配置和验证虚拟网络或 VPN 连接Configure and validate virtual network or VPN connections

本演练提供有关配置和验证各种 Azure VPN 与虚拟网络部署的分步指导。This walkthrough provides step-by-step guidance to configure and validate various Azure VPN and virtual network deployments. 方案包括传输路由、网络间的连接、边界网关协议 (BGP)、多站点连接和点到站点连接。Scenarios include transit routing, network-to-network connections, Border Gateway Protocol (BGP), multisite connections, and point-to-site connections.

借助 Azure VPN 网关的灵活性,可以在 Azure 中排列几乎所有类型的互连式虚拟网络拓扑。Azure VPN gateways enable flexibility in arranging almost any kind of connected virtual network topology in Azure. 例如,可以建立如下所述的虚拟网络连接:For example, you can connect virtual networks:

  • 跨区域。Across regions.
  • 在不同的虚拟网络类型(Azure 资源管理器与经典模型)之间。Between virtual network types (Azure Resource Manager versus classic).
  • 在 Azure 内部,或者在本地混合环境内部。Within Azure or within an on-premises hybrid environment.
  • 在不同的订阅中。In different subscriptions.

网络间的 VPN 连接Network-to-network VPN connection

通过 VPN 将一个虚拟网络连接到另一个虚拟网络(网络间连接)类似于将虚拟网络连接到本地站点位置。Connecting a virtual network to another virtual network (network-to-network) via VPN is similar to connecting a virtual network to an on-premises site location. 这两种连接类型都使用 VPN 网关通过 IPsec 和 IKE 提供安全隧道。Both connectivity types use a VPN gateway to provide a secure tunnel through IPsec and IKE. 虚拟网络可位于相同或不同的区域,来自相同或不同的订阅。The virtual networks can be in the same or different regions, and from the same or different subscriptions.

使用 IPsec 的网络间连接

如果虚拟网络位于同一区域,你可能会考虑使用虚拟网络对等互连来连接这些虚拟网络。If your virtual networks are in the same region, you might want to consider connecting them by using virtual network peering. 虚拟网络对等互连不使用 VPN 网关。Virtual network peering doesn't use a VPN gateway. 它可以提高吞吐量并降低延迟。It increases throughput and decreases latency. 若要配置虚拟网络对等互连,请选择“配置并验证 VNet 对等互连”。 To configure a virtual network peering connection, select Configure and validate VNet Peering.

如果虚拟网络是通过 Azure 资源管理器部署模型创建的,请选择“配置并验证资源管理器 VNet 到资源管理器 VNet 的连接”来配置 VPN 连接。 If your virtual networks were created through the Azure Resource Manger deployment model, select Configure and validate a Resource Manager VNet to a Resource Manager VNet connection to configure a VPN connection.

如果一个虚拟网络是通过 Azure 经典部署模型创建的,另一个虚拟网络是通过资源管理器创建的,请选择“配置并验证经典 VNet 到资源管理器 VNet 的连接”来配置 VPN 连接。 If one of the virtual networks was created through the Azure classic deployment model, and the other was created through Resource Manager, select Configure and validate a classic VNet to a Resource Manager VNet connection to configure a VPN connection.

为同一区域中的两个虚拟网络配置虚拟网络对等互连Configure virtual network peering for two virtual networks in the same region

在开始实施并配置 Azure 虚拟网络对等互连之前,请确保满足以下先决条件:Before you start to implement and configure Azure virtual network peering, make sure that you meet the following prerequisites:

  • 对等虚拟网络必须位于同一 Azure 区域。The peered virtual networks must exist in the same Azure region.
  • 对等虚拟网络必须使用不重叠的 IP 地址空间。The peered virtual networks must have IP address spaces that don't overlap.
  • 虚拟网络对等互连在两个虚拟网络之间进行。Virtual network peering is between two virtual networks. 对等互连之间没有任何派生的可传递关系。There's no derived transitive relationship across peerings. 例如,如果 VNetA 与 VNetB 对等互连,VNetB 与 VNetC 对等互连,但 VNetA 不与 VNetC 对等互连。 For example, if VNetA is peered with VNetB, and VNetB is peered with VNetC, VNetA is not peered with VNetC.

