network outage conditions quickly and take corrective action to mitigate the outage condition. 在 Azure 自动化中,可以通过 Runbook 以编程方式实施和运行任务。Azure Automation enables you to implement and run a task in a programmatic fashion through runbooks. 使用 Azure 自动化可以创建完美的脚本来执行连续、主动的网络监视和警报。Using Azure Automation creates a perfect recipe for performing continuous and proactive network monitoring and alerting.

方案Scenario

下图中的方案是一个多层应用程序,其中使用 VPN 网关和隧道建立了本地连接。The scenario in the following image is a multi-tiered application, with on premises connectivity established using a VPN Gateway and tunnel. 确保 VPN 网关正常运行对于应用程序的性能至关重要。Ensuring the VPN Gateway is up and running is critical to the applications performance.

可以创建一个包含脚本的 Runbook 来检查 VPN 隧道的连接状态,使用资源故障排除 API 来检查连接隧道的状态。A runbook is created with a script to check for connection status of the VPN tunnel, using the Resource Troubleshooting API to check for connection tunnel status. 如果状态不正常,可向管理员发送电子邮件触发器。If the status is not healthy, an email trigger is sent to administrators.

方案示例

此方案将:This scenario will:

  • 创建一个可以调用 Start-AzureRmNetworkWatcherResourceTroubleshooting cmdlet 来排查连接状态的 RunbookCreate a runbook calling the Start-AzureRmNetworkWatcherResourceTroubleshooting cmdlet to troubleshoot connection status
  • 将计划链接到 RunbookLink a schedule to the runbook

准备阶段Before you begin

在开始学习本方案之前,必须满足以下先决条件:Before you start this scenario, you must have the following pre-requisites:

  • 在 Azure 中有一个 Azure 自动化帐户。An Azure automation account in Azure. 请确保自动化帐户具有最新模块,同时确保具有 AzureRM.Network 模块。Ensure that the automation account has the latest modules and also has the AzureRM.Network module. 如果需要将 AzureRM.Network 模块添加到自动化帐户,可以在模块库中找到此模块。The AzureRM.Network module is available in the module gallery if you need to add it to your automation account.
  • 必须在 Azure 自动化中配置一组凭据。You must have a set of credentials configure in Azure Automation. Azure 自动化安全性中了解详细信息。Learn more at Azure Automation security
  • 在 Azure 自动化中定义有效的 SMTP 服务器(Office 365、本地电子邮件或其他服务器)和凭据A valid SMTP server (Office 365, your on-premises email or another) and credentials defined in Azure Automation
  • 在 Azure 配置的虚拟网络网关。A configured Virtual Network Gateway in Azure.
  • 现有存储帐户,其中具有一个存储登录信息的现有容器。An existing storage account with an existing container to store the logs in.

Note

上图所示的基础结构用于演示目的,不是使用本文中的步骤创建的。The infrastructure depicted in the preceding image is for illustration purposes and are not created with the steps contained in this article.

创建 RunbookCreate the runbook

配置示例的第一个步骤是创建 Runbook。The first step to configuring the example is to create the runbook. 本示例使用运行方式帐户。This example uses a run-as account.

步骤 1Step 1

Azure 门户中导航到“Azure 自动化”,并单击“Runbook”Navigate to Azure Automation in the Azure portal and click Runbooks

自动化帐户概述

步骤 2Step 2

单击“添加 Runbook”启动 Runbook 创建过程。Click Add a runbook to start the creation process of the runbook.

Runbook 边栏选项卡

步骤 3Step 3

在“快速创建”下面,单击“创建新的 Runbook”创建 Runbook。Under Quick Create, click Create a new runbook to create the runbook.

添加 Runbook 边栏选项卡

步骤 4Step 4

在此步骤中,我们将为 Runbook 命名,在本示例中命名为 Get-VPNGatewayStatusIn this step, we give the runbook a name, in the example it is called Get-VPNGatewayStatus. 必须为 Runbook 指定一个描述性的名称,我们建议遵循正式的 PowerShell 命名标准来命名。It is important to give the runbook a descriptive name, and recommended giving it a name that follows standard PowerShell naming standards. 本示例中的 Runbook 类型为“PowerShell”,其他选项包括“图形”、“PowerShell 工作流”和“图形 PowerShell 工作流”。The runbook type for this example is PowerShell, the other options are Graphical, PowerShell workflow, and Graphical PowerShell workflow.

Runbook 边栏选项卡

步骤 5Step 5

在此步骤中创建 Runbook。以下代码示例提供了本示例所需的所有代码。In this step the runbook is created, the following code example provides all the code needed for the example. 需要将代码中包含 <value> 的项替换为订阅中的值。The items in the code that contain <value> need to be replaced with the values from your subscription.

