诊断虚拟机路由问题Diagnose a virtual machine routing problem

本文介绍如何通过查看虚拟机 (VM) 中网络接口的有效路由来诊断路由问题。In this article, you learn how to diagnose a routing problem by viewing the routes that are effective for a network interface in a virtual machine (VM). Azure 为每个虚拟网络子网创建多个默认路由。Azure creates several default routes for each virtual network subnet. 可以通过在路由表中定义路由,然后将路由表关联到子网,来替代 Azure 的默认路由。You can override Azure's default routes by defining routes in a route table, and then associating the route table to a subnet. 创建的路由、Azure 的默认路由,以及使用边界网关协议 (BGP) 通过 Azure VPN 网关(如果虚拟网络已连接到本地网络)从本地网络传播的任何路由的组合,就是子网中所有网络接口的有效路由。The combination of routes you create, Azure's default routes, and any routes propagated from your on-premises network through an Azure VPN gateway (if your virtual network is connected to your on-premises network) via the border gateway protocol (BGP), are the effective routes for all network interfaces in a subnet. 如果不熟悉虚拟网络、网络接口或路由的概念,请参阅虚拟网络概述网络接口路由概述If you're not familiar with virtual network, network interface, or routing concepts, see Virtual network overview, Network interface, and Routing overview.

方案Scenario

你正在尝试连接到某个 VM,但连接失败。You attempt to connect to a VM, but the connection fails. 若要确定为何无法连接到该 VM,可以使用 Azure 门户PowerShellAzure CLI 查看网络接口的有效路由。To determine why you can't connect to the VM, you can view the effective routes for a network interface using the Azure portal, PowerShell, or the Azure CLI.

以下步骤假设有一个要查看其有效路由的现有 VM。The steps that follow assume you have an existing VM to view the effective routes for. 如果没有 VM,请先部署 LinuxWindows VM 以完成本文中的任务。If you don't have an existing VM, first deploy a Linux or Windows VM to complete the tasks in this article with. 本文中的示例适用于名为 myVM 的 VM,其中包含名为 myVMNic1 的网络接口 。The examples in this article are for a VM named myVM with a network interface named myVMNic1. VM 和网络接口位于名为 myResourceGroup 的资源组中,并位于“中国东部” 区域中。The VM and network interface are in a resource group named myResourceGroup, and are in the China East region. 针对想要诊断其问题的 VM,相应地更改步骤中的值。Change the values in the steps, as appropriate, for the VM you are diagnosing the problem for.

使用 Azure 门户诊断Diagnose using Azure portal

  1. 使用拥有所需权限的 Azure 帐户登录到 Azure 门户Log into the Azure portal with an Azure account that has the necessary permissions.

  2. 在 Azure 门户顶部的搜索框中,输入处于运行状态的 VM 的名称。At the top of the Azure portal, enter the name of a VM that is in the running state, in the search box. 当 VM 名称显示在搜索结果中时,请选择它。When the name of the VM appears in the search results, select it.

  3. 在左侧的“设置”下,选择“网络”,然后通过选择网络接口资源的名称导航到对应资源 。Under Settings on the left, select Networking, and navigate to the network interface resource by selecting its name.

    查看网络接口

  4. 在左侧选择“有效路由” 。On the left, select Effective routes. 下图显示了名为 myVMNic1 的网络接口的有效路由 :The effective routes for a network interface named myVMNic1 are shown, in the following picture:

    查看有效路由

    如果已将多个网络接口附加到 VM,可以选择任一网络接口来查看其有效路由。If there are multiple network interfaces attached to the VM, you can view the effective routes for any network interface by selecting it. 由于每个网络接口可能位于不同的子网中,因此,每个网络接口可能有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes.