满足要求后,可以根据教程:使用 Azure 门户通过虚拟网络对等互连来连接虚拟网络创建并配置对等互连。When you meet the requirements, you can follow Tutorial: Connect virtual networks with virtual network peering by using the Azure portal to create and configure the peering.

若要检查对等互连配置,请使用以下方法:To check the peering configuration, use the following method:

  1. 使用具有必要角色和权限的帐户登录到 Azure 门户Sign in to the Azure portal by using an account that has the necessary roles and permissions.
  2. 在门户顶部包含“搜索资源”文本的框中,键入“虚拟网络”。 In the box that contains the text Search resources at the top of the portal, type virtual networks. 当“虚拟网络”出现在搜索结果中时,请选择它。 When Virtual networks appears in the search results, select it.
  3. 在显示的“虚拟网络”边栏选项卡中,选择想要为其创建对等互连的虚拟网络。 In the Virtual networks blade that appears, select the virtual network for which you want to create a peering.
  4. 在针对所选虚拟网络显示的窗格中,选择“设置”部分中的“对等互连”。 In the pane that appears for the virtual network, select Peerings in the Settings section.
  5. 选择一个对等互连并查看配置结果。Select a peering and view the configuration results.

用于检查虚拟网络对等互连配置的选项

在 Azure PowerShell 中,运行命令 Get-AzureRmVirtualNetworkPeering 获取虚拟网络对等互连。For Azure PowerShell, run the command Get-AzureRmVirtualNetworkPeering to get the virtual network peering. 下面是一个示例:Here's an example:

PS C:\Users\User1> Get-AzureRmVirtualNetworkPeering -VirtualNetworkName Vnet10-01 -ResourceGroupName dev-vnets
Name                             : LinkToVNET10-02
Id                               : /subscriptions/GUID/resourceGroups/dev-vnets/providers/Microsoft.Network/virtualNetworks/VNET10-01/virtualNetworkPeerings/LinkToVNET10-0
2
Etag                             : W/"GUID"
ResourceGroupName                : dev-vnets
VirtualNetworkName               : vnet10-01
ProvisioningState                : Succeeded
RemoteVirtualNetwork             : {
                                  "Id": "/subscriptions/GUID/resourceGroups/DEV-VNET
                                   s/providers/Microsoft.Network/virtualNetworks/VNET10-02"
                                   }
AllowVirtualNetworkAccess        : True
AllowForwardedTraffic            : False
AllowGatewayTransit              : False
UseRemoteGateways                : False
RemoteGateways                   : null
RemoteVirtualNetworkAddressSpace : null

将资源管理器虚拟网络连接到另一个资源管理器虚拟网络Connect a Resource Manager virtual network to another Resource Manager virtual network

可以直接配置从一个资源管理器虚拟网络到另一个资源管理器虚拟网络的连接。You can configure a connection from one Resource Manager virtual network to another Resource Manager virtual network directly. 或者,可以配置使用 IPsec 的连接。Or you can configure the connection by using IPsec.

在资源管理器虚拟网络之间配置 VPN 连接Configure a VPN connection between Resource Manager virtual networks

若要在资源管理器虚拟网络之间配置不使用 IPsec 的连接,请参阅使用 Azure 门户配置网络间的 VPN 网关连接To configure a connection between Resource Manager virtual networks without IPsec, see Configure a network-to-network VPN gateway connection by using the Azure portal.

若要在两个资源管理器虚拟网络之间配置使用 IPsec 的连接,请针对每个虚拟网络遵循在 Azure 门户中创建站点到站点连接中的步骤 1-5。To configure a connection with IPsec between two Resource Manager virtual networks, follow steps 1 to 5 in Create a site-to-site connection in the Azure portal for each virtual network.

备注

这些步骤仅适用于同一订阅中的虚拟网络。These steps work only for virtual networks in the same subscription. 如果虚拟网络在不同的订阅中,则必须使用 PowerShell 进行连接。If your virtual networks are in different subscriptions, you must use PowerShell to make the connection. 请参阅 PowerShell 一文。See the PowerShell article.

验证资源管理器虚拟网络之间的 VPN 连接Validate the VPN connection between Resource Manager virtual networks

经典虚拟网络到 Azure 资源管理器虚拟网络的连接

若要检查是否已正确配置 VPN 连接,请按以下说明操作。To check that your VPN connection is configured correctly, follow these instructions.

