使用 Azure PowerShell 创建具有加速网络的 Windows VMCreate a Windows VM with accelerated networking using Azure PowerShell

本教程介绍如何创建具有加速网络的 Windows 虚拟机 (VM)。In this tutorial, you learn how to create a Windows virtual machine (VM) with accelerated networking.

备注

若要将加速网络用于 Linux 虚拟机,请参阅创建具有加速网络的 Linux VMTo use accelerated networking with a Linux virtual machine, see Create a Linux VM with accelerated networking.

使用加速网络可以实现对 VM 的单根 I/O 虚拟化 (SR-IOV),大幅提升其网络性能。Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its networking performance. 这种高性能路径会绕过数据路径中的主机,为受支持 VM 类型上最苛刻的网络工作负载降低延迟、抖动和 CPU 利用率。This high-performance path bypasses the host from the data path, which reduces latency, jitter, and CPU utilization for the most demanding network workloads on supported VM types. 下图说明了在使用和不使用加速网络的情况下,两个 VM 如何通信:The following diagram illustrates how two VMs communicate with and without accelerated networking:

在使用和不使用加速网络的情况下,Azure 虚拟机之间的通信

在不使用加速网络的情况下,传入和传出 VM 的所有网络流量必须遍历主机和虚拟交换机。Without accelerated networking, all networking traffic in and out of the VM must traverse the host and the virtual switch. 虚拟交换机针对网络流量实施所有策略,例如网络安全组、访问控制列表、隔离和其他网络虚拟化服务。The virtual switch provides all policy enforcement, such as network security groups, access control lists, isolation, and other network virtualized services to network traffic.

备注

若要详细了解虚拟交换机,请参阅 Hyper-V 虚拟交换机To learn more about virtual switches, see Hyper-V Virtual Switch.

在使用加速网络的情况下,网络流量将抵达 VM 的网络接口 (NIC),然后转发到 VM。With accelerated networking, network traffic arrives at the VM's network interface (NIC) and is then forwarded to the VM. 由虚拟交换机应用的所有网络策略现在都会卸载,并在硬件中应用。All network policies that the virtual switch applies are now offloaded and applied in hardware. 由于在硬件中应用策略,NIC 可以将网络流量直接转发到 VM。Because policy is applied in hardware, the NIC can forward network traffic directly to the VM. NIC 会绕过主机和虚拟交换机,同时维护主机中应用的所有策略。The NIC bypasses the host and the virtual switch, while it maintains all the policy it applied in the host.

加速网络的优势仅适用于已启用该功能的 VM。The benefits of accelerated networking only apply to the VM that it's enabled on. 为获得最佳效果,请在连接到同一个 Azure 虚拟网络的至少两个 VM 上启用此功能。For the best results, enable this feature on at least two VMs connected to the same Azure virtual network. 跨虚拟网络通信或者在本地连接时,此功能对总体延迟的影响极小。When communicating across virtual networks or connecting on-premises, this feature has minimal impact to overall latency.

优点Benefits

  • 降低延迟/提高每秒数据包数 (pps) :消除数据路径中的虚拟交换机可以减少数据包在主机中进行策略处理花费的时间。Lower Latency / Higher packets per second (pps): Eliminating the virtual switch from the data path removes the time packets spend in the host for policy processing. 还会增加 VM 中可处理的数据包数。It also increases the number of packets that can be processed inside the VM.

  • 减少波动:虚拟交换机处理取决于需要应用的策略数量。Reduced jitter: Virtual switch processing depends on the amount of policy that needs to be applied. 还取决于执行处理的 CPU 工作负载。It also depends on the workload of the CPU that's doing the processing. 将策略实施卸载到硬件,可将数据包直接传送到 VM,从而消除这种可变性。Offloading the policy enforcement to the hardware removes that variability by delivering packets directly to the VM. 卸载还会消除主机到 VM 的通信、所有软件中断和所有上下文切换。Offloading also removes the host-to-VM communication, all software interrupts, and all context switches.

  • 降低 CPU 利用率:绕过主机中的虚拟交换机可以减少用于处理流量的 CPU 资源。Decreased CPU utilization: Bypassing the virtual switch in the host leads to less CPU utilization for processing network traffic.

