Azure 中的互操作性:测试设置Interoperability in Azure : Test setup

本文介绍可用于分析 Azure 网络服务如何在控制平面级别和数据平面级别进行互操作的测试设置。This article describes a test setup you can use to analyze how Azure networking services interoperate at the control plane level and data plane level. 下面是 Azure 网络组件的概观:Let's look briefly at the Azure networking components:

  • Azure ExpressRoute:使用 Azure ExpressRoute 中的专用对等互连将本地网络中的专用 IP 空间直接连接到 Azure 虚拟网络部署。Azure ExpressRoute: Use private peering in Azure ExpressRoute to directly connect private IP spaces in your on-premises network to your Azure Virtual Network deployments. ExpressRoute 有助于实现更高的带宽和专用连接。ExpressRoute can help you achieve higher bandwidth and a private connection. 许多 ExpressRoute 生态合作伙伴提供 ExpressRoute 连接并以 SLA 作为保障。Many ExpressRoute eco partners offer ExpressRoute connectivity with SLAs. 若要详细了解 ExpressRoute 及其配置方式,请参阅 ExpressRoute 简介To learn more about ExpressRoute and to learn how to configure ExpressRoute, see Introduction to ExpressRoute.
  • 站点到站点 VPN:可以使用 Azure VPN 网关作为站点到站点 VPN,通过 Internet 或 ExpressRoute 将本地网络安全连接到 Azure。Site-to-site VPN: You can use Azure VPN Gateway as a site-to-site VPN to securely connect an on-premises network to Azure over the internet or by using ExpressRoute. 若要了解如何配置站点到站点 VPN 以连接到 Azure,请参阅配置 VPN 网关To learn how to configure a site-to-site VPN to connect to Azure, see Configure VPN Gateway.
  • VNet 对等互连:使用虚拟网络 (VNet) 对等互连在 Azure 虚拟网络中的 VNet 之间建立连接。VNet peering: Use virtual network (VNet) peering to establish connectivity between VNets in Azure Virtual Network. 若要详细了解 VNet 对等互连,请参阅有关 VNet 对等互连的教程To learn more about VNet peering, see the tutorial on VNet peering.

测试设置Test setup

下图演示了测试设置:The following figure illustrates the test setup:

11

测试设置的中心部分是 Azure 区域 1 中的中心 VNet。The centerpiece of the test setup is the hub VNet in Azure Region 1. 中心 VNet 按以下方式连接到不同的网络:The hub VNet is connected to different networks in the following ways:

  • 中心 VNet 使用 VNet 对等互连连接到辐射 VNet。The hub VNet is connected to the spoke VNet by using VNet peering. 辐射 VNet 可远程访问中心 VNet 中的两个网关。The spoke VNet has remote access to both gateways in the hub VNet.
  • 中心 VNet 使用站点到站点 VPN 连接到分支 VNet。The hub VNet is connected to the branch VNet by using site-to-site VPN. 该连接使用 eBGP 来交换路由。The connectivity uses eBGP to exchange routes.
  • 中心 VNet 使用 ExpressRoute 专用对等互连作为主要路径连接到本地位置 1 网络。The hub VNet is connected to the on-premises Location 1 network by using ExpressRoute private peering as the primary path. 它使用站点到站点 VPN 连接作为备用路径。It uses site-to-site VPN connectivity as the backup path. 在本文的余下部分,此 ExpressRoute 线路称作 ExpressRoute 1。In the rest of this article, we refer to this ExpressRoute circuit as ExpressRoute 1. 默认情况下,ExpressRoute 线路提供冗余连接以实现高可用性。By default, ExpressRoute circuits provide redundant connectivity for high availability. ExpressRoute 1 上已禁用面向辅助 Microsoft 企业边缘路由器 (MSEE) 的辅助客户边缘 (CE) 路由器子接口。On ExpressRoute 1, the secondary customer edge (CE) router's subinterface that faces the secondary Microsoft Enterprise Edge Router (MSEE) is disabled. 在上图中,双线箭头上面的红线表示禁用了 CE 路由器子接口。A red line over the double-line arrow in the preceding figure represents the disabled CE router subinterface.
  • 中心 VNet 使用另一个 ExpressRoute 专用对等互连连接到本地位置 2 网络。The hub VNet is connected to the on-premises Location 2 network by using another ExpressRoute private peering. 在本文的余下部分,这第二条 ExpressRoute 线路称作 ExpressRoute 2。In the rest of this article, we refer to this second ExpressRoute circuit as ExpressRoute 2.
  • ExpressRoute 1 也将中心 VNet 和本地位置 1 网络连接到 Azure 区域 2 中的远程 VNet。ExpressRoute 1 also connects both the hub VNet and the on-premises Location 1 network to a remote VNet in Azure Region 2.

