使用 Azure PowerShell 创建具有加速网络的 Windows 虚拟机Create a Windows virtual machine with Accelerated Networking using Azure PowerShell

本教程介绍如何创建具有加速网络的 Windows 虚拟机 (VM)。In this tutorial, you learn how to create a Windows virtual machine (VM) with Accelerated Networking. 若要使用加速网络创建 Linux VM,请参阅使用加速网络创建 Linux VMTo create a Linux VM with Accelerated Networking, see Create a Linux VM with Accelerated Networking. 使用加速网络可以实现对 VM 的单根 I/O 虚拟化 (SR-IOV),大幅提升其网络性能。Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its networking performance. 这种高性能路径会绕过数据路径中的主机,降低延迟、抖动,以及受支持 VM 类型上的最苛刻网络工作负荷的 CPU 利用率。This high-performance path bypasses the host from the datapath, reducing latency, jitter, and CPU utilization, for use with the most demanding network workloads on supported VM types. 下图显示了具有和没有加速网络的两个 VM 之间的通信:The following picture shows communication between two VMs with and without accelerated networking:

比较

在不使用加速网络的情况下,传入和传出 VM 的所有网络流量必须遍历主机和虚拟交换机。Without accelerated networking, all networking traffic in and out of the VM must traverse the host and the virtual switch. 虚拟交换机针对网络流量实施所有策略,例如网络安全组、访问控制列表、隔离和其他网络虚拟化服务。The virtual switch provides all policy enforcement, such as network security groups, access control lists, isolation, and other network virtualized services to network traffic. 若要详细了解虚拟交换机,请参阅 Hyper-V 网络虚拟化和虚拟交换机To learn more about virtual switches, see Hyper-V network virtualization and virtual switch.

在使用加速网络的情况下,网络流量将抵达 VM 的网络接口 (NIC),然后转发到 VM。With accelerated networking, network traffic arrives at the VM's network interface (NIC), and is then forwarded to the VM. 由虚拟交换机应用的所有网络策略现在都会卸载,并在硬件中应用。All network policies that the virtual switch applies are now offloaded and applied in hardware. 由于在硬件中应用策略,NIC 可以绕过主机和虚拟交换机将网络流量直接转发到 VM,同时保留它在主机中应用的所有策略。Applying policy in hardware enables the NIC to forward network traffic directly to the VM, bypassing the host and the virtual switch, while maintaining all the policy it applied in the host.

加速网络的优势仅适用于已启用该功能的 VM。The benefits of accelerated networking only apply to the VM that it is enabled on. 为获得最佳效果,最好是在连接到同一个 Azure 虚拟网络 (VNet) 的最少两个 VM 上启用此功能。For the best results, it is ideal to enable this feature on at least two VMs connected to the same Azure Virtual Network (VNet). 跨 VNet 通信或者在本地连接时,此功能对总体延迟的影响极小。When communicating across VNets or connecting on-premises, this feature has minimal impact to overall latency.

优点Benefits

  • 更低的延迟/更高的每秒数据包数 (pps): 从数据路径中去除虚拟交换机可以消除数据包在主机中进行策略处理所花费的时间,同时增大了 VM 中可处理的数据包数。Lower Latency / Higher packets per second (pps): Removing the virtual switch from the datapath removes the time packets spend in the host for policy processing and increases the number of packets that can be processed inside the VM.
  • 减少抖动: 虚拟交换机处理取决于需要应用的策略数量,以及正在执行处理的 CPU 工作负荷。Reduced jitter: Virtual switch processing depends on the amount of policy that needs to be applied and the workload of the CPU that is doing the processing. 将策略实施卸载到硬件消除了这种可变性,因为可以将数据包直接传送到 VM,省去了主机与 VM 之间的通信,以及所有的软件中断和上下文切换。Offloading the policy enforcement to the hardware removes that variability by delivering packets directly to the VM, removing the host to VM communication and all software interrupts and context switches.
  • 降低了 CPU 利用率: 绕过主机中的虚拟交换机可以减少用于处理流量的 CPU 资源。Decreased CPU utilization: Bypassing the virtual switch in the host leads to less CPU utilization for processing network traffic.

