教程:使用 Azure 门户将 NAT 网关与公共负载均衡器集成Tutorial: Integrate a NAT gateway with a public load balancer using the Azure portal

在本教程中,您将了解如何将 NAT 网关与公共负载均衡器集成。In this tutorial, you'll learn how to integrate a NAT gateway with a public load balancer.

默认情况下,Azure 标准负载均衡器是安全的。By default, an Azure Standard Load Balancer is secure. 通过启用出站 SNAT(源网络地址转换)来显式定义出站连接。Outbound connectivity is explicitly defined by enabling outbound SNAT (Source Network Address Translation). 在负载均衡规则或出站规则中启用了 SNAT。SNAT is enabled in a load-balancing rule or outbound rules.

NAT 网关集成免去了对后端池出站 SNAT 的出站规则的需要。The NAT gateway integration replaces the need for outbound rules for backend pool outbound SNAT.

在本教程中,你将了解如何执行以下操作:In this tutorial, you learn how to:

  • 创建 Azure 负载均衡器Create an Azure Load Balancer
  • 为 Azure 负载均衡器的后端池创建两个虚拟机Create two virtual machines for the backend pool of the Azure Load Balancer
  • 创建 NAT 网关Create a NAT gateway
  • 验证负载均衡器后端池中虚拟机的出站连接Validate outbound connectivity of the virtual machines in the load balancer backend pool

先决条件Prerequisites

具有活动订阅的 Azure 帐户。An Azure account with an active subscription. 创建试用版订阅Create a trial subscription.

创建负载均衡器Create load balancer

在本部分中,您将创建标准 Azure 负载均衡器。In this section, you'll create a Standard Azure Load Balancer.

  1. 登录到 Azure 门户Sign in to the Azure portal.

  2. 选择“创建资源”。 Select Create a resource.

  3. 在搜索框中,输入“负载均衡器”。In the search box, enter Load balancer. 在搜索结果中选择“负载均衡器”。Select Load balancer in the search results.

  4. 在“负载均衡器”页上,选择“创建” 。In the Load balancer page, select Create.

  5. 在“创建负载均衡器”页中,输入或选择以下信息:On the Create load balancer page enter, or select the following information:

    设置Setting Value
    项目详细信息Project details
    订阅Subscription 选择订阅。Select your subscription.
    资源组Resource group 选择 新建 并在文本框中输入 TutorPubLBNAT-rgSelect Create new and enter TutorPubLBNAT-rg in the text box.
    选择“确定”。Select OK.
    实例详细信息Instance details
    名称Name 输入“myLoadBalancer”Enter myLoadBalancer
    区域Region 选择“中国东部 2”。Select China East 2.
    类型Type 选择“公共”。Select Public.
    SKUSKU 保留默认值“标准”。Leave the default Standard.
    公共 IP 地址Public IP address
    公共 IP 地址Public IP address 选择“新建”。Select Create new.
    若要使用现有的公共 IP,请选择“使用现有项”。If you have an existing Public IP you would like to use, select Use existing.
    公共 IP 地址名称Public IP address name 在文本框中输入 myPublicIP-LBEnter myPublicIP-LB in the text box.
    添加一个公共 IPv6 地址Add a public IPv6 address 请选择“否”。Select No.
    有关 IPv6 地址和负载均衡器的详细信息,请参阅什么是适用于 Azure 虚拟网络的 IPv6?For more information on IPv6 addresses and load balancer, see What is IPv6 for Azure Virtual Network?
  6. 接受剩余设置的默认值,然后选择“查看 + 创建”。Accept the defaults for the remaining settings, and then select Review + create.

  7. 在“查看 + 创建”选项卡中,选择“创建”。In the Review + create tab, select Create.

创建负载均衡器资源Create load balancer resources

在本部分中,你将配置:In this section, you configure:

  • 后端地址池的负载均衡器设置。Load balancer settings for a backend address pool.
  • 运行状况探测。A health probe.
  • 负载均衡器规则。A load balancer rule.