备注

在这些步骤中,虚拟网络组件后面的编号对应于上图中的编号。The numbers after virtual network components in these steps correspond to the numbers in the preceding diagram.

  1. 请确保连接的虚拟网络中不存在重叠的地址空间。Make sure there are no overlapping address spaces in the connected virtual networks.
  2. 验证是否在“连接对象”实例 (4) 中准确定义了 Azure 资源管理器虚拟网络的地址范围 (1)。 Verify that the address range for the Azure Resource Manager virtual network (1) is defined accurately in the Connection object instance (4).
  3. 验证是否在“连接对象”实例 (3) 中准确定义了 Azure 资源管理器虚拟网络的地址范围 (6)。 Verify that the address range for the Azure Resource Manager virtual network (6) is defined accurately in the Connection object instance (3).
  4. 验证连接对象中的预共享密钥是否匹配。Verify that the pre-shared keys are matching on the connection objects.
  5. 验证是否在“连接对象”实例 (4) 中准确定义了 Azure 资源管理器虚拟网络网关 VIP (2)。 Verify that the Azure Resource Manager virtual network gateway VIP (2) is defined accurately in the Connection object instance (4).
  6. 验证是否在“连接对象”实例 (3) 中准确定义了 Azure 资源管理器虚拟网络网关 VIP (5)。 Verify that the Azure Resource Manager virtual network gateway VIP (5) is defined accurately in the Connection object instance (3).

将经典虚拟网络连接到资源管理器虚拟网络Connect a classic virtual network to a Resource Manager virtual network

可以在位于不同订阅、不同区域中的虚拟网络之间创建连接。You can create a connection between virtual networks that are in different subscriptions and in different regions. 还可以连接已连接到本地网络的虚拟网络,前提是已将网关类型配置为基于路由。You can also connect virtual networks that already have connections to on-premises networks, as long as you have configured the gateway type as route-based.

若要在经典虚拟网络与资源管理器虚拟网络之间配置连接,请参阅使用 Azure 门户从不同的部署模型连接虚拟网络To configure a connection between a classic virtual network and a Resource Manager virtual network, see Connect virtual networks from different deployment models by using the Azure portal.

经典虚拟网络到 Azure 资源管理器虚拟网络的连接

若要检查将经典虚拟网络连接到 Azure 资源管理器虚拟网络时的配置,请按以下说明操作。To check the configuration when you connect a classic virtual network to an Azure Resource Manager virtual network, follow these instructions.

备注

在这些步骤中,虚拟网络组件后面的编号对应于上图中的编号。The numbers after virtual network components in these steps correspond to the numbers in the preceding diagram.

  1. 请确保连接的虚拟网络中不存在重叠的地址空间。Make sure there are no overlapping address spaces in the connected virtual networks.
  2. 验证是否在经典本地网络定义 (3) 中准确定义了 Azure 资源管理器虚拟网络的地址范围 (6)。Verify that the address range for the Azure Resource Manager virtual network (6) is defined accurately in the classic local network definition (3).
  3. 验证是否在 Azure 资源管理器“连接对象”实例 (4) 中准确定义了经典虚拟网络的地址范围 (1)。 Verify that the address range for the classic virtual network (1) is defined accurately in the Azure Resource Manager Connection object instance (4).
  4. 验证是否在 Azure 资源管理器“连接对象”实例 (4) 中准确定义了经典虚拟网络网关 VIP (2)。 Verify that the classic virtual network gateway VIP (2) is defined accurately in the Azure Resource Manager Connection object instance (4).
  5. 验证是否在经典“本地网络定义”实例 (3) 中准确定义了 Azure 资源管理器虚拟网络网关 (5)。 Verify that the Azure Resource Manager virtual network gateway (5) is defined accurately in the classic Local Network Definition instance (3).
  6. 验证两个连接的虚拟网络上的预共享密钥是否匹配:Verify that the pre-shared keys are matching on both connected virtual networks:
    • 经典虚拟网络:本地网络定义 (3)Classic virtual network: Local Network Definition (3)
    • Azure 资源管理器虚拟网络:连接对象 (4)Azure Resource Manager virtual network: Connection object (4)

创建点到站点 VPN 连接Create a point-to-site VPN connection

使用点到站点(下图中的 P2S)配置可以创建从单个客户端计算机到虚拟网络的安全连接。A point-to-site (P2S in the following diagram) configuration lets you create a secure connection from an individual client computer to a virtual network. 如果要从远程位置(例如,从家里或会议室)连接到虚拟网络,点到站点连接会很有用。Point-to-site connections are useful when you want to connect to your virtual network from a remote location, such as from home or a conference. 只有少数几个客户端需要连接到虚拟网络时,这种连接也很有用。They're also useful when you have only a few clients that need to connect to a virtual network.