使用以下代码,并单击“保存”Use the following code as click Save

# Set these variables to the proper values for your environment
$o365AutomationCredential = "<Office 365 account>"
$fromEmail = "<from email address>"
$toEmail = "<to email address>"
$smtpServer = "<smtp.office365.com>"
$smtpPort = 587
$runAsConnectionName = "<AzureRunAsConnection>"
$subscriptionId = "<subscription id>"
$region = "<Azure region>"
$vpnConnectionName = "<vpn connection name>"
$vpnConnectionResourceGroup = "<resource group name>"
$storageAccountName = "<storage account name>"
$storageAccountResourceGroup = "<resource group name>"
$storageAccountContainer = "<container name>"

# Get credentials for Office 365 account
$cred = Get-AutomationPSCredential -Name $o365AutomationCredential

# Get the connection "AzureRunAsConnection "
$servicePrincipalConnection=Get-AutomationConnection -Name $runAsConnectionName

"Logging in to Azure..."
Add-AzureRmAccount -EnvironmentName AzureChinaCloud `
    -ServicePrincipal `
    -TenantId $servicePrincipalConnection.TenantId `
    -ApplicationId $servicePrincipalConnection.ApplicationId `
    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
"Setting context to a specific subscription"
Set-AzureRmContext -SubscriptionId $subscriptionId

$nw = Get-AzurermResource | Where {$_.ResourceType -eq "Microsoft.Network/networkWatchers" -and $_.Location -eq $region }
$networkWatcher = Get-AzureRmNetworkWatcher -Name $nw.Name -ResourceGroupName $nw.ResourceGroupName
$connection = Get-AzureRmVirtualNetworkGatewayConnection -Name $vpnConnectionName -ResourceGroupName $vpnConnectionResourceGroup
$sa = Get-AzureRmStorageAccount -Name $storageAccountName -ResourceGroupName $storageAccountResourceGroup 
$storagePath = "$($sa.PrimaryEndpoints.Blob)$($storageAccountContainer)"
$result = Start-AzureRmNetworkWatcherResourceTroubleshooting -NetworkWatcher $networkWatcher -TargetResourceId $connection.Id -StorageId $sa.Id -StoragePath $storagePath

if($result.code -ne "Healthy")
    {
        $body = "Connection for $($connection.name) is: $($result.code) `n$($result.results[0].summary) `nView the logs at $($storagePath) to learn more."
        Write-Output $body
        $subject = "$($connection.name) Status"
        Send-MailMessage `
        -To $toEmail `
        -Subject $subject `
        -Body $body `
        -UseSsl `
        -Port $smtpPort `
        -SmtpServer $smtpServer `
        -From $fromEmail `
        -BodyAsHtml `
        -Credential $cred
    }
else
    {
    Write-Output ("Connection Status is: $($result.code)")
    }

步骤 6Step 6

保存 Runbook 后,必须向它链接一个计划才能自动启动它。Once the runbook is saved, a schedule must be linked to it to automate the start of the runbook. 若要启动链接过程,请单击“计划”。To start the process, click Schedule.

步骤 6

必须创建一个新计划。A new schedule must be created. 单击“将计划链接到 Runbook”。Click Link a schedule to your runbook.

步骤 7

步骤 1Step 1

在“计划”边栏选项卡中,单击“创建新计划”On the Schedule blade, click Create a new schedule

步骤 8

步骤 2Step 2

在“新建计划”边栏选项卡中填写计划信息。On the New Schedule blade fill out the schedule information. 以下列表提供了可设置的值:The values that can be set are in the following list:

  • 名称 - 计划的友好名称。Name - The friendly name of the schedule.
  • 说明 - 计划的说明。Description - A description of the schedule.
  • 开始时间 - 此值是日期、时间和时区的组合,构成计划触发时间。Starts - This value is a combination of date, time, and time zone that make up the time the schedule triggers.
  • 重复周期 - 此值确定计划的重复方式。Recurrence - This value determines the schedules repetition. 有效值为“一次”或“定期”。Valid values are Once or Recurring.
  • 重复间隔 - 以小时、天、周或月为单位的计划重复间隔。Recur every - The recurrence interval of the schedule in hours, days, weeks, or months.
  • 设置过期时间 - 该值确定计划是否会过期。Set Expiration - The value determines if the schedule should expire or not. 可设置为“是”或“否”。Can be set to Yes or No. 如果选择“是”,则要提供有效的日期和时间。A valid date and time are to be provided if yes is chosen.

Note

如果需要以高于每隔一小时的频率运行某个 Runbook,必须以不同的间隔创建多个计划(即,在小时后面指定 15、30 或 45 分钟)If you need to have a runbook run more often than every hour, multiple schedules must be created at different intervals (that is, 15, 30, 45 minutes after the hour)

步骤 9

步骤 3Step 3

单击“保存”,将计划保存到 Runbook。Click Save to save the schedule to the runbook.

步骤 10

后续步骤Next steps