限制和约束Limitations and Constraints

支持的操作系统Supported operating systems

从 Azure 库即可支持以下分发:The following distributions are supported out of the box from the Azure Gallery:

  • Windows Server 2016 DatacenterWindows Server 2016 Datacenter
  • Windows Server 2012 R2 DatacenterWindows Server 2012 R2 Datacenter
  • Windows Server 2019 DatacenterWindows Server 2019 Datacenter

支持的 VM 实例Supported VM instances

大多数常规用途实例以及具有 2 个或更多 vCPU 的计算优化实例都支持加速网络。Accelerated Networking is supported on most general purpose and compute-optimized instance sizes with 2 or more vCPUs. 这些受支持的系列包括:D/DSv2 和 F/FsThese supported series are: D/DSv2 and F/Fs

在支持超线程的实例上,具有 4 个或更多 vCPU 的 VM 实例支持加速网络。On instances that support hyperthreading, Accelerated Networking is supported on VM instances with 4 or more vCPUs. 受支持的系列包括:D/Dsv3、E/Esv3、Fsv2、Ms/Mms 和 Ms/Mmsv2。Supported series are: D/Dsv3, E/Esv3, Fsv2, Ms/Mms and Ms/Mmsv2.

有关 VM 实例的详细信息,请参阅Windows VM 大小For more information on VM instances, see Windows VM sizes.

区域Regions

在所有公共 Azure 区域和 Azure 中国云中均可用。Available in all public Azure regions and Azure China Cloud Cloud.

在正在运行的 VM 上启用加速网络Enabling Accelerated Networking on a running VM

未启用加速网络的受支持 VM 大小只有在停止和解除分配时才能启用该功能。A supported VM size without accelerated networking enabled can only have the feature enabled when it is stopped and deallocated.

通过 Azure 资源管理器部署Deployment through Azure Resource Manager

虚拟机(经典)无法部署加速网络。Virtual machines (classic) cannot be deployed with Accelerated Networking.

创建具有 Azure 加速网络的 Windows VMCreate a Windows VM with Azure Accelerated Networking

在门户中创建Portal creation

尽管本文提供了使用 Azure Powershell 创建具有加速网络的虚拟机的步骤,但也可以使用 Azure 门户创建具有加速网络的虚拟机Though this article provides steps to create a virtual machine with accelerated networking using Azure Powershell, you can also create a virtual machine with accelerated networking using the Azure portal. 在门户中创建虚拟机时,在 “创建虚拟机”边栏选项卡中,选择“网络” 选项卡。在此选项卡中,有“加速网络” 的选项。When creating a virtual machine in the portal, in the Create a virtual machine blade, choose the Networking tab. In this tab, there is an option for Accelerated networking. 如果已选择支持的操作系统VM 大小,此选项将自动填充为“打开”。If you have chosen a supported operating system and VM size, this option will automatically populate to "On." 如果没有选择,它将填充加速网络的“关闭”选项,并为用户提供未启用它的原因。If not, it will populate the "Off" option for Accelerated Networking and give the user a reason why it is not be enabled.

  • 注意: 只有受支持的操作系统才能通过门户启用。Note: Only supported operating systems can be enabled through the portal. 如果使用的是自定义映像,并且映像支持加速网络,请使用 CLI 或 Powershell 创建 VM。If you are using a custom image, and your image supports Accelerated Networking, please create your VM using CLI or Powershell.

创建虚拟机后,可以按照“确认已启用加速网络”中的说明确认已启用加速网络。After the virtual machine is created, you can confirm Accelerated Networking is enabled by following the instructions in the Confirm that accelerated networking is enabled.

Powershell 创建Powershell creation

创建虚拟网络Create a virtual network

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

安装 Azure PowerShell 1.0.0 版或更高版本。Install Azure PowerShell version 1.0.0 or later. 要查找当前安装的版本,请运行 Get-Module -ListAvailable AzTo find your currently installed version, run Get-Module -ListAvailable Az. 如果需要进行安装或升级,请从 PowerShell 库安装最新版本的 Az 模块。If you need to install or upgrade, install the latest version of the Az module from the PowerShell Gallery. 在 PowerShell 会话中,使用 Connect-AzAccount -Environment AzureChinaCloud 登录到 Azure 帐户。In a PowerShell session, log in to an Azure account using Connect-AzAccount -Environment AzureChinaCloud.

在以下示例中,请将示例参数名称替换成自己的值。In the following examples, replace example parameter names with your own values. 参数名称示例包括 myResourceGroup、myNic 和 myVM。 Example parameter names included myResourceGroup, myNic, and myVM.

使用 New-AzResourceGroup 创建资源组。Create a resource group with New-AzResourceGroup. 以下示例在“chinaeast” 位置创建名为“myResourceGroup” 的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

New-AzResourceGroup -Name "myResourceGroup" -Location "chinaeast"

首先,使用 New-AzVirtualNetworkSubnetConfig 创建子网配置。First, create a subnet configuration with New-AzVirtualNetworkSubnetConfig. 以下示例创建名为 mySubnet 的子网:The following example creates a subnet named mySubnet:

$subnet = New-AzVirtualNetworkSubnetConfig `
    -Name "mySubnet" `
    -AddressPrefix "192.168.1.0/24"

使用 New-AzVirtualNetwork 创建带 mySubnet 子网的虚拟网络。Create a virtual network with New-AzVirtualNetwork, with the mySubnet subnet.