点到站点 VPN 连接通过本机 Windows VPN 客户端从客户端计算机启动。The point-to-site VPN connection is initiated from the client computer through the native Windows VPN client. 连接客户端使用证书进行身份验证。Connecting clients use certificates to authenticate.

点到站点连接

点到站点连接不需要 VPN 设备。Point-to-site connections don't require a VPN device. 它们创建基于安全套接字隧道协议 (SSTP) 的 VPN 连接。They create the VPN connection over Secure Socket Tunneling Protocol (SSTP). 可以使用不同的部署工具和部署模型来与虚拟网络建立点到站点连接:You can connect a point-to-site connection to a virtual network by using various deployment tools and deployment models:

验证点到站点连接Validate your point-to-site connection

故障排除:Azure 点到站点连接问题一文逐步讲解了如何排查点到站点连接的常见问题。The article Troubleshooting: Azure point-to-site connection problems walks through common issues with point-to-site connections.

创建多站点 VPN 连接Create a multisite VPN connection

可将站点到站点(下图中的 S2S)连接添加到已建立站点到站点连接、点到站点连接或网络间连接的虚拟网络。You can add a site-to-site (S2S in the following diagram) connection to a virtual network that already has a site-to-site connection, point-to-site connection, or network-to-network connection. 这种连接通常称为多站点配置。 This kind of connection is often called a multisite configuration.

多站点连接

Azure 当前使用两种部署模型:资源管理器部署模型和经典部署模型。Azure currently works with two deployment models: Resource Manager and classic. 这两种模型彼此不完全兼容。The two models aren't completely compatible with each other. 若要使用不同的模型配置多站点连接,请参阅以下文章:To configure a multisite connection with different models, see the following articles:

备注

这些文章中的步骤不适用于 Azure ExpressRoute 和站点到站点共存连接配置。The steps in those articles don't apply to Azure ExpressRoute and site-to-site coexisting connection configurations. 有关详细信息,请参阅 ExpressRoute 和站点到站点共存连接For more information, see ExpressRoute and site-to-site coexisting connections.

配置传输路由Configure transit routing

传输路由是一种特定的路由方案,在其中可以“菊花链”拓扑的形式连接多个网络。Transit routing is a specific routing scenario where you connect multiple networks in a daisy-chain topology. 此路由方式可让链两端的虚拟网络中的资源通过其间的虚拟网络相互通信。This routing enables resources in virtual networks at either end of the chain to communicate with one another through virtual networks in between. 如果没有传输路由,通过中心对等互连的网络或设备无法相互访问。Without transit routing, networks or devices peered through a hub can't reach one another.

在点到站点连接中配置传输路由Configure transit routing in a point-to-site connection

假设你要在 VNetA 与 VNetB 之间配置站点到站点 VPN 连接。Imagine a scenario in which you want to configure a site-to-site VPN connection between VNetA and VNetB. 此外,你还想要配置点到站点 VPN,使客户端能够连接到 VNetA 的网关。You also want to configure a point-to-site VPN for the client to connect to the gateway of VNetA. 然后希望启用传输路由,使点到站点客户端能够通过 VNetA 连接到 VNetB。Then, you want to enable transit routing for the point-to-site clients to connect to VNetB, which passes through VNetA.

在 VNetA 与 VNetB 之间的站点到站点 VPN 上启用 BGP 后,将会支持此方案。This scenario is supported when BGP is enabled on the site-to-site VPN between VNetA and VNetB. 有关详细信息,请参阅关于点到站点 VPN 路由For more information, see About point-to-site VPN routing.

