Azure 中的互操作性:数据平面分析Interoperability in Azure : Data plane analysis

本文介绍了测试设置的数据平面分析。This article describes the data plane analysis of the test setup. 你也可以查看测试设置的测试设置配置控制平面分析You can also review the test setup configuration and the control plane analysis of the test setup.

数据平面分析检查数据包从一个本地网络(LAN 或虚拟网络)遍历到拓扑中的另一个本地网络所采用的路径。Data plane analysis examines the path taken by packets that traverse from one local network (LAN or virtual network) to another within a topology. 两个本地网络之间的数据路径不一定是对称的。The data path between two local networks isn't necessarily symmetrical. 因此,本文将单独从反向路径的角度来分析从一个本地网络到另一个网络的正向路径。Therefore, in this article, we analyze a forwarding path from a local network to another network that's separate from the reverse path.

中心 VNet 中的数据路径Data path from the hub VNet

辐射 VNet 的路径Path to the spoke VNet

虚拟网络 (VNet) 对等互连模拟两个对等互连 VNet 之间的网桥功能。Virtual network (VNet) peering emulates network bridge functionality between the two VNets that are peered. 下面列出了从中心 VNet 到辐射 VNet 中某个 VM 的跟踪路由输出:Traceroute output from a hub VNet to a VM in the spoke VNet is shown here:

C:\Users\rb>tracert 10.11.30.4

Tracing route to 10.11.30.4 over a maximum of 30 hops

  1     2 ms     1 ms     1 ms  10.11.30.4

Trace complete.

下图显示了 Azure 网络观察程序中的 VNet 和辐射 VNet 的图形连接视图:The following figure shows the graphical connection view of the hub VNet and the spoke VNet from the perspective of Azure Network Watcher:

11

分支 VNet 的路径Path to the branch VNet

下面列出了从中心 VNet 到分支 VNet 中某个 VM 的跟踪路由输出:Traceroute output from a hub VNet to a VM in the branch VNet is shown here:

C:\Users\rb>tracert 10.11.30.68

Tracing route to 10.11.30.68 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  10.10.30.142
  2     *        *        *     Request timed out.
  3     2 ms     2 ms     2 ms  10.11.30.68

Trace complete.

在此跟踪路由中,第一个跃点是中心 VNet 的 Azure VPN 网关中的 VPN 网关。In this traceroute, the first hop is the VPN gateway in Azure VPN Gateway of the hub VNet. 第二个跃点是分支 VNet 的 VPN 网关。The second hop is the VPN gateway of the branch VNet. 对于分支 VNet 的 VPN 网关,其 IP 地址不会在中心 VNet 中播发。The IP address of the VPN gateway of the branch VNet isn't advertised in the hub VNet. 第三个跃点是分支 VNet 中的 VM。The third hop is the VM on the branch VNet.

下图显示了网络观察程序中的中心 VNet 和分支 VNet 的图形连接视图:The following figure shows the graphical connection view of the hub VNet and the branch VNet from the perspective of Network Watcher:

22

对于相同的连接,下图显示了网络观察程序中的网格视图:For the same connection, the following figure shows the grid view in Network Watcher:

33

本地位置 1 的路径Path to on-premises Location 1

下面列出了从中心 VNet 到本地位置 1 中某个 VM 的跟踪路由输出:Traceroute output from a hub VNet to a VM in on-premises Location 1 is shown here:

C:\Users\rb>tracert 10.2.30.10

Tracing route to 10.2.30.10 over a maximum of 30 hops

  1     2 ms     2 ms     2 ms  10.10.30.132
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     2 ms     2 ms     2 ms  10.2.30.10

Trace complete.

在此跟踪路由中,第一个跃点是 Azure ExpressRoute 网关隧道终结点到 Microsoft Enterprise Edge 路由器 (MSEE)。In this traceroute, the first hop is the Azure ExpressRoute gateway tunnel endpoint to a Microsoft Enterprise Edge Router (MSEE). 第二个和第三个跃点为客户边缘 (CE) 路由器和本地位置 1 LAN IP。The second and third hops are the customer edge (CE) router and the on-premises Location 1 LAN IPs. 这些 IP 地址不会在中心 VNet 中播发。These IP addresses aren't advertised in the hub VNet. 第四个跃点是本地位置 1 中的 VM。The fourth hop is the VM in the on-premises Location 1.