创建后端池Create a backend pool

后端地址池包含连接到负载均衡器的虚拟 (NIC) 的 IP 地址。A backend address pool contains the IP addresses of the virtual (NICs) connected to the load balancer.

创建后端地址池 myBackendPool 以包含用于对 Internet 流量进行负载均衡的虚拟机。Create the backend address pool myBackendPool to include virtual machines for load-balancing internet traffic.

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后在资源列表中选择“myLoadBalancer”。Select All services in the left-hand menu, select All resources, and then select myLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“后端池”、“添加”。Under Settings, select Backend pools, then select Add.

  3. 在“添加后端池”页上,键入 myBackendPool 作为后端池的名称,然后选择“添加”。On the Add a backend pool page, for name, type myBackendPool, as the name for your backend pool, and then select Add.

创建运行状况探测器Create a health probe

负载均衡器使用运行状况探测器监视应用的状态。The load balancer monitors the status of your app with a health probe.

运行状况探测器基于 VM 对运行状况检查的响应,在负载均衡器中添加或删除 VM。The health probe adds or removes VMs from the load balancer based on their response to health checks.

创建名为 myHealthProbe 的运行状况探测来监视 VM 的运行状况。Create a health probe named myHealthProbe to monitor the health of the VMs.

  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后在资源列表中选择“myLoadBalancer”。Select All services in the left-hand menu, select All resources, and then select myLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“运行状况探测”、“添加”。Under Settings, select Health probes, then select Add.

    设置Setting Value
    名称Name 输入 myHealthProbeEnter myHealthProbe.
    协议Protocol 选择“TCP”。Select TCP.
    端口Port 输入 80Enter 80.
    时间间隔Interval 输入 15 作为两次探测尝试之间的 时间间隔(以秒为单位)。Enter 15 for number of Interval in seconds between probe attempts.
    不正常阈值Unhealthy threshold 选择“2”,作为将 VM 视为不正常所要达到的 不正常阈值 或连续探测失败次数。Select 2 for number of Unhealthy threshold or consecutive probe failures that must occur before a VM is considered unhealthy.
  3. 将剩余的字段保留默认设置,然后选择 添加Leave the rest the defaults and Select Add.

创建负载均衡器规则Create a load balancer rule

负载均衡器规则用于定义将流量分配给 VM 的方式。A load balancer rule is used to define how traffic is distributed to the VMs. 定义传入流量的前端 IP 配置和后端 IP 池以接收流量。You define the frontend IP configuration for the incoming traffic and the backend IP pool to receive the traffic. 源端口和目标端口在规则中定义。The source and destination port are defined in the rule.

在本部分中,你将创建创建负载均衡器规则:In this section, you'll create a load balancer rule:

  • 该规则名为“myHTTPRule”。Named myHTTPRule.
  • 在名为“LoadBalancerFrontEnd”的前端中。In the frontend named LoadBalancerFrontEnd.
  • 正在侦听“端口 80”。Listening on Port 80.
  • 将负载均衡流量定向到“端口 80”上名为“myBackendPool”的后端 。Directs load balanced traffic to the backend named myBackendPool on Port 80.
  1. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后在资源列表中选择“myLoadBalancer”。Select All services in the left-hand menu, select All resources, and then select myLoadBalancer from the resources list.

  2. 在“设置”下,依次选择“负载均衡规则”、“添加” 。Under Settings, select Load-balancing rules, then select Add.

  3. 使用以下值配置负载均衡规则:Use these values to configure the load-balancing rule:

    设置Setting Value
    名称Name 输入 myHTTPRuleEnter myHTTPRule.
    IP 版本IP Version 选择“IPv4”Select IPv4
    前端 IP 地址Frontend IP address 选择“LoadBalancerFrontEnd”Select LoadBalancerFrontEnd
    协议Protocol 选择“TCP”。Select TCP.
    端口Port 输入 80Enter 80.
    后端端口Backend port 输入 80Enter 80.
    后端池Backend pool 选择“myBackendPool”。Select myBackendPool.
    运行状况探测Health probe 选择“myHealthProbe”。Select myHealthProbe.
    空闲超时(分钟)Idle timeout (minutes) 输入 15 分钟。Enter 15 minutes.
    TCP 重置TCP reset 选择“启用”。 Select Enabled.
    出站源网络地址转换 (SNAT)Outbound source network address translation (SNAT) 选择“(建议)使用出站规则为后端池成员提供对 Internet 的访问权限。”Select (Recommended) Use outbound rules to provide backend pool members access to the internet.
  4. 将剩余的字段保留默认设置,然后选择“确定”。Leave the rest of the defaults and then select OK.

创建虚拟网络Create the virtual network

在本部分,请创建虚拟网络和子网。In this section, you'll create a virtual network and subnet.

  1. 在屏幕的左上方选择“创建资源”>“网络”>“虚拟网络”,或者在搜索框中搜索“虚拟网络”。 On the upper-left side of the screen, select Create a resource > Networking > Virtual network or search for Virtual network in the search box.

  2. 选择“创建”。Select Create.

  3. 在“创建虚拟网络” 的“基本信息”选项卡中输入或选择以下信息 :In Create virtual network, enter or select this information in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择 TutorPubLBNAT-rgSelect TutorPubLBNAT-rg
    实例详细信息Instance details
    名称Name 输入“myVNet”Enter myVNet
    区域Region 选择“中国东部 2” Select China East 2
  4. 选择“IP 地址”选项卡 ,或选择页面底部的“下一步: IP 地址”按钮。Select the IP Addresses tab or select the Next: IP Addresses button at the bottom of the page.

  5. 在“IP 地址” 选项卡上,输入以下信息:In the IP Addresses tab, enter this information:

    设置Setting Value
    IPv4 地址空间IPv4 address space 输入“10.1.0.0/16”Enter 10.1.0.0/16
  6. 在“子网名称”下,选择词语“默认”。Under Subnet name, select the word default.

  7. 在“编辑子网”中输入以下信息: In Edit subnet, enter this information:

    设置Setting Value
    子网名称Subnet name 输入“myBackendSubnet”Enter myBackendSubnet
    子网地址范围Subnet address range 输入“10.1.0.0/24”Enter 10.1.0.0/24
  8. 选择“保存” 。Select Save.

  9. 选择“安全”选项卡。Select the Security tab.

  10. 在“BastionHost”下,选择“启用” 。Under BastionHost, select Enable. 输入此信息:Enter this information:

    设置Setting Value
    Bastion 名称Bastion name 输入“myBastionHost”Enter myBastionHost
    AzureBastionSubnet 地址空间AzureBastionSubnet address space 输入“10.1.1.0/24”Enter 10.1.1.0/24
    公共 IP 地址Public IP Address 选择“新建”。Select Create new.
    对于“名称”,请输入“myBastionIP” 。For Name, enter myBastionIP.
    选择“确定”。Select OK.
  11. 选择“查看 + 创建”选项卡,或选择“查看 + 创建”按钮。Select the Review + create tab or select the Review + create button.

  12. 选择“创建”。Select Create.

创建虚拟机Create virtual machines

在本部分中,您将在两个不同的区域(区域 1区域 2)中创建两个 VM(myVM1myVM2)。In this section, you'll create two VMs (myVM1 and myVM2) in two different zones (Zone 1 and Zone 2).

这些 VM 将添加到先前创建的负载均衡器的后端池中。These VMs are added to the backend pool of the load balancer that was created earlier.

  1. 在门户的左上方,选择“创建资源”,在“新建”页的搜索框中搜索“Windows Server 2019 Datacenter”,接着在搜索结果中选择“Windows Server 2019 Datacenter”,然后选择“创建”。On the upper-left side of the portal, select Create a resource, search for Windows Server 2019 Datacenter in search box of New page, then select Windows Server 2019 Datacenter in search results and select Create.