在 ExpressRoute 连接中配置传输路由Configure transit routing in an ExpressRoute connection

使用 Azure ExpressRoute 可通过连接服务提供商所提供的专用连接,将本地网络扩展到 Azure 云。Azure ExpressRoute lets you extend your on-premises networks into the Azure cloud over a dedicated private connection facilitated by a connectivity provider. 使用 ExpressRoute 可与 Azure、Office 365 和 Dynamics 365 等 Azure 云服务建立连接。With ExpressRoute, you can establish connections to Azure cloud services, such as Azure, Office 365, and Dynamics 365. 有关详细信息,请参阅 ExpressRoute 概述For more information, see ExpressRoute overview.

与 Azure虚拟网络建立 ExpressRoute 专用对等互连

备注

我们建议,如果 VNetA 和 VNetB 位于同一地缘政治区域,则将两个虚拟网络都链接到 ExpressRoute 线路,而不要配置传输路由。We recommend that if VNetA and VNetB are in the same geopolitical region, you link both virtual networks to the ExpressRoute circuit instead of configuring transit routing. 如果虚拟网络位于不同的地缘政治区域,并且你已获得 ExpressRoute 高级版,则也可以直接将虚拟网络链接到自己的线路。If your virtual networks are in different geopolitical regions, you can also link them to your circuit directly if you have ExpressRoute Premium.

如果 ExpressRoute 和站点到站点连接共存,则不支持传输路由。If you have ExpressRoute and site-to-site coexistence, transit routing isn't supported. 有关详细信息,请参阅使用 PowerShell 配置 ExpressRoute 和站点到站点连接For more information, see Configure ExpressRoute and site-to-site by using PowerShell.

如果已启用 ExpressRoute 以将本地网络连接到 Azure 虚拟网络,则可以在要使用传输路由的虚拟网络之间启用对等互连。If you have enabled ExpressRoute to connect your local networks to an Azure virtual network, you can enable peering between the virtual networks where you want to have transit routing. 要使本地网络能够连接到远程虚拟网络,必须配置虚拟网络对等互连To allow your local networks to connect to the remote virtual network, you must configure virtual network peering.

备注

虚拟网络对等互连仅适用于同一区域中的虚拟网络。Virtual network peering is available only for virtual networks in the same region.

若要检查是否为虚拟网络对等互连配置了传输路由,请按以下说明操作:To check whether you have configured transit routing for virtual network peering, follow these instructions:

  1. 使用具有必要角色和权限的帐户登录到 Azure 门户Sign in to the Azure portal by using an account that has the necessary roles and permissions.
  2. 按前面的示意图所示,在 VNetA 与 VNetB 之间创建对等互连Create a peering between VNetA and VNetB as shown in the earlier diagram.
  3. 在针对所选虚拟网络显示的窗格中,选择“设置”部分中的“对等互连”。 In the pane that appears for the virtual network, select Peerings in the Settings section.
  4. 选择要查看的对等互连。Select the peering you want to view. 然后选择“配置”,验证是否已在连接到 ExpressRoute 线路的 VNetA 网络上启用了“允许网关传输”,并在未连接到 ExpressRoute 线路的远程 VNetB 网络上启用了“使用远程网关”。 Then, select Configuration to validate that you have enabled Allow Gateway Transit on the VNetA network connected to the ExpressRoute circuit and Use Remote Gateway on the remote VNetB network not connected to the ExpressRoute circuit.

在虚拟网络对等互连中配置传输路由Configure transit routing in a virtual network peering connection

将虚拟网络对等互连后,还可以将对等虚拟网络中的网关配置为本地网络的传输点。When virtual networks are peered, you can also configure the gateway in the peered virtual network as a transit point to an on-premises network. 若要在虚拟网络对等互连中配置传输路由,请参阅网络间的连接To configure a transit route in virtual network peering, see Network-to-network connections.

备注

通过不同部署模型创建的虚拟网络之间的对等互连关系不支持网关传输。Gateway transit isn't supported in the peering relationship between virtual networks created through different deployment models. 若要使用网关传输,对等互连关系中的两个虚拟网络都必须通过资源管理器创建。Both virtual networks in the peering relationship must have been created through Resource Manager for gateway transit to work.

若要检查是否为虚拟网络对等互连配置了传输路由,请按以下说明操作:To check whether you have configured a transit route for virtual network peering, follow these instructions:

  1. 使用具有必要角色和权限的帐户登录到 Azure 门户Sign in to the Azure portal by using an account that has the necessary roles and permissions.