$vnet = New-AzVirtualNetwork -ResourceGroupName "myResourceGroup" `
    -Location "chinaeast" `
    -Name "myVnet" `
    -AddressPrefix "192.168.0.0/16" `
    -Subnet $Subnet

创建网络安全组Create a network security group

首先,使用 New-AzNetworkSecurityRuleConfig 创建网络安全组规则。First, create a network security group rule with New-AzNetworkSecurityRuleConfig.

$rdp = New-AzNetworkSecurityRuleConfig `
    -Name 'Allow-RDP-All' `
    -Description 'Allow RDP' `
    -Access Allow `
    -Protocol Tcp `
    -Direction Inbound `
    -Priority 100 `
    -SourceAddressPrefix * `
    -SourcePortRange * `
    -DestinationAddressPrefix * `
    -DestinationPortRange 3389

使用 New-AzNetworkSecurityGroup 创建网络安全组,并向其分配 Allow-RDP-All 安全规则。Create a network security group with New-AzNetworkSecurityGroup and assign the Allow-RDP-All security rule to it. 除 Allow-RDP-All 规则 外,该网络安全组还包含多个默认规则。In addition to the Allow-RDP-All rule, the network security group contains several default rules. 其中一个默认规则会禁用所有来自 Internet 的入站访问,这正是向网络安全组分配 Allow-RDP-All 规则的原因,为的是在虚拟机创建后能够远程连接到虚拟机。One default rule disables all inbound access from the Internet, which is why the Allow-RDP-All rule is assigned to the network security group so that you can remotely connect to the virtual machine, once it's created.

$nsg = New-AzNetworkSecurityGroup `
    -ResourceGroupName myResourceGroup `
    -Location chinaeast `
    -Name "myNsg" `
    -SecurityRules $rdp

使用 Set-AzVirtualNetworkSubnetConfig 将网络安全组关联到 mySubnet 子网。Associate the network security group to the mySubnet subnet with Set-AzVirtualNetworkSubnetConfig. 网络安全组中的规则对子网中部署的所有资源都是有效的。The rule in the network security group is effective for all resources deployed in the subnet.

Set-AzVirtualNetworkSubnetConfig `
    -VirtualNetwork $vnet `
    -Name 'mySubnet' `
    -AddressPrefix "192.168.1.0/24" `
    -NetworkSecurityGroup $nsg

创建具有加速网络的网络接口Create a network interface with accelerated networking

使用 New-AzPublicIpAddress 创建一个公共 IP 地址。Create a public IP address with New-AzPublicIpAddress. 如果不打算从 Internet 访问虚拟机,则不需要公共 IP 地址,但必须完成本文中的步骤。A public IP address isn't required if you don't plan to access the virtual machine from the Internet, but to complete the steps in this article, it is required.

$publicIp = New-AzPublicIpAddress `
    -ResourceGroupName myResourceGroup `
    -Name 'myPublicIp' `
    -location chinaeast `
    -AllocationMethod Dynamic

使用 New-AzNetworkInterface 创建启用了加速网络的网络接口,并将公共 IP 地址分配给该网络接口。Create a network interface with New-AzNetworkInterface with accelerated networking enabled and assign the public IP address to the network interface. 下面的示例在 myVnet 虚拟网络的 mySubnet 子网中创建名为 myNic 的网络接口,并向其分配 myPublicIp 公共 IP 地址 :The following example creates a network interface named myNic in the mySubnet subnet of the myVnet virtual network and assigns the myPublicIp public IP address to it:

$nic = New-AzNetworkInterface `
    -ResourceGroupName "myResourceGroup" `
    -Name "myNic" `
    -Location "chinaeast" `
    -SubnetId $vnet.Subnets[0].Id `
    -PublicIpAddressId $publicIp.Id `
    -EnableAcceleratedNetworking

创建虚拟机Create the virtual machine

使用 Get-Credential 将 VM 凭据设置为 $cred 变量:Set your VM credentials to the $cred variable using Get-Credential:

$cred = Get-Credential

首先,使用 New-AzVMConfig 定义 VM。First, define your VM with New-AzVMConfig. 以下示例定义名为 myVM 的 VM,其大小支持加速网络 (Standard_DS4_v2): The following example defines a VM named myVM with a VM size that supports Accelerated Networking (Standard_DS4_v2):

$vmConfig = New-AzVMConfig -VMName "myVm" -VMSize "Standard_DS4_v2"

若要获取所有 VM 大小和特性列表,请参阅 Windows VM 大小For a list of all VM sizes and characteristics, see Windows VM sizes.