本地位置 2 的路径Path to on-premises Location 2

下面列出了从中心 VNet 到本地位置 2 中某个 VM 的跟踪路由输出:Traceroute output from a hub VNet to a VM in on-premises Location 2 is shown here:

C:\Users\rb>tracert 10.1.31.10

Tracing route to 10.1.31.10 over a maximum of 30 hops

  1    76 ms    75 ms    75 ms  10.10.30.134
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4    75 ms    75 ms    75 ms  10.1.31.10

Trace complete.

在此跟踪路由中,第一跃点是 MSEE 的 ExpressRoute 网关隧道终结点。In this traceroute, the first hop is the ExpressRoute gateway tunnel endpoint to an MSEE. 第二个和第三个跃点为 CE 路由器和本地位置 2 LAN IP。The second and third hops are the CE router and the on-premises Location 2 LAN IPs. 这些 IP 地址不会在中心 VNet 中播发。These IP addresses aren't advertised in the hub VNet. 第四个跃点是本地位置 2 中的 VM。The fourth hop is the VM on the on-premises Location 2.

远程 VNet 的路径Path to the remote VNet

下面列出了从中心 VNet 到远程 VNet 中某个 VM 的跟踪路由输出:Traceroute output from a hub VNet to a VM in the remote VNet is shown here:

C:\Users\rb>tracert 10.17.30.4

Tracing route to 10.17.30.4 over a maximum of 30 hops

  1     2 ms     2 ms     2 ms  10.10.30.132
  2     *        *        *     Request timed out.
  3    69 ms    68 ms    69 ms  10.17.30.4

Trace complete.

在此跟踪路由中,第一跃点是 MSEE 的 ExpressRoute 网关隧道终结点。In this traceroute, the first hop is the ExpressRoute gateway tunnel endpoint to an MSEE. 第二个跃点是远程 VNet 的网关 IP。The second hop is the remote VNet's gateway IP. 第二个跃点的 IP 范围不会在中心 VNet 中播发。The second hop IP range isn't advertised in the hub VNet. 第三个跃点是远程 VNet 中的 VM。The third hop is the VM on the remote VNet.

辐射 VNet 中的数据路径Data path from the spoke VNet

辐射 VNet 共享中心 VNet 的网络视图。The spoke VNet shares the network view of the hub VNet. 辐射 VNet 通过 VNet 对等互连使用中心 VNet 的远程网关连接,如同两者是直接连接的一样。Through VNet peering, the spoke VNet uses the remote gateway connectivity of the hub VNet as if it's directly connected to the spoke VNet.

中心 VNet 的路径Path to the hub VNet

下面列出了从辐射 VNet 到中心 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the spoke VNet to a VM in the hub VNet is shown here:

C:\Users\rb>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.10.30.4

Trace complete.

分支 VNet 的路径Path to the branch VNet

下面列出了从辐射 VNet 到分支 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the spoke VNet to a VM in the branch VNet is shown here:

C:\Users\rb>tracert 10.11.30.68

Tracing route to 10.11.30.68 over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms  10.10.30.142
  2     *        *        *     Request timed out.
  3     3 ms     2 ms     2 ms  10.11.30.68

Trace complete.

在此跟踪路由中,第一个跃点是中心 VNet 的 VPN 网关。In this traceroute, the first hop is the VPN gateway of the hub VNet. 第二个跃点是分支 VNet 的 VPN 网关。The second hop is the VPN gateway of the branch VNet. 分支 VNet 的 VPN 网关的 IP 地址不会在中心/辐射 VNet 中播发。The IP address of the VPN gateway of the branch VNet isn't advertised within the hub/spoke VNet. 第三个跃点是分支 VNet 中的 VM。The third hop is the VM on the branch VNet.