  2. 在门户顶部包含“搜索资源”文本的框中,键入“虚拟网络”。 In the box that contains the text Search resources at the top of the portal, type virtual networks. 当“虚拟网络”出现在搜索结果中时,请选择它。 When Virtual networks appears in the search results, select it.

  3. 在显示的“虚拟网络”边栏选项卡中,选择要检查其对等互连设置的虚拟网络。 In the Virtual networks blade that appears, select the virtual network for which you want to check the peering setting.

  4. 在针对所选虚拟网络显示的窗格中,选择“设置”部分中的“对等互连”。 In the pane that appears for the virtual network that you selected, select Peerings in the Settings section.

  5. 选择要查看的对等互连。Select the peering that you want to view. 在“配置”下验证是否已启用“允许网关传输”和“使用远程网关”。 Validate that you have enabled Allow gateway transit and Use remote gateways under Configuration.

    用于检查是否已为虚拟网络对等互连配置传输路由的选项

在网络间连接中配置传输路由Configure transit routing in a network-to-network connection

若要在虚拟网络之间配置传输路由,必须使用资源管理器部署模型和 PowerShell 在所有中间网络间连接上启用 BGP。To configure transit routing between virtual networks, you must enable BGP on all intermediate network-to-network connections by using the Resource Manager deployment model and PowerShell. 有关说明,请参阅如何使用 PowerShell 在 Azure VPN 网关上配置 BGPFor instructions, see How to configure BGP on Azure VPN gateways by using PowerShell.

使用经典部署模型通过 Azure VPN 网关传输流量是可行的,但依赖于网络配置文件中静态定义的地址空间。Transit traffic through Azure VPN gateways is possible through the classic deployment model, but that relies on statically defined address spaces in the network configuration file. 尚不支持通过经典部署模型使用 Azure 虚拟网络和 VPN 网关配置 BGP。BGP isn't yet supported with Azure virtual networks and VPN gateways through the classic deployment model. 如果没有 BGP,手动定义传输地址空间很容易出错,因此不建议这样做。Without BGP, manually defining transit address spaces is error prone, and we don't recommend it.

备注

可以使用 Azure 经典管理门户或使用经典管理门户中的网络配置文件来配置经典网络间连接。You configure classic network-to-network connections by using the Azure Classic Management Portal, or by using a network configuration file in the Classic Management Portal. 无法通过 Azure 资源管理器部署模型或 Azure 门户来创建或修改经典虚拟网络。You can't create or modify a classic virtual network through the Azure Resource Manager deployment model or the Azure portal. 有关经典虚拟网络传输路由的详细信息,请参阅 Microsoft 开发人员博客For more information on transit routing for classic virtual networks, see the Microsoft Developer blog.

在站点到站点连接中配置传输路由Configure transit routing in a site-to-site connection

若要在使用站点到站点连接的本地网络与虚拟网络之间配置传输路由,必须使用资源管理器部署模型和 PowerShell 在所有中间站点到站点连接上启用 BGP。To configure transit routing between your on-premises network and a virtual network with a site-to-site connection, you must enable BGP on all intermediate site-to-site connections by using the Resource Manager deployment model and PowerShell. 有关说明,请参阅如何使用 PowerShell 在 Azure VPN 网关上配置 BGPSee How to configure BGP on Azure VPN gateways by using PowerShell for instructions.

使用经典部署模型通过 Azure VPN 网关传输流量是可行的,但依赖于网络配置文件中静态定义的地址空间。Transit traffic through Azure VPN gateways is possible through the classic deployment model, but that relies on statically defined address spaces in the network configuration file. 尚不支持通过经典部署模型使用 Azure 虚拟网络和 VPN 网关配置 BGP。BGP isn't yet supported with Azure virtual networks and VPN gateways through the classic deployment model. 如果没有 BGP,手动定义传输地址空间很容易出错,因此不建议这样做。Without BGP, manually defining transit address spaces is error prone, and we don't recommend it.