    在上图中所示的示例中,列出的路由是 Azure 为每个子网创建的默认路由。In the example shown in the previous picture, the listed routes are default routes that Azure creates for each subnet. 你的列表至少包含这些路由,但可能还包含其他路由,具体取决于为虚拟网络启用的功能,例如,已将它对等互连到另一个虚拟网络,或通过 Azure VPN 网关连接到本地网络。Your list has at least these routes, but may have additional routes, depending on capabilities you may have enabled for your virtual network such as it being peered with another virtual network or connected to your on-premises network through an Azure VPN gateway. 若要详细了解每个路由以及网络接口的其他路由,请参阅虚拟网络流量路由To learn more about each of the routes, and other routes you may see for your network interface, see Virtual network traffic routing. 如果列表中包含大量的路由,你可能会发现,选择“下载”来下载包含路由列表的 .csv 文件会更方便。 If your list has a large number of routes, you may find it easier to select Download, to download a .csv file with the list of routes.

尽管上述步骤是通过 VM 查看有效路由,但也可以通过以下方式查看有效路由:Though effective routes were viewed through the VM in the previous steps, you can also view effective routes through an:

使用 PowerShell 诊断Diagnose using PowerShell

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

可以通过从计算机运行 PowerShell 来运行命令。You can run the commands by running PowerShell from your computer. 如果在计算机上运行 PowerShell,需要 Azure PowerShell 模块 1.0.0 或更高版本。If you run PowerShell from your computer, you need the Azure PowerShell module, version 1.0.0 or later. 在计算机上运行 Get-Module -ListAvailable Az,找到已安装的版本。Run Get-Module -ListAvailable Az on your computer, to find the installed version. 如果需要进行升级,请参阅 Install Azure PowerShell module(安装 Azure PowerShell 模块)。If you need to upgrade, see Install Azure PowerShell module. 如果在本地运行 PowerShell,则还需要运行 Connect-AzAccount -Environment AzureChinaCloud,以使用拥有所需权限的帐户登录到 Azure。If you are running PowerShell locally, you also need to run Connect-AzAccount -Environment AzureChinaCloud to log into Azure with an account that has the necessary permissions.

使用 Get-AzEffectiveRouteTable 获取网络接口的有效路由。Get the effective routes for a network interface with Get-AzEffectiveRouteTable. 以下示例获取资源组 myResourceGroup 中名为 myVMNic1 的网络接口的有效路由 :The following example gets the effective routes for a network interface named myVMNic1, that is in a resource group named myResourceGroup:

Get-AzEffectiveRouteTable `
  -NetworkInterfaceName myVMNic1 `
  -ResourceGroupName myResourceGroup `
  | Format-Table

若要了解输出中返回的信息,请参阅路由概述To understand the information returned in the output, see Routing overview. 仅当 VM 处于运行状态时,才返回输出。Output is only returned if the VM is in the running state. 如果已将多个网络接口附加到 VM,可以查看每个网络接口的有效路由。If there are multiple network interfaces attached to the VM, you can review the effective routes for each network interface. 由于每个网络接口可能位于不同的子网中,因此,每个网络接口可能有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes. 如果仍遇到通信问题,请参阅其他诊断注意事项If you're still having a communication problem, see additional diagnosis and considerations.

如果不知道网络接口的名称,但知道网络接口所附加到的 VM 的名称,则运行以下命令会返回附加到 VM 的所有网络接口的 ID:If you don't know the name of a network interface, but do know the name of the VM the network interface is attached to, the following commands return the IDs of all network interfaces attached to a VM:

$VM = Get-AzVM -Name myVM `
  -ResourceGroupName myResourceGroup
$VM.NetworkProfile

将会收到类似于以下示例的输出:You receive output similar to the following example:

NetworkInterfaces
-----------------
{/subscriptions/<ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myVMNic1

在前面的输出中,网络接口名称为 myVMNic1 。In the previous output, the network interface name is myVMNic1.

使用 Azure CLI 诊断Diagnose using Azure CLI

可以通过从计算机运行 CLI 来运行命令。You can run the commands by running the CLI from your computer. 本文需要 Azure CLI 2.0.32 或更高版本。This article requires the Azure CLI version 2.0.32 or later. 运行 az --version 查找已安装的版本。Run az --version to find the installed version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI. 如果在本地运行 Azure CLI,则还需要运行 az login,并使用拥有所需权限的帐户登录到 Azure。If you are running the Azure CLI locally, you also need to run az login and log into Azure with an account that has the necessary permissions.