通过 Set-AzVMOperatingSystemSet-AzVMSourceImage 创建 VM 配置的其余部分。Create the rest of your VM configuration with Set-AzVMOperatingSystem and Set-AzVMSourceImage. 以下示例创建一个 Windows Server 2016 VM:The following example creates a Windows Server 2016 VM:

$vmConfig = Set-AzVMOperatingSystem -VM $vmConfig `
    -Windows `
    -ComputerName "myVM" `
    -Credential $cred `
    -ProvisionVMAgent `
    -EnableAutoUpdate
$vmConfig = Set-AzVMSourceImage -VM $vmConfig `
    -PublisherName "MicrosoftWindowsServer" `
    -Offer "WindowsServer" `
    -Skus "2016-Datacenter" `
    -Version "latest"

使用 Add-AzVMNetworkInterface 附加之前创建的网络接口:Attach the network interface that you previously created with Add-AzVMNetworkInterface:

$vmConfig = Add-AzVMNetworkInterface -VM $vmConfig -Id $nic.Id

最后,使用 New-AzVM 创建 VM:Finally, create your VM with New-AzVM:

New-AzVM -VM $vmConfig -ResourceGroupName "myResourceGroup" -Location "chinaeast"

确认操作系统中安装了驱动程序Confirm the driver is installed in the operating system

在 Azure 中创建 VM 后,立即连接到 VM 并确认 Windows 中安装了驱动程序。Once you create the VM in Azure, connect to the VM and confirm that the driver is installed in Windows.

  1. 在 Internet 浏览器中打开 Azure 门户并使用 Azure 帐户登录。From an Internet browser, open the Azure portal and sign in with your Azure account.

  2. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入 myVm。 In the box that contains the text Search resources at the top of the Azure portal, type myVm. 当“myVm”出现在搜索结果中时,请单击它。 When myVm appears in the search results, click it. 如果“连接”按钮下方显示“正在创建”,则表示 Azure 尚未完成创建 VM 。If Creating is visible under the Connect button, Azure has not yet finished creating the VM. 仅在“连接”按钮下方不再显示“正在创建”时,才在概述的左上角单击“连接”。 Click Connect in the top left corner of the overview only after you no longer see Creating under the Connect button.

  3. 输入在创建虚拟机中输入的用户名和密码。Enter the username and password you entered in Create the virtual machine. 如果从未连接到 Azure 中的 Windows VM,请参阅连接到虚拟机If you've never connected to a Windows VM in Azure, see Connect to virtual machine.

  4. 右键单击 Windows“开始”按钮,并单击“设备管理器”。 Right-click the Windows Start button and click Device Manager. 展开“网络适配器”节点。 Expand the Network adapters node. 确认已显示“Mellanox ConnectX-3 Virtual Function Ethernet Adapter”,如下图所示: Confirm that the Mellanox ConnectX-3 Virtual Function Ethernet Adapter appears, as shown in the following picture:

    设备管理器

现在已为 VM 启用加速网络。Accelerated Networking is now enabled for your VM.

在现有 VM 上启用加速网络Enable Accelerated Networking on existing VMs

如果创建的 VM 没有加速网络,则可在现有 VM 上启用此功能。If you have created a VM without Accelerated Networking, it is possible to enable this feature on an existing VM. VM 必须支持加速网络,前提是满足以下先决条件(上文亦有列出):The VM must support Accelerated Networking by meeting the following prerequisites that are also outlined above:

  • VM 必须是加速网络支持的大小The VM must be a supported size for Accelerated Networking
  • VM 必须是受支持的 Azure 库映像(以及适用于 Linux 的内核版本)The VM must be a supported Azure Gallery image (and kernel version for Linux)
  • 在任何 NIC 上启用加速网络前,必须停止/解除分配可用性集或 VMSS 中的所有 VMAll VMs in an availability set or VMSS must be stopped/deallocated before enabling Accelerated Networking on any NIC

单个 VM 与可用性集中的 VMIndividual VMs & VMs in an availability set

首先停止/解除分配 VM,或集合中的所有 VM(如果是可用性集):First stop/deallocate the VM or, if an Availability Set, all the VMs in the Set:

Stop-AzVM -ResourceGroup "myResourceGroup" `
    -Name "myVM"

请务必注意,如果 VM 是单独创建的并且没有可用性集,则只需停止/解除分配单个 VM 即可启用加速网络。Important, please note, if your VM was created individually, without an availability set, you only need to stop/deallocate the individual VM to enable Accelerated Networking. 如果 VM 是随可用性集创建的,则在任何 NIC 上启用加速网络前,必须停止/解除分配可用性集中包含的所有 VM。If your VM was created with an availability set, all VMs contained in the availability set will need to be stopped/deallocated before enabling Accelerated Networking on any of the NICs.