  2. 在“创建虚拟机”中,在“基本信息”选项卡中键入或选择值:In Create a virtual machine, type or select the values in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择 TutorPubLBNAT-rgSelect TutorPubLBNAT-rg
    实例详细信息Instance details
    虚拟机名称Virtual machine name 输入“myVM1”Enter myVM1
    区域Region 选择“中国东部 2” Select China East 2
    可用性选项Availability Options 选择“无需基础结构冗余”Select No infrastructure redundancy required
    映像Image 选择“Windows Server 2019 Datacenter”Select Windows Server 2019 Datacenter
    大小Size 选择 VM 大小或采用默认设置Choose VM size or take default setting
    管理员帐户Administrator account
    用户名Username 输入用户名Enter a username
    密码Password 输入密码Enter a password
    确认密码Confirm password 重新输入密码Reenter password
    入站端口规则Inbound port rules
    公共入站端口Public inbound ports 选择“无”Select None
  3. 选择“网络”选项卡,或选择“下一步: 磁盘”,然后选择“下一步: 网络”。Select the Networking tab, or select Next: Disks, then Next: Networking.

  4. 在“网络”选项卡中,选择或输入:In the Networking tab, select or enter:

    设置Setting Value
    网络接口Network interface
    虚拟网络Virtual network myVNetmyVNet
    子网Subnet myBackendSubnetmyBackendSubnet
    公共 IPPublic IP 选择“无”。Select None.
    NIC 网络安全组NIC network security group 选择“高级”Select Advanced
    配置网络安全组Configure network security group 选择“新建”。Select Create new.
    在“创建网络安全组”中,在“名称”中输入“myNSG” 。In the Create network security group, enter myNSG in Name.
    在“入站规则”下,选择“+ 添加入站规则” 。Under Inbound rules, select +Add an inbound rule.
    在“目标端口范围”下,输入“80” 。Under Destination port ranges, enter 80.
    在“优先级”下,输入“100” 。Under Priority, enter 100.
    在“名称”中,输入“myHTTPRule”In Name, enter myHTTPRule
    选择“添加”Select Add
    选择“确定”Select OK
    负载均衡Load balancing
    是否将此虚拟机置于现有的负载均衡解决方案之后?Place this virtual machine behind an existing load-balancing solution? 选择此复选框。Select the check box.
    负载均衡设置Load balancing settings
    负载均衡选项Load balancing options 选择“Azure 负载均衡器” Select Azure load balancer
    选择负载均衡器Select a load balancer 选择“myLoadBalancer”Select myLoadBalancer
    选择后端池Select a backend pool 选择“myBackendPool”Select myBackendPool
  5. 选择“查看 + 创建”。Select Review + create.

  6. 检查设置,然后选择“创建”。Review the settings, and then select Create.

  7. 按照步骤 1 到 7 操作,使用以下值创建一个 VM,所有其他设置均与 myVM1 相同:Follow the steps 1 to 7 to create a VM with the following values and all the other settings the same as myVM1:

    设置Setting VM 2VM 2
    名称Name myVM2myVM2
    网络安全组Network security group 选择现有的“myNSG”Select the existing myNSG

创建 NAT 网关Create NAT gateway

在本部分中,您将创建一个 NAT 网关,并将其分配给您之前创建的虚拟网络中的子网。In this section, you'll create a NAT gateway and assign it to the subnet in the virtual network you created previously.

  1. 在屏幕的左上方,选择“创建资源”>“网络”>“NAT 网关”,或者在搜索框中搜索“NAT 网关” 。On the upper-left side of the screen, select Create a resource > Networking > NAT gateway or search for NAT gateway in the search box.

  2. 选择“创建”。Select Create.

