Azure 后端连接功能中的互操作性:测试配置详细信息Interoperability in Azure back-end connectivity features: Test configuration details

本文介绍测试设置的配置详细信息。This article describes the configuration details of the test setup. 测试设置可帮助你分析 Azure 网络服务如何在控制平面级别和数据平面级别进行互操作。The test setup helps you analyze how Azure networking services interoperate at the control plane level and data plane level.

使用 VNet 对等互连建立辐射 VNet 连接Spoke VNet connectivity by using VNet peering

下图显示了辐射虚拟网络 (VNet) 的 Azure 虚拟网络对等互连详细信息。The following figure shows the Azure Virtual Network peering details of a spoke virtual network (VNet). 若要了解如何在两个 VNet 之间设置对等互连,请参阅[管理 VNet 对等互连][VNet-Config]。To learn how to set up peering between two VNets, see [Manage VNet peering][VNet-Config]. 如果希望辐射 VNet 使用连接到中心 VNet 的网关,请选择“使用远程网关”。 If you want the spoke VNet to use the gateways that are connected to the hub VNet, select Use remote gateways.


下图显示了中心 VNet 的 VNet 对等互连详细信息。The following figure shows the VNet peering details of the hub VNet. 如果希望中心 VNet 允许辐射 VNet 使用中心的网关,请选择“允许网关传输” 。If you want the hub VNet to permit the spoke VNet to use the hub's gateways, select Allow gateway transit.


使用站点到站点 VPN 建立分支 VNet 连接Branch VNet connectivity by using a site-to-site VPN

使用 Azure VPN 网关中的 VPN 网关在中心与分支 VNet 之间建立站点到站点 VPN 连接。Set up site-to-site VPN connectivity between the hub and branch VNets by using VPN gateways in Azure VPN Gateway. 默认情况下,VPN 网关和 Azure ExpressRoute 网关使用专用自治系统编号 (ASN) 值 65515By default, VPN gateways and Azure ExpressRoute gateways use a private autonomous system number (ASN) value of 65515. 可在 VPN 网关中更改 ASN 值。You can change the ASN value in VPN Gateway. 在测试设置中,分支 VNet VPN 网关的 ASN 值将更改为 65516,以支持中心与分支 VNet 之间的 eBGP 路由。In the test setup, the ASN value of the branch VNet VPN gateway is changed to 65516 to support eBGP routing between the hub and branch VNets.


使用 ExpressRoute 和站点到站点 VPN 的本地位置 1 连接On-premises Location 1 connectivity by using ExpressRoute and a site-to-site VPN

ExpressRoute 1 配置详细信息ExpressRoute 1 configuration details

下图显示了本地位置 1 客户边缘 (CE) 路由器的 Azure 区域 1 ExpressRoute 线路配置:The following figure shows the Azure Region 1 ExpressRoute circuit configuration toward on-premises Location 1 customer edge (CE) routers:


下图显示了 ExpressRoute 1 线路与中心 VNet 之间的连接配置:The following figure shows the connection configuration between the ExpressRoute 1 circuit and the hub VNet:


以下列表显示了 ExpressRoute 专用对等互连的主要 CE 路由器配置。The following list shows the primary CE router configuration for ExpressRoute private peering connectivity. (Cisco ASR1000 路由器用作测试设置中的 CE 路由器。)当站点到站点 VPN 和 ExpressRoute 线路同时配置为将某个本地网络连接到 Azure 时,默认情况下,Azure 会优先使用 ExpressRoute 线路。(Cisco ASR1000 routers are used as CE routers in the test setup.) When site-to-site VPN and ExpressRoute circuits are configured in parallel to connect an on-premises network to Azure, Azure prioritizes the ExpressRoute circuit by default. 为了避免非对称路由,本地网络也应该优先使用 ExpressRoute 连接而不是站点到站点 VPN 连接。To avoid asymmetrical routing, the on-premises network also should prioritize ExpressRoute connectivity over site-to-site VPN connectivity. 以下配置使用 BGP local-preference 属性来建立优先级:The following configuration establishes prioritization by using the BGP local-preference attribute:

interface TenGigabitEthernet0/0/0.300
 description Customer 30 private peering to Azure
 encapsulation dot1Q 30 second-dot1q 300
 ip vrf forwarding 30
 ip address
interface TenGigabitEthernet1/0/0.30
 description Customer 30 to south bound LAN switch
 encapsulation dot1Q 30
 ip vrf forwarding 30
 ip address
 ip ospf network point-to-point
router ospf 30 vrf 30
 redistribute bgp 65021 subnets route-map BGP2OSPF
 network area
default-information originate always
 default-metric 10
router bgp 65021
 address-family ipv4 vrf 30
  network mask
  neighbor remote-as 12076
  neighbor activate
  neighbor next-hop-self
  neighbor soft-reconfiguration inbound
  neighbor route-map prefer-ER-over-VPN in
  neighbor prefix-list Cust30_to_Private out
route-map prefer-ER-over-VPN permit 10
 set local-preference 200
ip prefix-list Cust30_to_Private seq 10 permit

站点到站点 VPN 配置详细信息Site-to-site VPN configuration details

以下列表显示了站点到站点 VPN 连接的主要 CE 路由器配置:The following list shows the primary CE router configuration for site-to-site VPN connectivity:

crypto ikev2 proposal Cust30-azure-proposal
 encryption aes-cbc-256 aes-cbc-128 3des
 integrity sha1
 group 2
crypto ikev2 policy Cust30-azure-policy
 match address local
 proposal Cust30-azure-proposal
crypto ikev2 keyring Cust30-azure-keyring
 peer azure
  pre-shared-key local IamSecure123
  pre-shared-key remote IamSecure123
crypto ikev2 profile Cust30-azure-profile
 match identity remote address
 identity local address
 authentication local pre-share
 authentication remote pre-share
 keyring local Cust30-azure-keyring
crypto ipsec transform-set Cust30-azure-ipsec-proposal-set esp-aes 256 esp-sha-hmac
 mode tunnel
crypto ipsec profile Cust30-azure-ipsec-profile
 set transform-set Cust30-azure-ipsec-proposal-set
 set ikev2-profile Cust30-azure-profile
interface Loopback30
 ip address
interface Tunnel30
 ip vrf forwarding 30
 ip address
 tunnel source Loopback30
 tunnel mode ipsec ipv4
 tunnel destination
 tunnel protection ipsec profile Cust30-azure-ipsec-profile
router bgp 65021
 address-family ipv4 vrf 30
  network mask
  neighbor remote-as 65515
  neighbor ebgp-multihop 5
  neighbor update-source Tunnel30
  neighbor activate
  neighbor soft-reconfiguration inbound
ip route vrf 30 Tunnel30

使用 ExpressRoute 的本地位置 2 连接On-premises Location 2 connectivity by using ExpressRoute

与本地位置 2 比较靠近的另一条 ExpressRoute 线路将本地位置 2 连接到中心 VNet。A second ExpressRoute circuit, in closer proximity to on-premises Location 2, connects on-premises Location 2 to the hub VNet. 下图显示了第二个 ExpressRoute 配置:The following figure shows the second ExpressRoute configuration:


下图显示了第二条 ExpressRoute 线路与中心 VNet 之间的连接配置:The following figure shows the connection configuration between the second ExpressRoute circuit and the hub VNet:


ExpressRoute 1 将中心 VNet 和本地位置 1 连接到不同 Azure 区域中的远程 VNet:ExpressRoute 1 connects both the hub VNet and on-premises Location 1 to a remote VNet in a different Azure region:


串联 ExpressRoute 和站点到站点 VPN 连接ExpressRoute and site-to-site VPN connectivity in tandem

将站点到站点 VPN 用作 ExpressRoute 的安全故障转移路径Site-to-site VPN as a secure failover path for ExpressRoute

ExpressRoute 充当冗余的线路对,可确保高可用性。ExpressRoute serves as a redundant circuit pair to ensure high availability. 可在不同的 Azure 区域配置异地冗余的 ExpressRoute 连接。You can configure geo-redundant ExpressRoute connectivity in different Azure regions. 另外,如测试设置中所示,在 Azure 区域中,可以使用站点到站点 VPN 为 ExpressRoute 连接创建故障转移路径。Also, as demonstrated in our test setup, within an Azure region, you can use a site-to-site VPN to create a failover path for your ExpressRoute connectivity. 通过 ExpressRoute 和站点到站点 VPN 播发相同的前缀时,Azure 会优先使用 ExpressRoute。When the same prefixes are advertised over both ExpressRoute and a site-to-site VPN, Azure prioritizes ExpressRoute. 为了避免 ExpressRoute 与站点到站点 VPN 之间的非对称路由,本地网络配置同样应该优先使用 ExpressRoute 连接,然后再使用站点到站点 VPN 连接。To avoid asymmetrical routing between ExpressRoute and the site-to-site VPN, on-premises network configuration should also reciprocate by using ExpressRoute connectivity before it uses site-to-site VPN connectivity.

有关如何配置 ExpressRoute 和站点到站点 VPN 共存连接的详细信息,请参阅 ExpressRoute 和站点到站点共存For more information about how to configure coexisting connections for ExpressRoute and a site-to-site VPN, see ExpressRoute and site-to-site coexistence.

将后端连接扩展到辐射 VNet 和分支位置Extend back-end connectivity to spoke VNets and branch locations

使用 VNet 对等互连建立辐射 VNet 连接Spoke VNet connectivity by using VNet peering

中心辐射型 VNet 体系结构的使用非常广泛。Hub and spoke VNet architecture is widely used. 中心是 Azure 中的一个 VNet,充当辐射 VNet 与本地网络之间的连接中心点。The hub is a VNet in Azure that acts as a central point of connectivity between your spoke VNets and to your on-premises network. 辐射是与中心对等互连的 VNet,可用于隔离工作负荷。The spokes are VNets that peer with the hub, and which you can use to isolate workloads. 流量通过 ExpressRoute 或 VPN 连接在本地数据中心与中心之间流动。Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN connection. 有关详细信息,请参阅“体系结构”。For more information about the architecture.

在区域内的 VNet 对等互连中,辐射 VNet 可以使用中心 VPN 网关(VPN 和 ExpressRoute 网关)来与远程网络通信。In VNet peering within a region, spoke VNets can use hub VPN gateways (both VPN and ExpressRoute gateways) to communicate with remote networks.

使用站点到站点 VPN 建立分支 VNet 连接Branch VNet connectivity by using site-to-site VPN

你可能想让位于不同区域中的分支 VNet 和本地网络通过中心 VNet 相互通信。You might want branch VNets, which are in different regions, and on-premises networks to communicate with each other via a hub VNet. 此配置的本机 Azure 解决方案是使用 VPN 建立站点到站点 VPN 连接。The native Azure solution for this configuration is site-to-site VPN connectivity by using a VPN. 替代方案是对中心内部的路由使用网络虚拟设备 (NVA)。An alternative is to use a network virtual appliance (NVA) for routing in the hub.

有关详细信息,请参阅什么是 VPN 网关?For more information, see What is VPN Gateway?.

后续步骤Next steps

了解测试设置的控制平面分析,以及拓扑中不同 VNet 或 VLAN 的视图。Learn about control plane analysis of the test setup and the views of different VNets or VLANs in the topology.

了解测试设置的数据平面分析,以及 Azure 网络监视功能视图。Learn about data plane analysis of the test setup and Azure network monitoring feature views.

请参阅 ExpressRoute 常见问题解答See the ExpressRoute FAQ to:

  • 了解可将多少条 ExpressRoute 线路连接到一个 ExpressRoute 网关。Learn how many ExpressRoute circuits you can connect to an ExpressRoute gateway.
  • 了解可将多少个 ExpressRoute 网关连接到一条 ExpressRoute 线路。Learn how many ExpressRoute gateways you can connect to an ExpressRoute circuit.
  • 了解 ExpressRoute 的其他缩放限制。Learn about other scale limits of ExpressRoute.