本地位置 1 的路径Path to on-premises Location 1

下面列出了从辐射 VNet 到本地位置 1 中某个 VM 的跟踪路由输出:Traceroute output from the spoke VNet to a VM in on-premises Location 1 is shown here:

C:\Users\rb>tracert 10.2.30.10

Tracing route to 10.2.30.10 over a maximum of 30 hops

  1    24 ms     2 ms     3 ms  10.10.30.132
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     3 ms     2 ms     2 ms  10.2.30.10

Trace complete.

在此跟踪路由中,第一跃点是 MSEE 的中心 VNet ExpressRoute 网关隧道终结点。In this traceroute, the first hop is the hub VNet's ExpressRoute gateway tunnel endpoint to an MSEE. 第二个和第三个跃点为 CE 路由器和本地位置 1 LAN IP。The second and third hops are the CE router and the on-premises Location 1 LAN IPs. 这些 IP 地址不会在中心/辐射 VNet 中播发。These IP addresses aren't advertised in the hub/spoke VNet. 第四个跃点是本地位置 1 中的 VM。The fourth hop is the VM in the on-premises Location 1.

本地位置 2 的路径Path to on-premises Location 2

下面列出了从辐射 VNet 到本地位置 2 中某个 VM 的跟踪路由输出:Traceroute output from the spoke VNet to a VM in on-premises Location 2 is shown here:

C:\Users\rb>tracert 10.1.31.10

Tracing route to 10.1.31.10 over a maximum of 30 hops

  1    76 ms    75 ms    76 ms  10.10.30.134
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4    75 ms    75 ms    75 ms  10.1.31.10

Trace complete.

在此跟踪路由中,第一跃点是 MSEE 的中心 VNet ExpressRoute 网关隧道终结点。In this traceroute, the first hop is the hub VNet's ExpressRoute gateway tunnel endpoint to an MSEE. 第二个和第三个跃点为 CE 路由器和本地位置 2 LAN IP。The second and third hops are the CE router and the on-premises Location 2 LAN IPs. 这些 IP 地址不会在中心/辐射 VNet 中播发。These IP addresses aren't advertised in the hub/spoke VNets. 第四个跃点是在本地位置 2 中的 VM。The fourth hop is the VM in the on-premises Location 2.

远程 VNet 的路径Path to the remote VNet

下面列出了从辐射 VNet 到远程 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the spoke VNet to a VM in the remote VNet is shown here:

C:\Users\rb>tracert 10.17.30.4

Tracing route to 10.17.30.4 over a maximum of 30 hops

  1     2 ms     1 ms     1 ms  10.10.30.133
  2     *        *        *     Request timed out.
  3    71 ms    70 ms    70 ms  10.17.30.4

Trace complete.

在此跟踪路由中,第一跃点是 MSEE 的中心 VNet ExpressRoute 网关隧道终结点。In this traceroute, the first hop is the hub VNet's ExpressRoute gateway tunnel endpoint to an MSEE. 第二个跃点是远程 VNet 的网关 IP。The second hop is the remote VNet's gateway IP. 第二个跃点的 IP 范围不会在中心/辐射 VNet 中播发。The second hop IP range isn't advertised in the hub/spoke VNet. 第三个跃点是远程 VNet 中的 VM。The third hop is the VM on the remote VNet.

分支 VNet 中的数据路径Data path from the branch VNet

中心 VNet 的路径Path to the hub VNet

下面列出了从分支 VNet 到中心 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the branch VNet to a VM in the hub VNet is shown here:

C:\Windows\system32>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.11.30.100
  2     *        *        *     Request timed out.
  3     4 ms     3 ms     3 ms  10.10.30.4

Trace complete.

在此跟踪路由中,第一个跃点是分支 VNet 的 VPN 网关。In this traceroute, the first hop is the VPN gateway of the branch VNet. 第二个跃点是中心 VNet 的 VPN 网关。The second hop is the VPN gateway of the hub VNet. 中心 VNet 的 VPN 网关的 IP 地址不会在远程 VNet 中播发。The IP address of the VPN gateway of the hub VNet isn't advertised in the remote VNet. 第三个跃点是中心 VNet 中的 VM。The third hop is the VM on the hub VNet.

