使用 Azure 网络观察程序排查虚拟网络网关和连接问题Troubleshoot Virtual Network gateway and Connections using Azure Network Watcher

网络观察程序提供了许多功能,因为它关系到了解 Azure 中的网络资源。Network Watcher provides many capabilities as it relates to understanding your network resources in Azure. 其中一项功能就是资源故障排除。One of these capabilities is resource troubleshooting. 可以通过门户、PowerShell、CLI 或 REST API 调用资源故障排除。Resource troubleshooting can be called through the portal, PowerShell, CLI, or REST API. 调用后,网络观察程序会检查虚拟网络网关或连接的运行状况,并返回调查结果。When called, Network Watcher inspects the health of a Virtual Network Gateway or a Connection and returns its findings.

本文逐步讲解如何完成当前可用于资源故障排除的不同管理任务。This article takes you through the different management tasks that are currently available for resource troubleshooting.

开始之前Before you begin

通过 PowerShell 调用 REST API 时,使用的是 ARMclient。ARMclient is used to call the REST API using PowerShell. 根据 Chocolatey 上的 ARMClient 中所述在 chocolatey 上找到 ARMClientARMClient is found on chocolatey at ARMClient on Chocolatey

此方案假定已按照创建网络观察程序中的步骤创建网络观察程序。This scenario assumes you have already followed the steps in Create a Network Watcher to create a Network Watcher.

有关支持的网关类型列表,请访问支持的网关类型For a list of supported gateway types visit, Supported Gateway types.

概述Overview

使用网络观察程序故障排除功能可以排查虚拟网络网关和连接发生的问题。Network Watcher troubleshooting provides the ability troubleshoot issues that arise with Virtual Network gateways and Connections. 向资源故障排除功能发出请求时,系统将查询并检查日志。When a request is made to the resource troubleshooting, logs are querying and inspected. 检查完成后,将返回结果。When inspection is complete, the results are returned. 故障排除 API 请求是长时间运行的请求,可能需要好几分钟才返回结果。The troubleshoot API requests are long running requests, which could take multiple minutes to return a result. 日志存储在存储帐户上的某个容器中。Logs are stored in a container on a storage account.

使用 ARMClient 登录Log in with ARMClient

$env:ARMCLIENT_ENV="MOONCAKE"
armclient login

排查虚拟网络网关问题Troubleshoot a Virtual Network gateway

POST 故障排除请求POST the troubleshoot request

以下示例查询虚拟网络网关的状态。The following example queries the status of a Virtual Network gateway.


$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "ContosoRG"
$NWresourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_chinaeast"
$vnetGatewayName = "ContosoVNETGateway"
$storageAccountName = "contososa"
$containerName = "gwlogs"
$requestBody = @"
{
'TargetResourceId': '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/virtualNetworkGateways/${vnetGatewayName}',
'Properties': {
'StorageId': '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${storageAccountName}',
'StoragePath': 'https://${storageAccountName}.blob.core.chinacloudapi.cn/${containerName}'
}
}
"@

armclient post "https://management.chinacloudapi.cn/subscriptions/${subscriptionId}/ResourceGroups/${NWresourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/troubleshoot?api-version=2016-03-30" $requestBody -verbose

由于此操作会长时间运行,因此会在响应标头中返回用于查询操作的 URI 以及结果的 URI,如以下响应中所示:Since this operation is long running, the URI for querying the operation and the URI for the result is returned in the response header as shown in the following response:

重要值Important Values

  • Azure AsyncOperation - 此属性包含用于查询异步故障排除操作的 URIAzure-AsyncOperation - This property contains the URI to query the Async troubleshoot operation
  • Location - 此属性包含完成操作时结果所在的 URILocation - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: 8a1167b7-6768-4ac1-85dc-703c9c9b9247
Azure-AsyncOperation: https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operations/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operationResults/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: 4364d88a-bd08-422c-a716-dbb0cdc99f7b
x-ms-routing-request-id: NORTHCENTRALUS:20170112T183202Z:4364d88a-bd08-422c-a716-dbb0cdc99f7b
Date: Thu, 12 Jan 2017 18:32:01 GMT

null

查询异步操作是否完成Query the async operation for completion

使用操作 URI 查询操作的进度,如以下示例中所示:Use the operations URI to query for the progress of the operation as seen in the following example:

armclient get "https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operations/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30" -verbose

当操作正在进行时,响应会显示 InProgress,如以下示例中所示:While the operation is in progress, the response shows InProgress as seen in the following example:

{
  "status": "InProgress"
}

完成操作后,状态将更改为 SucceededWhen the operation is complete the status changes to Succeeded.