支持的操作系统Supported operating systems

由 Azure 库直接支持以下发行版:The following distributions are supported directly from the Azure Gallery:

  • Windows Server 2019 DatacenterWindows Server 2019 Datacenter
  • Windows Server 2016 DatacenterWindows Server 2016 Datacenter
  • Windows Server 2012 R2 DatacenterWindows Server 2012 R2 Datacenter

限制和约束Limitations and constraints

支持的 VM 实例Supported VM instances

大多数常规用途实例以及具有两个或更多虚拟 CPU (vCPU) 的计算优化实例都支持加速网络。Accelerated networking is supported on most general purpose and compute-optimized instance sizes with two or more virtual CPUs (vCPUs). 这些受支持的系列包括:Dv2/DSv2 和 F/Fs。These supported series are: Dv2/DSv2 and F/Fs.

在支持超线程的实例上,具有四个或更多个 vCPU 的 VM 实例支持加速网络。On instances that support hyperthreading, accelerated networking is supported on VM instances with four or more vCPUs. 受支持的系列包括:D/Dsv3、E/Esv3、Fsv2 和 Ms/Mms。Supported series are: D/Dsv3, E/Esv3, Fsv2, and Ms/Mms.

有关 VM 实例的详细信息,请参阅 Azure 中的 Windows 虚拟机大小For more information on VM instances, see Sizes for Windows virtual machines in Azure.

自定义映像Custom images

如果你使用的是自定义映像,并且映像支持加速网络,请确保安装了可以在 Azure 上与 Mellanox 的 ConnectX-3 和 ConnectX-4 Lx NIC 配合使用的必需驱动程序。If you're using a custom image and your image supports Accelerated Networking, be sure that you have the required drivers that work with Mellanox ConnectX-3 and ConnectX-4 Lx NICs on Azure.

区域Regions

加速网络在 Azure 中国云中可用。Accelerated networking is available in Azure China Cloud.

在正在运行的 VM 上启用加速网络Enabling accelerated networking on a running VM

未启用加速网络的受支持 VM 大小只有在停止和解除分配时才能启用该功能。A supported VM size without accelerated networking enabled can only have the feature enabled when it's stopped and deallocated.

通过 Azure 资源管理器部署Deployment through Azure Resource Manager

虚拟机(经典)无法部署加速网络。Virtual machines (classic) can't be deployed with accelerated networking.

使用门户创建 VMVM creation using the portal

尽管本文提供了使用 Azure Powershell 创建具有加速网络的 VM 的步骤,但也可以使用 Azure 门户创建启用加速网络的虚拟机Though this article provides steps to create a VM with accelerated networking using Azure PowerShell, you can also use the Azure portal to create a virtual machine that enables accelerated networking. 在门户中创建 VM 时,在“创建虚拟机”页中,选择“网络”选项卡 。此选项卡具有“加速网络”的选项。When you create a VM in the portal, in the Create a virtual machine page, choose the Networking tab. This tab has an option for Accelerated networking. 如果已选择支持的操作系统VM 大小,此选项会自动设置为“打开”。If you have chosen a supported operating system and VM size, this option is automatically set to On. 否则,该选项会设置为“关”,Azure 将显示无法启用它的原因。Otherwise, the option is set to Off, and Azure displays the reason why it can't be enabled.

备注

只有受支持的操作系统才能通过门户启用。Only supported operating systems can be enabled through the portal. 如果你使用的是自定义映像,并且该映像支持加速网络,请使用 CLI 或 PowerShell 创建 VM。If you are using a custom image, and your image supports accelerated networking, please create your VM using CLI or PowerShell.

创建 VM 后,可以确认是否已启用加速网络。After you create the VM, you can confirm whether accelerated networking is enabled. 按照以下说明操作:Follow these instructions:

  1. 转到 Azure 门户来管理 VM。Go to the Azure portal to manage your VMs. 搜索并选择“虚拟机”。Search for and select Virtual machines.

  2. 在虚拟机列表中,选择新的 VM。In the virtual machine list, choose your new VM.

  3. 在 VM 菜单栏中选择“网络”。In the VM menu bar, choose Networking.