使用 az network nic show-effective-route-table 获取网络接口的有效路由。Get the effective routes for a network interface with az network nic show-effective-route-table. 以下示例获取资源组 myResourceGroup 中名为 myVMNic1 的网络接口的有效路由 :The following example gets the effective routes for a network interface named myVMNic1 that is in a resource group named myResourceGroup:

az network nic show-effective-route-table \
  --name myVMNic1 \
  --resource-group myResourceGroup

若要了解输出中返回的信息,请参阅路由概述To understand the information returned in the output, see Routing overview. 仅当 VM 处于运行状态时,才返回输出。Output is only returned if the VM is in the running state. 如果已将多个网络接口附加到 VM,可以查看每个网络接口的有效路由。If there are multiple network interfaces attached to the VM, you can review the effective routes for each network interface. 由于每个网络接口可能位于不同的子网中,因此,每个网络接口可能有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes. 如果仍遇到通信问题,请参阅其他诊断注意事项If you're still having a communication problem, see additional diagnosis and considerations.

如果不知道网络接口的名称,但知道网络接口所附加到的 VM 的名称,则运行以下命令会返回附加到 VM 的所有网络接口的 ID:If you don't know the name of a network interface, but do know the name of the VM the network interface is attached to, the following commands return the IDs of all network interfaces attached to a VM:

az vm show \
  --name myVM \
  --resource-group myResourceGroup

解决问题Resolve a problem

解决路由问题的过程通常包括:Resolving routing problems typically consists of:

  • 创建自定义路由来替代 Azure 的默认路由。Adding a custom route to override one of Azure's default routes. 了解如何添加自定义路由Learn how to add a custom route.
  • 更改或删除可能导致路由到不需要的位置的自定义路由。Change or remove a custom route that may cause routing to an undesired location. 了解如何更改删除自定义路由。Learn how to change or delete a custom route.
  • 确保包含定义的任何自定义路由的路由表已关联到网络接口所在的子网。Ensuring that the route table that contains any custom routes you've defined is associated to the subnet the network interface is in. 了解如何将路由表关联到子网Learn how to associate a route table to a subnet.
  • 确保部署的设备(例如 Azure VPN 网关或网络虚拟设备)正常运行。Ensuring that devices such as Azure VPN gateway or network virtual appliances you've deployed are operable. 使用网络观察程序的 VPN 诊断功能来确定 Azure VPN 网关的任何问题。Use the VPN diagnostics capability of Network Watcher to determine any problems with an Azure VPN gateway.

如果仍然遇到通信问题,请参阅“注意事项”和“其他诊断”。If you're still having communication problems, see Considerations and Additional diagnosis.

注意事项Considerations

排查通信问题时,请注意以下几点:Consider the following points when troubleshooting communication problems:

  • 路由基于定义的路由、边界网关协议 (BGP) 和系统路由之间的最长前缀匹配 (LPM)。Routing is based on longest prefix match (LPM) among routes that you've defined, border gateway protocol (BGP), and system routes. 如果有多个路由的 LPM 匹配情况相同,则会按路由概述中所列的顺序,根据路由的来源选择路由。If there is more than one route with the same LPM match, then a route is selected based on its origin in the order listed in Routing overview. 对于有效路由,只能查看基于所有可用路由匹配 LPM 的有效路由。With effective routes, you can only see effective routes that are an LPM match, based on all the available routes. 查看网络接口的路由评估方式可以更方便地对可能影响 VM 通信的特定路由进行故障排除。Seeing how the routes are evaluated for a network interface makes it a lot easier to troubleshoot specific routes that may be impacting communication from your VM.
  • 如果定义了网络虚拟设备 (NVA) 的自定义路由(“虚拟设备”是下一跃点类型),请确保接收流量的 NVA 已启用 IP 转发,否则数据包会被丢弃。 If you've defined custom routes to a network virtual appliance (NVA), with Virtual Appliance as the next hop type, ensure that IP forwarding is enabled on the NVA receiving the traffic, or packets are dropped. 详细了解如何为网络接口启用 IP 转发Learn more about enabling IP forwarding for a network interface. 此外,NVA 中的操作系统或应用程序也必须能够转发网络流量,并且能够配置为执行此操作。Additionally, the operating system, or application within the NVA must also be able to forward network traffic and be configured to do so.
  • 如果创建了 0.0.0.0/0 的路由,所有出站 Internet 流量将路由到指定的下一跃点,从而路由到 NVA 或 VPN 网关。If you've created a route to 0.0.0.0/0, all outbound internet traffic is routed to the next hop you specified, such as to an NVA or VPN gateway. 创建此类路由的方法通常称为强制隧道。Creating such a route is often referred to as forced tunneling. 根据下一跃点处理流量的方式,使用此路由可能无法从 Internet 通过 RDP 或 SSH 来与 VM 建立远程连接。Remote connections using the RDP or SSH protocols from the internet to your VM may not work with this route, depending on how the next hop handles the traffic. 符合以下条件时,可以启用强制隧道:Forced-tunneling can be enabled:
    • 使用站点到站点 VPN 创建下一跃点类型为“VPN 网关”的路由。 When using site-to-site VPN, by creating a route with a next hop type of VPN Gateway. 详细了解如何配置强制隧道Learn more about configuring forced tunneling.
    • 使用站点到站点 VPN 或 ExpressRoute 线路时,通过虚拟网络网关基于 BGP 播发 0.0.0.0/0(默认路由)。If a 0.0.0.0/0 (default route) is advertised over BGP through a virtual network gateway when using a site-to-site VPN, or ExpressRoute circuit. 详细了解如何将 BGP 与站点到站点 VPNExpressRoute 配合使用。Learn more about using BGP with a site-to-site VPN or ExpressRoute.
  • 要使虚拟网络对等互连流量正常工作,对等互连虚拟网络的前缀范围中必须存在下一跃点类型为“VNet 对等互连”的系统路由。 For virtual network peering traffic to work correctly, a system route with a next hop type of VNet Peering must exist for the peered virtual network's prefix range. 如果没有此类路由,并且虚拟网络对等互连链接为“已连接”: If such a route doesn't exist, and the virtual network peering link is Connected:
  • 尽管 Azure 会将默认路由分配到每个 Azure 网络接口,但如果已将多个网络接口附加到 VM,则只会为主要网络接口或 VM 操作系统中的网关分配默认路由 (0.0.0.0/0)。Though Azure assigns default routes to each Azure network interface, if you have multiple network interfaces attached to the VM, only the primary network interface is assigned a default route (0.0.0.0/0), or gateway, within the VM's operating system. 了解如何为附加到 WindowsLinux VM 的辅助网络接口创建默认路由。Learn how to create a default route for secondary network interfaces attached to a Windows or Linux VM. 详细了解主要和辅助网络接口Learn more about primary and secondary network interfaces.

其他诊断Additional diagnosis

  • 若要运行快速测试来确定发往某个位置的流量的下一跃点类型,请使用 Azure 网络观察程序的下一跃点功能。To run a quick test to determine the next hop type for traffic destined to a location, use the Next hop capability of Azure Network Watcher. 下一跃点告知发往指定位置的流量的下一跃点类型是什么。Next hop tells you what the next hop type is for traffic destined to a specified location.
  • 如果没有任何路由导致 VM 的网络通信失败,则问题可能在于 VM 操作系统中运行的防火墙软件If there are no routes causing a VM's network communication to fail, the problem may be due to firewall software running within the VM's operating system
  • 如果使用强制隧道通过 VPN 网关或 NVA 将流量发送到本地设备,可能无法从 Internet 连接到 VM,具体取决于为设备配置路由的方式。If you are force tunneling traffic to an on-premises device through a VPN gateway, or NVA, you may not be able to connect to a VM from the internet, depending on how you've configured routing for the devices. 确认针对设备配置的路由是将流量路由到 VM 的公共还是专用 IP 地址。Confirm that the routing you have configured for the device routes traffic to either a public or private IP address for the VM.
  • 使用网络观察程序的连接故障排除功能,来确定出站通信问题的路由、筛选和 OS 内部相关原因。Use the connection troubleshoot capability of Network Watcher to determine routing, filtering, and in-OS causes of outbound communication problems.

后续步骤Next steps