备注

可以使用 Azure 经典管理门户或使用经典管理门户中的网络配置文件来配置经典站点到站点连接。You configure classic site-to-site connections by using the Azure Classic Management Portal, or by using a network configuration file in the Classic Management Portal. 无法通过 Azure 资源管理器部署模型或 Azure 门户来创建或修改经典虚拟网络。You can't create or modify a classic virtual network through the Azure Resource Manager deployment model or the Azure portal. 有关经典虚拟网络传输路由的详细信息,请参阅 Microsoft 开发人员博客For more information on transit routing for classic virtual networks, see the Microsoft Developer blog.

为 VPN 网关配置 BGPConfigure BGP for a VPN gateway

BGP 是在 Internet 上使用的,用于在两个或更多网络之间交换路由和可访问性信息的标准路由协议。BGP is the standard routing protocol used on the internet to exchange routing and reachability information between two or more networks. 在 Azure 虚拟网络的上下文中使用 BGP 时,BGP 支持 Azure VPN 网关和本地 VPN 设备(称为 BGP 对等节点或邻居)。When BGP is used in the context of Azure virtual networks, it enables the Azure VPN gateways and your on-premises VPN devices, known as BGP peers or neighbors. 这些设备会向这两个网关提供有关前缀可用性和可访问性的信息,以便通过所涉及的网关或路由器。They exchange "routes" that will inform both gateways on the availability and reachability for those prefixes to go through the gateways or routers involved.

此外,BGP 还可以通过将 BGP 网关从一个 BGP 对等节点获知的路由传播到所有其他 BGP 对等节点,以实现在多个网络之间传输路由。BGP can also enable transit routing among multiple networks by propagating routes that a BGP gateway learns from one BGP peer to all other BGP peers. 有关详细信息,请参阅使用 Azure VPN 网关的 BGP 概述For more information, see Overview of BGP with Azure VPN Gateway.

为 VPN 连接配置 BGPConfigure BGP for a VPN connection

若要配置使用 BGP 的 VPN 连接,请参阅使用 PowerShell 在 Azure VPN 网关上配置 BGPTo configure a VPN connection that uses BGP, see How to configure BGP on Azure VPN gateways by using PowerShell.

通过为虚拟网络网关创建自治系统 (AS) 编号在虚拟网络网关上启用 BGP。Enable BGP on the virtual network gateway by creating an autonomous system (AS) number for it. 基本网关不支持 BGP。Basic gateways don't support BGP. 若要检查网关的 SKU,请在 Azure 门户中转到“VPN 网关”边栏选项卡的“概述”部分。 To check the SKU of the gateway, go to the Overview section of the VPN Gateway blade in the Azure portal. 如果 SKU 为“基本”,则必须将 SKU(请参阅调整网关大小)更改为“VpnGw1”。 If your SKU is Basic, you have to change the SKU (see Resizing the gateway) to VpnGw1.

检查 SKU 会导致 20 到 30 分钟的停机时间。Checking the SKU will cause 20 to 30 minutes of downtime. 网关获得正确的 SKU 后,你可以使用 Set-AzureRmVirtualNetworkGateway PowerShell cmdlet 添加 AS 编号。As soon as the gateway has the correct SKU, you can add the AS number by using the Set-AzureRmVirtualNetworkGateway PowerShell commandlet. 配置 AS 编号后,系统会自动提供网关的 BGP 对等互连 IP。After you configure the AS number, a BGP peer IP for the gateway will be provided automatically.

必须使用 AS 编号和 BGP 对等互连地址手动提供 LocalNetworkGatewayYou must manually provide LocalNetworkGateway with an AS number and a BGP peer address. 可以使用 New-AzureRmLocalNetworkGatewaySet-AzureRmLocalNetworkGateway PowerShell cmdlet 设置 ASN-BgpPeeringAddress 值。You can set the ASN and -BgpPeeringAddress values by using either the New-AzureRmLocalNetworkGateway or the Set-AzureRmLocalNetworkGateway PowerShell commandlet. 某些 AS 编号是为 Azure 保留的,不能按关于使用 Azure VPN 网关的 BGP 中所述使用这些编号。Some AS numbers are reserved for Azure, and you can't use them as described in About BGP with Azure VPN Gateway.

必须为连接对象启用 BGP。The connection object must have BGP enabled. 可以通过 New-AzureRmVirtualNetworkGatewayConnectionSet-AzureRmVirtualNetworkGatewayConnection-EnableBGP 值设置为 $TrueYou can set the -EnableBGP value to $True through New-AzureRmVirtualNetworkGatewayConnection or Set-AzureRmVirtualNetworkGatewayConnection.