在网络接口信息中的“加速网络”标签旁边,门户会显示加速网络状态为“已禁用”或“已启用” 。In the network interface information, next to the Accelerated networking label, the portal displays either Disabled or Enabled for the accelerated networking status.

使用 PowerShell 创建 VMVM creation using PowerShell

请先安装 Azure PowerShell 1.0.0 版或更高版本。Before you proceed, install Azure PowerShell version 1.0.0 or later. 要查找当前安装的版本,请运行 Get-Module -ListAvailable AzTo find your currently installed version, run Get-Module -ListAvailable Az. 如果需要进行安装或升级,请从 PowerShell 库安装最新版本的 Az 模块。If you need to install or upgrade, install the latest version of the Az module from the PowerShell Gallery. 在 PowerShell 会话中,使用 Connect-AzAccount -Environment AzureChinaCloud 登录到 Azure 帐户。In a PowerShell session, sign in to an Azure account using Connect-AzAccount -Environment AzureChinaCloud.

在以下示例中,请将示例参数名称替换成自己的值。In the following examples, replace example parameter names with your own values. 参数名称示例包括 myResourceGroup、myNic 和 myVM。 Example parameter names included myResourceGroup, myNic, and myVM.

创建虚拟网络Create a virtual network

  1. 使用 New-AzResourceGroup 创建资源组。Create a resource group with New-AzResourceGroup. 以下命令在 chinaeast 位置创建名为 myResourceGroup 的资源组 :The following command creates a resource group named myResourceGroup in the chinaeast location:

    New-AzResourceGroup -Name "myResourceGroup" -Location "chinaeast"
    
  2. 使用 New-AzVirtualNetworkSubnetConfig 创建子网配置。Create a subnet configuration with New-AzVirtualNetworkSubnetConfig. 以下命令创建名为 mySubnet 的子网:The following command creates a subnet named mySubnet:

    $subnet = New-AzVirtualNetworkSubnetConfig `
        -Name "mySubnet" `
        -AddressPrefix "192.168.1.0/24"
    
  3. 使用 New-AzVirtualNetwork 创建带 mySubnet 子网的虚拟网络。Create a virtual network with New-AzVirtualNetwork, with the mySubnet subnet.

    $vnet = New-AzVirtualNetwork -ResourceGroupName "myResourceGroup" `
        -Location "chinaeast" `
        -Name "myVnet" `
        -AddressPrefix "192.168.0.0/16" `
        -Subnet $Subnet
    

创建网络安全组Create a network security group

  1. 使用 New-AzNetworkSecurityRuleConfig 创建网络安全组规则。Create a network security group rule with New-AzNetworkSecurityRuleConfig.

    $rdp = New-AzNetworkSecurityRuleConfig `
        -Name 'Allow-RDP-All' `
        -Description 'Allow RDP' `
        -Access Allow `
        -Protocol Tcp `
        -Direction Inbound `
        -Priority 100 `
        -SourceAddressPrefix * `
        -SourcePortRange * `
        -DestinationAddressPrefix * `
        -DestinationPortRange 3389
    
  2. 使用 New-AzNetworkSecurityGroup 创建网络安全组,并向其分配 Allow-RDP-All 安全规则。Create a network security group with New-AzNetworkSecurityGroup and assign the Allow-RDP-All security rule to it. 除 Allow-RDP-All 规则外,该网络安全组还包含多个默认规则。Aside from the Allow-RDP-All rule, the network security group contains several default rules. 某个默认规则禁用来自 Internet 的所有入站访问。One default rule disables all inbound access from the internet. 创建后,Allow-RDP-All 规则分配给网络安全组,以便可以远程连接到 VM。Once it's created, the Allow-RDP-All rule is assigned to the network security group so that you can remotely connect to the VM.

    $nsg = New-AzNetworkSecurityGroup `
        -ResourceGroupName myResourceGroup `
        -Location chinaeast `
        -Name "myNsg" `
        -SecurityRules $rdp
    
  3. 使用 Set-AzVirtualNetworkSubnetConfig 将网络安全组关联到 mySubnet 子网。Associate the network security group to the mySubnet subnet with Set-AzVirtualNetworkSubnetConfig. 网络安全组中的规则对子网中部署的所有资源都是有效的。The rule in the network security group is effective for all resources deployed in the subnet.

    Set-AzVirtualNetworkSubnetConfig `
        -VirtualNetwork $vnet `
        -Name 'mySubnet' `
        -AddressPrefix "192.168.1.0/24" `
        -NetworkSecurityGroup $nsg
    

创建具有加速网络的网络接口Create a network interface with accelerated networking

  1. 使用 New-AzPublicIpAddress 创建一个公共 IP 地址。Create a public IP address with New-AzPublicIpAddress. 如果不打算从 Internet 访问 VM,则不需要公共 IP 地址。A public IP address is unnecessary if you don't plan to access the VM from the internet. 但是需要完成本文中的步骤。However, it's required to complete the steps in this article.

    $publicIp = New-AzPublicIpAddress `
        -ResourceGroupName myResourceGroup `
        -Name 'myPublicIp' `
        -location chinaeast `
        -AllocationMethod Dynamic
    
  2. 使用 New-AzNetworkInterface 创建启用了加速网络的网络接口,并将公共 IP 地址分配给该网络接口。Create a network interface with New-AzNetworkInterface with accelerated networking enabled, and assign the public IP address to the network interface. 下面的示例在 myVnet 虚拟网络的 mySubnet 子网中创建名为 myNic 的网络接口,向其分配 myPublicIp 公共 IP 地址 :The following example creates a network interface named myNic in the mySubnet subnet of the myVnet virtual network, assigning the myPublicIp public IP address to it:

    $nic = New-AzNetworkInterface `
        -ResourceGroupName "myResourceGroup" `
        -Name "myNic" `
        -Location "chinaeast" `
        -SubnetId $vnet.Subnets[0].Id `
        -PublicIpAddressId $publicIp.Id `
        -EnableAcceleratedNetworking
    

创建 VM 并附加网络接口Create a VM and attach the network interface

  1. 使用 Get-Credential 将 VM 凭据设置为 $cred 变量,这样会提示你登录:Set your VM credentials to the $cred variable using Get-Credential, which prompts you to sign in:

    $cred = Get-Credential
    
  2. 通过 New-AzVMConfig 定义你的 VM。Define your VM with New-AzVMConfig. 以下命令定义名为 myVM 的 VM,其大小支持加速网络 (Standard_DS4_v2) :The following command defines a VM named myVM with a VM size that supports accelerated networking (Standard_DS4_v2):

    $vmConfig = New-AzVMConfig -VMName "myVm" -VMSize "Standard_DS4_v2"
    

    若要获取所有 VM 大小和特性列表,请参阅 Windows VM 大小For a list of all VM sizes and characteristics, see Windows VM sizes.

  3. 通过 Set-AzVMOperatingSystemSet-AzVMSourceImage 创建 VM 配置的其余部分。Create the rest of your VM configuration with Set-AzVMOperatingSystem and Set-AzVMSourceImage. 以下命令创建 Windows Server 2016 Datacenter:The following command creates a Windows Server 2016 Datacenter:

    $vmConfig = Set-AzVMOperatingSystem -VM $vmConfig `
        -Windows `
        -ComputerName "myVM" `
        -Credential $cred `
        -ProvisionVMAgent `
        -EnableAutoUpdate
    $vmConfig = Set-AzVMSourceImage -VM $vmConfig `
        -PublisherName "MicrosoftWindowsServer" `
        -Offer "WindowsServer" `
        -Skus "2016-Datacenter" `
        -Version "latest"
    
  4. 使用 Add-AzVMNetworkInterface 附加之前创建的网络接口:Attach the network interface that you previously created with Add-AzVMNetworkInterface:

    $vmConfig = Add-AzVMNetworkInterface -VM $vmConfig -Id $nic.Id
    
  5. 使用 New-AzVM 创建 VM。Create your VM with New-AzVM.

    New-AzVM -VM $vmConfig -ResourceGroupName "myResourceGroup" -Location "chinaeast"
    

确认 Windows VM 中已安装以太网控制器Confirm the Ethernet controller is installed in the Windows VM

在 Azure 中创建 VM 后,立即连接到 VM 并确认 Windows 中安装了以太网控制器。Once you create the VM in Azure, connect to the VM and confirm that the Ethernet controller is installed in Windows.