辐射 VNet 的路径Path to the spoke VNet

下面列出了从分支 VNet 到辐射 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the branch VNet to a VM in the spoke VNet is shown here:

C:\Users\rb>tracert 10.11.30.4

Tracing route to 10.11.30.4 over a maximum of 30 hops

  1     1 ms    <1 ms     1 ms  10.11.30.100
  2     *        *        *     Request timed out.
  3     4 ms     3 ms     2 ms  10.11.30.4

Trace complete.

在此跟踪路由中,第一个跃点是分支 VNet 的 VPN 网关。In this traceroute, the first hop is the VPN gateway of the branch VNet. 第二个跃点是中心 VNet 的 VPN 网关。The second hop is the VPN gateway of the hub VNet. 中心 VNet 的 VPN 网关的 IP 地址不会在远程 VNet 中播发。The IP address of the VPN gateway of the hub VNet isn't advertised in the remote VNet. 第三个跃点是辐射 VNet 中的 VM。The third hop is the VM on the spoke VNet.

本地位置 1 的路径Path to on-premises Location 1

下面列出了从分支 VNet 到本地位置 1 中某个 VM 的跟踪路由输出:Traceroute output from the branch VNet to a VM in on-premises Location 1 is shown here:

C:\Users\rb>tracert 10.2.30.10

Tracing route to 10.2.30.10 over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms  10.11.30.100
  2     *        *        *     Request timed out.
  3     3 ms     2 ms     2 ms  10.2.30.125
  4     *        *        *     Request timed out.
  5     3 ms     3 ms     3 ms  10.2.30.10

Trace complete.

在此跟踪路由中,第一个跃点是分支 VNet 的 VPN 网关。In this traceroute, the first hop is the VPN gateway of the branch VNet. 第二个跃点是中心 VNet 的 VPN 网关。The second hop is the VPN gateway of the hub VNet. 中心 VNet 的 VPN 网关的 IP 地址不会在远程 VNet 中播发。The IP address of the VPN gateway of the hub VNet isn't advertised in the remote VNet. 第三个跃点是主要 CE 路由器上的 VPN 隧道终结点。The third hop is the VPN tunnel termination point on the primary CE router. 第四个跃点是在本地位置 1 的内部 IP 地址。The fourth hop is an internal IP address of on-premises Location 1. 此 LAN IP 地址不会在 CE 路由器外部播发。This LAN IP address isn't advertised outside the CE router. 第五个跃点是本地位置 1 中的目标 VM。The fifth hop is the destination VM in the on-premises Location 1.

本地位置 2 和远程 VNet 的路径Path to on-premises Location 2 and the remote VNet

如在控制平面分析中所述,根据网络配置,本地位置 2 和远程 VNet 都看不到分支 VNet。As we discussed in the control plane analysis, the branch VNet has no visibility either to on-premises Location 2 or to the remote VNet per the network configuration. 以下 ping 结果确认了这一事实:The following ping results confirm:

C:\Users\rb>ping 10.1.31.10

Pinging 10.1.31.10 with 32 bytes of data:

Request timed out.
...
Request timed out.

Ping statistics for 10.1.31.10:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\rb>ping 10.17.30.4

Pinging 10.17.30.4 with 32 bytes of data:

Request timed out.
...
Request timed out.

Ping statistics for 10.17.30.4:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

本地位置 1 中的数据路径Data path from on-premises Location 1

中心 VNet 的路径Path to the hub VNet

下面列出了从本地位置 1 到中心 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 1 to a VM in the hub VNet is shown here:

C:\Users\rb>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.2.30.3
  2    <1 ms    <1 ms    <1 ms  192.168.30.0
  3    <1 ms    <1 ms    <1 ms  192.168.30.18
  4     *        *        *     Request timed out.
  5     2 ms     2 ms     2 ms  10.10.30.4

Trace complete.

在跟踪路由中,前两个跃点属于本地网络。In this traceroute, the first two hops are part of the on-premises network. 第三个跃点是面向 CE 路由器的主要 MSEE 接口。The third hop is the primary MSEE interface that faces the CE router. 第四个跃点是中心 VNet 的 ExpressRoute 网关。The fourth hop is the ExpressRoute gateway of the hub VNet. 中心 VNet 的 ExpressRoute 网关的 IP 范围不会播发到本地网络。The IP range of the ExpressRoute gateway of the hub VNet isn't advertised to the on-premises network. 第五个跃点是目标 VM。The fifth hop is the destination VM.