验证 BGP 配置Validate the BGP configuration

若要检查是否正确配置了 BGP,可以运行 get-AzureRmVirtualNetworkGatewayget-AzureRmLocalNetworkGateway cmdlet。To check whether BGP is configured correctly, you can run the get-AzureRmVirtualNetworkGateway and get-AzureRmLocalNetworkGateway commandlets. 然后,可以在 BgpSettingsText 部分看到 BGP 相关的输出。Then you'll notice BGP-related output in the BgpSettingsText part. 例如:For example:

{

"Asn": AsnNumber,

"BgpPeeringAddress": "IP address",

"PeerWeight": 0

}

创建高可用性主动/主动 VPN 连接Create a highly available active/active VPN connection

主动/主动与主动/待机网关之间的重要差异:The key differences between the active/active and active/standby gateways are:

  • 必须使用两个公共 IP 地址创建两个网关 IP 配置。You must create two gateway IP configurations with two public IP addresses.
  • 必须设置 EnableActiveActiveFeature 标志。You must set the EnableActiveActiveFeature flag.
  • 网关 SKU 必须是 VpnGw1VpnGw2VpnGw3The gateway SKU must be VpnGw1, VpnGw2, or VpnGw3.

若要实现跨界连接和网络间连接的高可用性,应该部署多个 VPN 网关,在网络与 Azure 之间建立多个并行连接。To achieve high availability for cross-premises and network-to-network connectivity, you should deploy multiple VPN gateways and establish multiple parallel connections between your networks and Azure. 有关连接选项和拓扑的概述,请参阅高可用性跨界连接和网络间连接For an overview of connectivity options and topology, see Highly available cross-premises and network-to-network connectivity.

若要创建主动/主动跨界连接和网络间连接,请按照配置与 Azure VPN 网关的主动/主动 S2S VPN 连接中的说明,以主动/主动模式配置 Azure VPN 网关。To create active/active cross-premises and network-to-network connections, follow the instructions in Configure active/active S2S VPN connections with Azure VPN gateways to configure an Azure VPN gateway in active/active mode.

备注

  • 将地址添加到启用了 BGP 的主动/主动模式的本地网络网关时,只会添加 BGP 对等互连的 /32 地址。 When you add addresses to the local network gateway for BGP-enabled active/active mode, add only the /32 addresses of the BGP peers. 如果添加更多地址,这些地址将被视为静态路由,并优先于 BGP 路由。If you add more addresses, they will be considered static routes and take precedence over BGP routes.
  • 对于连接到 Azure 的本地网络,必须使用不同的 BGP AS 编号。You must use different BGP AS numbers for your on-premises networks that are connecting to Azure. (如果它们是相同的,并且本地 VPN 设备已使用 ASN 与其他 BGP 邻居建立对等互连,则必须更改虚拟网络的 AS 编号。)(If they're the same, you have to change your virtual network AS number if your on-premises VPN device already uses the ASN to peer with other BGP neighbors.)

部署后更改 Azure VPN 网关类型Change an Azure VPN gateway type after deployment

无法将 Azure 虚拟网络网关类型从基于策略更改为基于路由,反之亦然。You can't change an Azure virtual network gateway type from policy-based to route-based or the other way directly. 必须先删除网关。You must first delete the gateway. 之后,IP 地址和预共享密钥不会保留。After that, the IP address and the pre-shared key won't be preserved. 然后可以创建所需类型的新网关。Then you can create a new gateway of the desired type.

若要删除并创建网关,请执行以下步骤:To delete and create a gateway, follow these steps:

  1. 删除与原始网关相关联的所有连接。Delete any connections associated with the original gateway.
  2. 使用 Azure 门户、PowerShell 或经典 PowerShell 删除网关:Delete the gateway by using the Azure portal, PowerShell, or classic PowerShell:
  3. 遵循创建 VPN 网关中的步骤创建所需类型的新网关,并完成 VPN 设置。Follow the steps in Create the VPN gateway to create the new gateway of the desired type and complete the VPN setup.

备注

此过程将花费大约 60 分钟时间。This process will take around 60 minutes.

后续步骤Next steps