  1. 转到 Azure 门户来管理 VM。Go to the Azure portal to manage your VMs. 搜索并选择“虚拟机”。Search for and select Virtual machines.

  2. 在虚拟机列表中,选择新的 VM。In the virtual machine list, choose your new VM.

  3. 在 VM 概述页中,如果 VM 的“状态”列为“正在创建”,请等到 Azure 完成 VM 创建 。In the VM overview page, if the Status of the VM is listed as Creating, wait until Azure finishes creating the VM. VM 创建完成后,“状态”将更改为“正在运行” 。The Status will be changed to Running after VM creation is complete.

  4. 在 VM 概述工具栏中,选择“连接” > “RDP” > “下载 RDP 文件” 。From the VM overview toolbar, select Connect > RDP > Download RDP File.

  5. 打开 .rdp 文件,然后使用在创建 VM 并附加网络接口部分中输入的凭据登录到 VM。Open the .rdp file, and then sign in to the VM with the credentials you entered in the Create a VM and attach the network interface section. 如果从未连接到 Azure 中的 Windows VM,请参阅连接到虚拟机If you've never connected to a Windows VM in Azure, see Connect to virtual machine.

  6. 显示 VM 的远程桌面会话后,右键单击 Windows“开始”按钮,然后选择“设备管理器”。After the remote desktop session for your VM appears, right-click the Windows Start button and choose Device Manager.

  7. 在“设备管理器”窗口中,展开“网络适配器”节点 。In the Device Manager window, expand the Network adapters node.

  8. 确认已显示“Mellanox ConnectX-3 虚函数以太网适配器”,如下图所示:Confirm that the Mellanox ConnectX-3 Virtual Function Ethernet Adapter appears, as shown in the following image:

    Mellanox ConnectX-3 虚函数以太网适配器,适用于加速网络的新网络适配器,设备管理器

现在已为 VM 启用加速网络。Accelerated networking is now enabled for your VM.

备注

如果 Mellanox 适配器启动失败,请在远程桌面会话中打开管理员提示符,然后输入以下命令:If the Mellanox adapter fails to start, open an administrator prompt in the remote desktop session and enter the following command:

netsh int tcp set global rss = enabled

在现有 VM 上启用加速网络Enable accelerated networking on existing VMs

如果创建的 VM 没有加速网络,则可在现有 VM 上启用此功能。If you've created a VM without accelerated networking, you may enable this feature on an existing VM. VM 必须支持加速网络,前提是满足以下先决条件(上文亦有列出):The VM must support accelerated networking by meeting the following prerequisites, which are also outlined above:

  • VM 必须是加速网络支持的大小。The VM must be a supported size for accelerated networking.
  • VM 必须是受支持的 Azure 库映像(以及适用于 Linux 的内核版本)。The VM must be a supported Azure Gallery image (and kernel version for Linux).
  • 在任何 NIC 上启用加速网络前,必须停止或解除分配可用性集或虚拟机规模集中的所有 VM。All VMs in an availability set or a virtual machine scale set must be stopped or deallocated before you enable accelerated networking on any NIC.

单个 VM 与可用性集中的 VMIndividual VMs and VMs in an availability set

  1. 停止或解除分配 VM,或集合中的所有 VM(如果是可用性集):Stop or deallocate the VM or, if an availability set, all the VMs in the set:

    Stop-AzVM -ResourceGroup "myResourceGroup" -Name "myVM"
    

    备注

    单独创建 VM 而没有可用性集时,只需停止或解除分配单个 VM 即可启用加速网络。When you create a VM individually, without an availability set, you only need to stop or deallocate the individual VM to enable accelerated networking. 如果 VM 是使用可用性集创建的,则在任何 NIC 上启用加速网络之前,必须停止或解除分配可用性集中包含的所有 VM,以便 VM 最终位于支持加速网络的群集上。If your VM was created with an availability set, you must stop or deallocate all VMs contained in the availability set before enabling accelerated networking on any of the NICs, so that the VMs end up on a cluster that supports accelerated networking. 如果禁用加速网络,则无需停止或解除分配要求,因为支持加速网络的群集也可与不使用加速网络的 NIC 一起正常工作。The stop or deallocate requirement is unnecessary if you disable accelerated networking, because clusters that support accelerated networking also work fine with NICs that don't use accelerated networking.