网络观察程序仅提供以 Azure 为中心的视图。Network Watcher provides only an Azure-centric view. 在本地透视图中,我们将使用 Azure 网络性能监视器。For an on-premises perspective, we use Azure Network Performance Monitor. 网络性能监视器提供可以安装在 Azure 外部网络中的服务器上以进行数据路径分析的代理。Network Performance Monitor provides agents that you can install on servers in networks outside Azure for data path analysis.

下图显示本地位置 1 VM 通过 ExpressRoute 与中心 VNet 中的 VM 建立连接的拓扑视图:The following figure shows the topology view of the on-premises Location 1 VM connectivity to the VM on the hub VNet via ExpressRoute:

44

如前文所述,测试设置使用站点到站点 VPN 作为本地位置 1 与中心 VNet 之间的备用 ExpressRoute 连接。As discussed earlier, the test setup uses a site-to-site VPN as backup connectivity for ExpressRoute between the on-premises Location 1 and the hub VNet. 为了测试备份数据路径,让我们在本地位置 1 主要 CE 路由器和相应的 MSEE 之间引发一个 ExpressRoute 链接故障。To test the backup data path, let's induce an ExpressRoute link failure between the on-premises Location 1 primary CE router and the corresponding MSEE. 为引发 ExpressRoute 链接故障,请关闭面向 MSEE 的 CE 接口:To induce an ExpressRoute link failure, shut down the CE interface that faces the MSEE:

C:\Users\rb>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.2.30.3
  2    <1 ms    <1 ms    <1 ms  192.168.30.0
  3     3 ms     2 ms     3 ms  10.10.30.4

Trace complete.

下图显示当 ExpressRoute 连接断开时,本地位置 1 VM 通过站点到站点 VPN 连接与中心 VNet 中的 VM 建立连接的拓扑视图:The following figure shows the topology view of the on-premises Location 1 VM connectivity to the VM on the hub VNet via site-to-site VPN connectivity when ExpressRoute connectivity is down:

55

辐射 VNet 的路径Path to the spoke VNet

下面列出了从本地位置 1 到辐射 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 1 to a VM in the spoke VNet is shown here:

让我们恢复 ExpressRoute 主要连接,以对辐射 VNet 执行数据路径分析:Let's bring back the ExpressRoute primary connectivity to do the data path analysis toward the spoke VNet:

C:\Users\rb>tracert 10.11.30.4

Tracing route to 10.11.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.2.30.3
  2    <1 ms    <1 ms    <1 ms  192.168.30.0
  3    <1 ms    <1 ms    <1 ms  192.168.30.18
  4     *        *        *     Request timed out.
  5     3 ms     2 ms     2 ms  10.11.30.4

Trace complete.

调出主要 ExpressRoute 1 连接,以执行剩余的数据路径分析。Bring up the primary ExpressRoute 1 connectivity for the remainder of the data path analysis.

分支 VNet 的路径Path to the branch VNet

下面列出了从本地位置 1 到分支 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 1 to a VM in the branch VNet is shown here:

C:\Users\rb>tracert 10.11.30.68

Tracing route to 10.11.30.68 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.2.30.3
  2    <1 ms    <1 ms    <1 ms  192.168.30.0
  3     3 ms     2 ms     2 ms  10.11.30.68

Trace complete.

本地位置 2 的路径Path to on-premises Location 2

控制平面分析中所述,根据网络配置,本地位置 2 看不到本地位置 1。As we discuss in the control plane analysis, the on-premises Location 1 has no visibility to on-premises Location 2 per the network configuration. 以下 ping 结果确认了这一事实:The following ping results confirm:

C:\Users\rb>ping 10.1.31.10

Pinging 10.1.31.10 with 32 bytes of data:

Request timed out.
...
Request timed out.