{
  "status": "Succeeded"
}

检索结果Retrieve the results

返回的状态变为 Succeeded 后,针对 operationResult URI 调用 GET 方法来检索结果。Once the status returned is Succeeded, call a GET Method on the operationResult URI to retrieve the results.

armclient get "https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operationResults/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30" -verbose

以下响应是查询网关故障排除结果时返回的典型降级响应的示例。The following responses are examples of a typical degraded response returned when querying the results of troubleshooting a gateway. 请参阅了解结果,获取响应中属性的含义说明。See Understanding the results to get clarification on what the properties in the response mean.

{
  "startTime": "2017-01-12T10:31:41.562646-08:00",
  "endTime": "2017-01-12T18:31:48.677Z",
  "code": "Degraded",
  "results": [
    {
      "id": "PlatformInActive",
      "summary": "We are sorry, your VPN gateway is in standby mode",
      "detail": "During this time the gateway will not initiate or accept VPN connections with on premises VPN devices or other Azure VPN Gateways. This is a transient state while the Azure platform is being updated.",
      "recommendedActions": [
        {
          "actionText": "If the condition persists, please try resetting your Azure VPN gateway",
          "actionUri": "https://docs.azure.cn/vpn-gateway/vpn-gateway-resetgw-classic",
          "actionUriText": "resetting the VPN Gateway"
        },
        {
          "actionText": "If your VPN gateway isn't up and running by the expected resolution time, contact support",
          "actionUri": "https://support.azure.cn/support/contact/",
          "actionUriText": "contact support"
        }
      ]
    },
    {
      "id": "NoFault",
      "summary": "This VPN gateway is running normally",
      "detail": "There aren't any known Azure platform problems affecting this VPN Connection",
      "recommendedActions": [
        {
          "actionText": "If you are still experience problems with the VPN gateway, please try resetting the VPN gateway.",
          "actionUri": "https://docs.azure.cn/vpn-gateway/vpn-gateway-resetgw-classic",
          "actionUriText": "resetting VPN gateway"
        },
        {
          "actionText": "If you are experiencing problems you believe are caused by Azure, contact support",
          "actionUri": "https://support.azure.cn/support/contact/",
          "actionUriText": "contact support"
        }
      ]
    }
  ]
}

排查连接问题Troubleshoot Connections

以下示例查询连接的状态。The following example queries the status of a Connection.


$subscriptionId = "00000000-0000-0000-0000-000000000000"
$resourceGroupName = "ContosoRG"
$NWresourceGroupName = "NetworkWatcherRG"
$networkWatcherName = "NetworkWatcher_chinaeast"
$connectionName = "VNET2toVNET1Connection"
$storageAccountName = "contososa"
$containerName = "gwlogs"
$requestBody = @{
"TargetResourceId": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/connections/${connectionName}",
"Properties": {
"StorageId": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${storageAccountName}",
"StoragePath": "https://${storageAccountName}.blob.core.chinacloudapi.cn/${containerName}"
}

}
armclient post "https://management.chinacloudapi.cn/subscriptions/${subscriptionId}/ResourceGroups/${NWresourceGroupName}/providers/Microsoft.Network/networkWatchers/${networkWatcherName}/troubleshoot?api-version=2016-03-30 $requestBody"

备注

无法同时针对连接及其相应的网关运行故障排除操作。The troubleshoot operation cannot be run in parallel on a Connection and its corresponding gateways. 必须先完成该操作,才能针对前一个资源执行该操作。The operation must complete prior to running it on the previous resource.

由于此操作是一个长时间运行的事务,因此将返回响应标头、用于查询操作的 URI 以及结果的 URI,如以下响应中所示:Since this is a long running transaction, in the response header, the URI for querying the operation and the URI for the result is returned as shown in the following response:

重要值Important Values

  • Azure AsyncOperation - 此属性包含用于查询异步故障排除操作的 URIAzure-AsyncOperation - This property contains the URI to query the Async troubleshoot operation
  • Location - 此属性包含完成操作时结果所在的 URILocation - This property contains the URI where the results are when the operation is complete
HTTP/1.1 202 Accepted
Pragma: no-cache
Retry-After: 10
x-ms-request-id: 8a1167b7-6768-4ac1-85dc-703c9c9b9247
Azure-AsyncOperation: https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operations/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-cache
Location: https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operationResults/8a1167b7-6768-4ac1-85dc-703c9c9b9247?api-version=2016-03-30
Server: Microsoft-HTTPAPI/2.0; Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id: 4364d88a-bd08-422c-a716-dbb0cdc99f7b
x-ms-routing-request-id: NORTHCENTRALUS:20170112T183202Z:4364d88a-bd08-422c-a716-dbb0cdc99f7b
Date: Thu, 12 Jan 2017 18:32:01 GMT

null

查询异步操作是否完成Query the async operation for completion

使用操作 URI 查询操作的进度,如以下示例中所示:Use the operations URI to query for the progress of the operation as seen in the following example:

armclient get "https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operations/843b1c31-4717-4fdd-b7a6-4c786ca9c501?api-version=2016-03-30"