  2. 在 VM 的 NIC 上启用加速网络:Enable accelerated networking on the NIC of your VM:

    $nic = Get-AzNetworkInterface -ResourceGroupName "myResourceGroup" `
        -Name "myNic"
    
    $nic.EnableAcceleratedNetworking = $true
    
    $nic | Set-AzNetworkInterface
    
  3. 重启 VM(如果在可用性集中,则重启其中的所有 VM),并确认已启用加速网络:Restart your VM or, if in an availability set, all the VMs in the set, and confirm that accelerated networking is enabled:

    Start-AzVM -ResourceGroup "myResourceGroup" `
        -Name "myVM"
    

虚拟机规模集Virtual machine scale set

虚拟机规模集略有不同,但它遵循相同的工作流。A virtual machine scale set is slightly different, but it follows the same workflow.

  1. 停止 VM:Stop the VMs:

    Stop-AzVmss -ResourceGroupName "myResourceGroup" `
        -VMScaleSetName "myScaleSet"
    
  2. 更新网络接口下的加速网络属性:Update the accelerated networking property under the network interface:

    $vmss = Get-AzVmss -ResourceGroupName "myResourceGroup" `
        -VMScaleSetName "myScaleSet"
    
    $vmss.VirtualMachineProfile.NetworkProfile.NetworkInterfaceConfigurations[0].EnableAcceleratedNetworking = $true
    
    Update-AzVmss -ResourceGroupName "myResourceGroup" `
        -VMScaleSetName "myScaleSet" `
        -VirtualMachineScaleSet $vmss
    
  3. 将应用的更新设置为自动,以便立即应用更改:Set the applied updates to automatic so that the changes are immediately picked up:

    $vmss.UpgradePolicy.Mode = "Automatic"
    
    Update-AzVmss -ResourceGroupName "myResourceGroup" `
        -VMScaleSetName "myScaleSet" `
        -VirtualMachineScaleSet $vmss
    

    备注

    规模集具有 VM 升级功能,可使用三种不同的设置(自动、滚动和手动)应用更新。A scale set has VM upgrades that apply updates using three different settings: automatic, rolling, and manual. 在这些说明中,策略设置为自动,因此规模集会在重启后立即应用更改。In these instructions, the policy is set to automatic, so the scale set picks up the changes immediately after it restarts.

  4. 重启规模集:Restart the scale set:

    Start-AzVmss -ResourceGroupName "myResourceGroup" `
        -VMScaleSetName "myScaleSet"
    

重启后,请等待升级完成。Once you restart, wait for the upgrades to finish. 升级完成后,虚函数 (VF) 会显示在 VM 内。After the upgrades are done, the virtual function (VF) appears inside the VM. 确保使用的是支持的 OS 和 VM 大小。Make sure you're using a supported OS and VM size.

调整具有加速网络的现有 VM 的大小Resizing existing VMs with accelerated networking

如果 VM 启用了加速网络,则只能将其调整为支持加速网络的 VM 大小。If a VM has accelerated networking enabled, you're only able to resize it to a VM that supports accelerated networking.

启用加速网络的 VM 不能使用调整大小操作调整为不支持加速网络的 VM 实例的大小。A VM with accelerated networking enabled can't be resized to a VM instance that doesn't support accelerated networking using the resize operation. 相反,若要调整其中一个 VM 的大小,请执行以下操作:Instead, to resize one of these VMs:

  1. 停止或解除分配 VM。Stop or deallocate the VM. 对于可用性集或规模集,停止或解除分配可用性集或规模集中的所有 VM。For an availability set or scale set, stop or deallocate all the VMs in the availability set or scale set.

  2. 在 VM 的 NIC 上禁用加速网络。Disable accelerated networking on the NIC of the VM. 对于可用性集或规模集,请在可用性集或规模集中的所有 VM 的 NIC 上禁用加速网络。For an availability set or scale set, disable accelerated networking on the NICs of all VMs in the availability set or scale set.

  3. 禁用加速网络后,将 VM、可用性集或规模集移至不支持加速网络的新大小,然后重启。After you disable accelerated networking, move the VM, availability set, or scale set to a new size that doesn't support accelerated networking, and then restart them.