Ping statistics for 10.1.31.10:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

远程 VNet 的路径Path to the remote VNet

下面列出了从本地位置 1 到远程 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 1 to a VM in the remote VNet is shown here:

C:\Users\rb>tracert 10.17.30.4

Tracing route to 10.17.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.2.30.3
  2     2 ms     5 ms     7 ms  192.168.30.0
  3    <1 ms    <1 ms    <1 ms  192.168.30.18
  4     *        *        *     Request timed out.
  5    69 ms    70 ms    69 ms  10.17.30.4

Trace complete.

本地位置 2 中的数据路径Data path from on-premises Location 2

中心 VNet 的路径Path to the hub VNet

下面列出了从本地位置 2 到远程 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 2 to a VM in the hub VNet is shown here:

C:\Windows\system32>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.1.31.3
  2    <1 ms    <1 ms    <1 ms  192.168.31.4
  3    <1 ms    <1 ms    <1 ms  192.168.31.22
  4     *        *        *     Request timed out.
  5    75 ms    74 ms    74 ms  10.10.30.4

Trace complete.

辐射 VNet 的路径Path to the spoke VNet

下面列出了从本地位置 2 到辐射 VNet 中的 VM 的跟踪路由输出:Traceroute output from on-premises Location 2 to a VM in the spoke VNet is shown here:

C:\Windows\system32>tracert 10.11.30.4

Tracing route to 10.11.30.4 over a maximum of 30 hops
  1    <1 ms    <1 ms     1 ms  10.1.31.3
  2    <1 ms    <1 ms    <1 ms  192.168.31.0
  3    <1 ms    <1 ms    <1 ms  192.168.31.18
  4     *        *        *     Request timed out.
  5    75 ms    74 ms    74 ms  10.11.30.4

Trace complete.

分支 VNet、本地位置 1 和远程 VNet 的路径Path to the branch VNet, on-premises Location 1, and the remote VNet

控制平面分析中所述,根据网络配置,分支 VNet、本地位置 1 或远程 VNet 看不到本地位置 1。As we discuss in the control plane analysis, the on-premises Location 1 has no visibility to the branch VNet, to on-premises Location 1, or to the remote VNet per the network configuration.

远程 VNet 中的数据路径Data path from the remote VNet

中心 VNet 的路径Path to the hub VNet

下面列出了从远程 VNet 到中心 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the remote VNet to a VM in the hub VNet is shown here:

C:\Users\rb>tracert 10.10.30.4

Tracing route to 10.10.30.4 over a maximum of 30 hops

  1    65 ms    65 ms    65 ms  10.17.30.36
  2     *        *        *     Request timed out.
  3    69 ms    68 ms    68 ms  10.10.30.4

Trace complete.

辐射 VNet 的路径Path to the spoke VNet

下面列出了从远程 VNet 到辐射 VNet 中某个 VM 的跟踪路由输出:Traceroute output from the remote VNet to a VM in the spoke VNet is shown here:

C:\Users\rb>tracert 10.11.30.4

Tracing route to 10.11.30.4 over a maximum of 30 hops

  1    67 ms    67 ms    67 ms  10.17.30.36
  2     *        *        *     Request timed out.
  3    71 ms    69 ms    69 ms  10.11.30.4

Trace complete.

分支 VNet 和本地位置 2 的路径Path to the branch VNet and on-premises Location 2

控制平面分析中所述,根据网络配置,分支 VNet 或本地位置 2 看不到远程 VNet。As we discuss in the control plane analysis, the remote VNet has no visibility to the branch VNet or to on-premises Location 2 per the network configuration.

本地位置 1 的路径Path to on-premises Location 1

下面列出了从远程 VNet 到本地位置 1 中某个 VM 的跟踪路由输出:Traceroute output from the remote VNet to a VM in on-premises Location 1 is shown here:

C:\Users\rb>tracert 10.2.30.10

Tracing route to 10.2.30.10 over a maximum of 30 hops

  1    67 ms    67 ms    67 ms  10.17.30.36
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4    69 ms    69 ms    69 ms  10.2.30.10

Trace complete.