串联 ExpressRoute 和站点到站点 VPN 连接ExpressRoute and site-to-site VPN connectivity in tandem

将站点到站点 VPN 用作 ExpressRoute 的安全故障转移路径Site-to-site VPN as a secure failover path for ExpressRoute

ExpressRoute 充当冗余的线路对,可确保高可用性。ExpressRoute serves as a redundant circuit pair to ensure high availability. 可在不同的 Azure 区域配置异地冗余的 ExpressRoute 连接。You can configure geo-redundant ExpressRoute connectivity in different Azure regions. 另外,如测试设置中所示,在 Azure 区域中,可以使用站点到站点 VPN 为 ExpressRoute 连接创建故障转移路径。Also, as demonstrated in our test setup, within an Azure region, you can use a site-to-site VPN to create a failover path for your ExpressRoute connectivity. 通过 ExpressRoute 和站点到站点 VPN 播发相同的前缀时,Azure 会优先使用 ExpressRoute。When the same prefixes are advertised over both ExpressRoute and a site-to-site VPN, Azure prioritizes ExpressRoute. 为了避免 ExpressRoute 与站点到站点 VPN 之间的非对称路由,本地网络配置同样应该优先使用 ExpressRoute 连接,然后再使用站点到站点 VPN 连接。To avoid asymmetrical routing between ExpressRoute and the site-to-site VPN, on-premises network configuration should also reciprocate by using ExpressRoute connectivity before it uses site-to-site VPN connectivity.

有关如何配置 ExpressRoute 和站点到站点 VPN 共存连接的详细信息,请参阅 ExpressRoute 和站点到站点共存For more information about how to configure coexisting connections for ExpressRoute and a site-to-site VPN, see ExpressRoute and site-to-site coexistence.

将后端连接扩展到辐射 VNet 和分支位置Extend back-end connectivity to spoke VNets and branch locations

使用 VNet 对等互连建立辐射 VNet 连接Spoke VNet connectivity by using VNet peering

中心辐射型 VNet 体系结构的使用非常广泛。Hub and spoke VNet architecture is widely used. 中心是 Azure 中的一个 VNet,充当辐射 VNet 与本地网络之间的连接中心点。The hub is a VNet in Azure that acts as a central point of connectivity between your spoke VNets and to your on-premises network. 辐射是与中心对等互连的 VNet,可用于隔离工作负荷。The spokes are VNets that peer with the hub, and which you can use to isolate workloads. 流量通过 ExpressRoute 或 VPN 连接在本地数据中心与中心之间流动。Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN connection.

在区域内的 VNet 对等互连中,辐射 VNet 可以使用中心 VPN 网关(VPN 和 ExpressRoute 网关)来与远程网络通信。In VNet peering within a region, spoke VNets can use hub VPN gateways (both VPN and ExpressRoute gateways) to communicate with remote networks.

使用站点到站点 VPN 建立分支 VNet 连接Branch VNet connectivity by using site-to-site VPN

你可能想让位于不同区域中的分支 VNet 和本地网络通过中心 VNet 相互通信。You might want branch VNets, which are in different regions, and on-premises networks to communicate with each other via a hub VNet. 此配置的本机 Azure 解决方案是使用 VPN 建立站点到站点 VPN 连接。The native Azure solution for this configuration is site-to-site VPN connectivity by using a VPN. 替代方案是对中心内部的路由使用网络虚拟设备 (NVA)。An alternative is to use a network virtual appliance (NVA) for routing in the hub.

有关详细信息,请参阅什么是 VPN 网关?For more information, see What is VPN Gateway?.

后续步骤Next steps

了解测试拓扑的配置详细信息Learn about configuration details for the test topology.

了解测试设置的控制平面分析,以及拓扑中不同 VNet 或 VLAN 的视图。Learn about control plane analysis of the test setup and the views of different VNets or VLANs in the topology.

了解测试设置的数据平面分析,以及 Azure 网络监视功能视图。Learn about the data plane analysis of the test setup and Azure network monitoring feature views.

请参阅 ExpressRoute 常见问题解答See the ExpressRoute FAQ to:

  • 了解可将多少条 ExpressRoute 线路连接到一个 ExpressRoute 网关。Learn how many ExpressRoute circuits you can connect to an ExpressRoute gateway.
  • 了解可将多少个 ExpressRoute 网关连接到一条 ExpressRoute 线路。Learn how many ExpressRoute gateways you can connect to an ExpressRoute circuit.
  • 了解 ExpressRoute 的其他缩放限制。Learn about other scale limits of ExpressRoute.