一旦停止,即可在 VM 的 NIC 上启用加速网络:Once stopped, enable Accelerated Networking on the NIC of your VM:

$nic = Get-AzNetworkInterface -ResourceGroupName "myResourceGroup" `
    -Name "myNic"

$nic.EnableAcceleratedNetworking = $true

$nic | Set-AzNetworkInterface

重启 VM,或集中的所有 VM(如果在可用性集中),并确认已启用加速网络:Restart your VM or, if in an availability set, all the VMs in the set, and confirm that Accelerated Networking is enabled:

Start-AzVM -ResourceGroup "myResourceGroup" `
    -Name "myVM"

VMSSVMSS

VMSS 略有不同,但遵循相同的工作流。VMSS is slightly different but follows the same workflow. 首先,停止 VM:First, stop the VMs:

Stop-AzVmss -ResourceGroupName "myResourceGroup" `
    -VMScaleSetName "myScaleSet"

VM 停止后,更新网络接口下的加速网络属性:Once the VMs are stopped, update the Accelerated Networking property under the network interface:

$vmss = Get-AzVmss -ResourceGroupName "myResourceGroup" `
    -VMScaleSetName "myScaleSet"

$vmss.VirtualMachineProfile.NetworkProfile.NetworkInterfaceConfigurations[0].EnableAcceleratedNetworking = $true

Update-AzVmss -ResourceGroupName "myResourceGroup" `
    -VMScaleSetName "myScaleSet" `
    -VirtualMachineScaleSet $vmss

请注意,VMSS 的 VM 升级功能可使用三种不同的设置(自动、滚动和手动)应用更新。Please note, a VMSS has VM upgrades that apply updates using three different settings, automatic, rolling and manual. 在这些说明中,策略设置为自动,以便 VMSS 在可重启后立即收到更改。In these instructions the policy is set to automatic so that the VMSS will pick up the changes immediately after restarting. 若要将其设置为自动以便立即收到更改,请执行以下操作:To set it to automatic so that the changes are immediately picked up:

$vmss.UpgradePolicy.AutomaticOSUpgrade = $true

Update-AzVmss -ResourceGroupName "myResourceGroup" `
    -VMScaleSetName "myScaleSet" `
    -VirtualMachineScaleSet $vmss

最后,重启 VMSS:Finally, restart the VMSS:

Start-AzVmss -ResourceGroupName "myResourceGroup" `
    -VMScaleSetName "myScaleSet"

请在重启后等待升级完成,但一旦完成,VF 将在 VM 内部出现。Once you restart, wait for the upgrades to finish but once completed, the VF will appear inside the VM. (请确保使用的是支持的操作系统和 VM 大小)(Please make sure you are using a supported OS and VM size)

调整具有加速网络的现有 VM 的大小Resizing existing VMs with Accelerated Networking

启用加速网络的 VM 只能调整为支持加速网络的 VM 的大小。VMs with Accelerated Networking enabled can only be resized to VMs that support Accelerated Networking.

启用加速网络的 VM 不能使用调整大小操作调整为不支持加速网络的 VM 实例的大小。A VM with Accelerated Networking enabled cannot be resized to a VM instance that does not support Accelerated Networking using the resize operation. 相反,若要调整其中一个 VM 的大小,请执行以下操作:Instead, to resize one of these VMs:

  • 停止/解除分配 VM,或如果在可用性集/VMSS 中,则停止/解除分配集合/VMSS 中的所有 VM。Stop/Deallocate the VM or if in an availability set/VMSS, stop/deallocate all the VMs in the set/VMSS.
  • 必须在 VM 的 NIC 上禁用加速网络,或者如果在可用性集/VMSS 中,则必须在集合/​​VMSS 中的所有 VM 上禁用。Accelerated Networking must be disabled on the NIC of the VM or if in an availability set/VMSS, all VMs in the set/VMSS.
  • 一旦加速网络被禁用,VM/可用性集/VMSS 即可移至不支持加速网络的新大小并重启。Once Accelerated Networking is disabled, the VM/availability set/VMSS can be moved to a new size that does not support Accelerated Networking and restarted.