当操作正在进行时,响应会显示 InProgress,如以下示例中所示:While the operation is in progress, the response shows InProgress as seen in the following example:

{
  "status": "InProgress"
}

完成操作后,状态将更改为 SucceededWhen the operation is complete, the status changes to Succeeded.

{
  "status": "Succeeded"
}

以下响应是查询连接故障排除结果时返回的典型响应的示例。The following responses are examples of a typical response returned when querying the results of troubleshooting a Connection.

检索结果Retrieve the results

返回的状态变为 Succeeded 后,针对 operationResult URI 调用 GET 方法来检索结果。Once the status returned is Succeeded, call a GET Method on the operationResult URI to retrieve the results.

armclient get "https://management.chinacloudapi.cn/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/chinaeast/operationResults/843b1c31-4717-4fdd-b7a6-4c786ca9c501?api-version=2016-03-30"

以下响应是查询连接故障排除结果时返回的典型响应的示例。The following responses are examples of a typical response returned when querying the results of troubleshooting a Connection.

{
  "startTime": "2017-01-12T14:09:19.1215346-08:00",
  "endTime": "2017-01-12T22:09:23.747Z",
  "code": "UnHealthy",
  "results": [
    {
      "id": "PlatformInActive",
      "summary": "We are sorry, your VPN gateway is in standby mode",
      "detail": "During this time the gateway will not initiate or accept VPN connections with on premises VPN devices or other Azure VPN Gateways. This 
is a transient state while the Azure platform is being updated.",
      "recommendedActions": [
        {
          "actionText": "If the condition persists, please try resetting your Azure VPN gateway",
          "actionUri": "https://docs.azure.cn/vpn-gateway/vpn-gateway-resetgw-classic",
          "actionUriText": "resetting the VPN gateway"
        },
        {
          "actionText": "If your VPN Connection isn't up and running by the expected resolution time, contact support",
          "actionUri": "https://support.azure.cn/support/contact/",
          "actionUriText": "contact support"
        }
      ]
    },
    {
      "id": "NoFault",
      "summary": "This VPN Connection is running normally",
      "detail": "There aren't any known Azure platform problems affecting this VPN Connection",
      "recommendedActions": [
        {
          "actionText": "If you are still experience problems with the VPN gateway, please try resetting the VPN gateway.",
          "actionUri": "https://docs.azure.cn/vpn-gateway/vpn-gateway-resetgw-classic",
          "actionUriText": "resetting VPN gateway"
        },
        {
          "actionText": "If you are experiencing problems you believe are caused by Azure, contact support",
          "actionUri": "https://support.azure.cn/support/contact/",
          "actionUriText": "contact support"
        }
      ]
    }
  ]
}

了解结果Understanding the results

操作文本提供有关如何解决问题的常规指导。The action text provides general guidance on how to resolve the issue. 如果可以对问题采取措施,将提供一个包含更多指导的链接。If an action can be taken for the issue, a link is provided with additional guidance. 如果没有更多指导,响应将提供一个用于建立支持案例的 URL。In the case where there is no additional guidance, the response provides the url to open a support case. 有关响应的属性及其包含的内容的详细信息,请访问网络观察程序故障排除概述For more information about the properties of the response and what is included, visit Network Watcher Troubleshoot overview

有关从 Azure 存储帐户下载文件的说明,请参阅通过 .NET 开始使用 Azure Blob 存储For instructions on downloading files from azure storage accounts, refer to Get started with Azure Blob storage using .NET. 可以使用的另一个工具是存储资源管理器。Another tool that can be used is Storage Explorer. 有关存储资源管理器的详细信息可以在此链接中找到:存储资源管理器More information about Storage Explorer can be found here at the following link: Storage Explorer

后续步骤Next steps

如果停止 VPN 连接的设置已更改,请参阅管理网络安全组找到可能有问题的网络安全组和安全规则。If settings have been changed that stop VPN connectivity, see Manage Network Security Groups to track down the network security group and security rules that may be in question.