串联 ExpressRoute 和站点到站点 VPN 连接ExpressRoute and site-to-site VPN connectivity in tandem

将站点到站点 VPN 用作 ExpressRoute 的安全故障转移路径Site-to-site VPN as a secure failover path for ExpressRoute

ExpressRoute 充当冗余的线路对,可确保高可用性。ExpressRoute serves as a redundant circuit pair to ensure high availability. 可在不同的 Azure 区域配置异地冗余的 ExpressRoute 连接。You can configure geo-redundant ExpressRoute connectivity in different Azure regions. 另外,如测试设置中所示,在 Azure 区域中,可以使用站点到站点 VPN 为 ExpressRoute 连接创建故障转移路径。Also, as demonstrated in our test setup, within an Azure region, you can use a site-to-site VPN to create a failover path for your ExpressRoute connectivity. 通过 ExpressRoute 和站点到站点 VPN 播发相同的前缀时,Azure 会优先使用 ExpressRoute。When the same prefixes are advertised over both ExpressRoute and a site-to-site VPN, Azure prioritizes ExpressRoute. 为了避免 ExpressRoute 与站点到站点 VPN 之间的非对称路由,本地网络配置同样应该优先使用 ExpressRoute 连接,然后再使用站点到站点 VPN 连接。To avoid asymmetrical routing between ExpressRoute and the site-to-site VPN, on-premises network configuration should also reciprocate by using ExpressRoute connectivity before it uses site-to-site VPN connectivity.

有关如何配置 ExpressRoute 和站点到站点 VPN 共存连接的详细信息,请参阅 ExpressRoute 和站点到站点共存For more information about how to configure coexisting connections for ExpressRoute and a site-to-site VPN, see ExpressRoute and site-to-site coexistence.

将后端连接扩展到辐射 VNet 和分支位置Extend back-end connectivity to spoke VNets and branch locations

使用 VNet 对等互连建立辐射 VNet 连接Spoke VNet connectivity by using VNet peering

中心辐射型 VNet 体系结构的使用非常广泛。Hub and spoke VNet architecture is widely used. 中心是 Azure 中的一个 VNet,充当辐射 VNet 与本地网络之间的连接中心点。The hub is a VNet in Azure that acts as a central point of connectivity between your spoke VNets and to your on-premises network. 辐射是与中心对等互连的 VNet,可用于隔离工作负荷。The spokes are VNets that peer with the hub, and which you can use to isolate workloads. 流量通过 ExpressRoute 或 VPN 连接在本地数据中心与中心之间流动。Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN connection.

在区域内的 VNet 对等互连中,辐射 VNet 可以使用中心 VPN 网关(VPN 和 ExpressRoute 网关)来与远程网络通信。In VNet peering within a region, spoke VNets can use hub VPN gateways (both VPN and ExpressRoute gateways) to communicate with remote networks.

使用站点到站点 VPN 建立分支 VNet 连接Branch VNet connectivity by using site-to-site VPN

你可能想让位于不同区域中的分支 VNet 和本地网络通过中心 VNet 相互通信。You might want branch VNets, which are in different regions, and on-premises networks to communicate with each other via a hub VNet. 此配置的本机 Azure 解决方案是使用 VPN 建立站点到站点 VPN 连接。The native Azure solution for this configuration is site-to-site VPN connectivity by using a VPN. 替代方案是对中心内部的路由使用网络虚拟设备 (NVA)。An alternative is to use a network virtual appliance (NVA) for routing in the hub.

有关详细信息,请参阅什么是 VPN 网关?For more information, see What is VPN Gateway?.

后续步骤Next steps

请参阅 ExpressRoute 常见问题解答See the ExpressRoute FAQ to:

  • 了解可将多少条 ExpressRoute 线路连接到一个 ExpressRoute 网关。Learn how many ExpressRoute circuits you can connect to an ExpressRoute gateway.
  • 了解可将多少个 ExpressRoute 网关连接到一条 ExpressRoute 线路。Learn how many ExpressRoute gateways you can connect to an ExpressRoute circuit.
  • 了解 ExpressRoute 的其他缩放限制。Learn about other scale limits of ExpressRoute.

[VNet-Config]: https://docs.azure.cn/virtual-network/virtual-network-manage-peering[VNet-Config]: https://docs.azure.cn/virtual-network/virtual-network-manage-peering