  3. 在“创建网络地址转换(NAT)网关”中,在“基本信息”选项卡中输入或选择以下信息 :In Create network address translation (NAT) gateway, enter or select this information in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅。Select your Azure subscription.
    资源组Resource Group 选择 TutorPubLBNAT-rgSelect TutorPubLBNAT-rg.
    实例详细信息Instance details
    名称Name 输入 myNATGatewayEnter myNATGateway
    区域Region 选择“中国东部 2” Select China East 2
    空闲超时(分钟)Idle timeout (minutes) 输入“10”。Enter 10.
  4. 选择“出站 IP”选项卡,或者选择“下一步:出站 IP”按钮(位于页面底部) 。Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  5. 在“出站 IP”选项卡中,输入或选择以下信息:In the Outbound IP tab, enter or select the following information:

    设置Setting Value
    公共 IP 地址Public IP addresses 选择“创建新的公共 IP 地址”。Select Create a new public IP address.
    名称 中,输入 myPublicIP-NATIn Name, enter myPublicIP-NAT.
    选择“确定”。Select OK.
  6. 选择“子网”选项卡,或者选择“下一步:子网”按钮(位于页面底部) 。Select the Subnet tab, or select the Next: Subnet button at the bottom of the page.

  7. 在“子网”选项卡中,选择“虚拟网络”下拉列表中的“myVNet” 。In the Subnet tab, select myVNet in the Virtual network pull-down.

  8. 选中 myBackendSubnet 旁边的复选框。Check the box next to myBackendSubnet.

  9. 选择“查看 + 创建”选项卡,或选择页面底部的“查看 + 创建”按钮 。Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  10. 选择“创建”。Select Create.

测试 NAT 网关Test NAT gateway

在本部分中,我们将测试 NAT 网关。In this section, we'll test the NAT gateway. 首先,我们将发现 NAT 网关的公共 IP。We'll first discover the public IP of the NAT gateway. 然后,我们将连接到测试虚拟机,并通过 NAT 网关验证出站连接。We'll then connect to the test virtual machine and verify the outbound connection through the NAT gateway.

  1. 在“概述”屏幕上找到 NAT 网关的公共 IP 地址。Find the public IP address for the NAT gateway on the Overview screen. 在左侧菜单中选择“所有服务”,选择“所有资源”,然后选择“myPublicIP”。Select All services in the left-hand menu, select All resources, and then select myPublicIP.

  2. 记下公共 IP 地址:Make note of the public IP address:

    发现 NAT 网关的公共 IP 地址的屏幕截图。

  3. 在左侧菜单中选择 所有服务,选择 所有资源,然后从资源列表中选择位于 TutorPubLBNAT-rg 资源组中的 myVM1Select All services in the left-hand menu, select All resources, and then from the resources list, select myVM1 that is located in the TutorPubLBNAT-rg resource group.

  4. 在“概述”页上,选择“连接”,然后选择“Bastion” 。On the Overview page, select Connect, then Bastion.

  5. 选择蓝色的“使用堡垒”按钮。Select the blue Use Bastion button.

  6. 输入在 VM 创建过程中输入的用户名和密码。Enter the username and password entered during VM creation.

  7. myVM1 中打开 Internet ExplorerOpen Internet Explorer on myVM1.

  8. 在地址栏中输入“https://whatsmyip.com”。Enter https://whatsmyip.com in the address bar.

  9. 验证显示的 IP 地址与你在上一步中记下的 NAT 网关地址是否匹配:Verify the IP address displayed matches the NAT gateway address you noted in the previous step:

    显示外部出站 IP 的 Internet Explorer 的屏幕截图。

清理资源Clean up resources

如果你不打算继续使用此应用程序,请按以下步骤删除虚拟网络、虚拟机和 NAT 网关:If you're not going to continue to use this application, delete the virtual network, virtual machine, and NAT gateway with the following steps:

  1. 从左侧菜单中,选择“资源组”。From the left-hand menu, select Resource groups.

  2. 选择 TutorPubLBNAT-rg 资源组。Select the TutorPubLBNAT-rg resource group.

  3. 选择“删除资源组”。Select Delete resource group.

  4. 输入 TutorPubLBNAT-rg,然后选择 删除Enter TutorPubLBNAT-rg and select Delete.

后续步骤Next steps

有关 Azure 虚拟网络 NAT 的详细信息,请参阅:For more information on Azure Virtual Network NAT, see: