方案:Azure 防火墙 - 自定义Scenario: Azure Firewall - custom

使用虚拟 WAN 虚拟中心路由时,有很多可用方案。When working with Virtual WAN virtual hub routing, there are quite a few available scenarios. 在此方案中,目标是在 VNet 之间直接路由流量,但对 VNet 到 Internet/分支和分支到 VNet 的流量流使用 Azure 防火墙。In this scenario, the goal is to route traffic between VNets directly, but use Azure Firewall for VNet-to-Internet/Branch and Branch-to-VNet traffic flows.

设计Design

为了确定需要多少路由表,可以构建一个连接矩阵,其中每个单元格都表示源(行)是否可以与目标(列)通信。In order to figure out how many route tables will be needed, you can build a connectivity matrix, where each cell represents whether a source (row) can communicate to a destination (column). 此方案中的连接矩阵很普通,但需要与其他方案保持一致,仍然有待我们进行研究。The connectivity matrix in this scenario is trivial, but be consistent with other scenarios, we can still look at it.

连接矩阵Connectivity matrix

From 到:To: VNetVNets 分支Branches InternetInternet
VNetVNets XX AzFWAzFW AzFWAzFW
分支Branches AzFWAzFW XX XX

在上一个表中,“X”表示两个连接之间的直接连接,流量不穿过虚拟 WAN 中的 Azure 防火墙,而“AzFW”表示该流将通过 Azure 防火墙。In the previous table, an "X" represents direct connectivity between two connections without the traffic traversing the Azure Firewall in Virtual WAN, and "AzFW" indicates that the flow will go through the Azure Firewall. 由于矩阵中有两个不同的连接模式,我们将需要两个路由表,这两个表将配置如下:Since there are two distinct connectivity patterns in the matrix, we will need two route tables that will be configured as follows:

  • 虚拟网络:Virtual networks:
    • 关联的路由表: RT_VNetAssociated route table: RT_VNet
    • 传播到路由表: RT_VNetPropagating to route tables: RT_VNet
  • 分支:Branches:
    • 关联的路由表: 默认Associated route table: Default
    • 传播到路由表: 默认Propagating to route tables: Default

备注

你可以在每个区域中使用单个安全虚拟中心创建一个单独的虚拟 WAN 实例,然后可以通过站点到站点 VPN 将每个虚拟 WAN 互相连接。You can create a separate Virtual WAN instance with one single Secure Virtual Hub in each region, and then you can connect each Virtual WAN to each other via Site-to-Site VPN.

有关虚拟中心路由的信息,请参阅关于虚拟中心路由For information about virtual hub routing, see About virtual hub routing.

工作流Workflow

在此方案中,你希望通过 Azure 防火墙为 VNet 到 Internet、VNet 到分支或分支到 VNet 的流量路由流量,但想要直接路由 VNet 到 VNet 的流量。In this scenario, you want to route traffic through the Azure Firewall for VNet-to-Internet, VNet-to-Branch, or Branch-to-VNet traffic, but would like to go direct for VNet-to-VNet traffic. 如果使用了 Azure 防火墙管理器,则路由设置会自动填充到默认路由表中。If you used Azure Firewall Manager, the route settings are automatically populated into the Default Route Table . 专用流量适用于 VNet 和分支,Internet 流量适用于 0.0.0.0/0。Private Traffic applies to VNet and Branches, Internet traffic applies to 0.0.0.0/0.

VPN、ExpressRoute 和用户 VPN 连接统称为“分支”,并与同一(默认)路由表关联。VPN, ExpressRoute, and User VPN connections are collectively called Branches and associate to the same (Default) route table. 所有 VPN、ExpressRoute 和用户 VPN 连接将路由传播到同一组路由表。All VPN, ExpressRoute, and User VPN connections propagate routes to the same set of route tables. 若要配置此方案,请考虑以下步骤:In order to configure this scenario, take the following steps into consideration:

  1. 创建自定义路由表 RT_VNetCreate a custom route table RT_VNet .

  2. 创建用于激活 VNet 到 Internet 和 VNet 到分支的路由:0.0.0.0/0 且下一跃点指向 Azure 防火墙。Create a route to activate VNet-to-Internet and VNet-to-Branch: 0.0.0.0/0 with the next hop pointing to Azure Firewall. 在“传播”部分中,确保选择了 VNet,这将确保创建更具体的路由,从而允许 VNet 到 VNet 的直接流量流。In the Propagation section, you'll make sure that VNets are selected which would ensure more specific routes, thereby allowing VNet-to-VNet direct traffic flow.

    • 在“关联”中:选择 VNet,这表示 VNet 将根据此路由表的路由到达目标。In Association: Select VNets that will imply that VNets will reach destination according to the routes of this route table.
    • 在“传播”中:选择 VNet,这表示 VNet 传播到此路由表;换而言之,更具体的路由将传播到此路由表,从而确保 VNet 到 VNet 之间的直接流量流。In Propagation: Select VNets that will imply that the VNets propagate to this route table; in other words, more specific routes will propagate to this route table, thereby ensuring direct traffic flow between VNet to VNet.
  3. 将 VNet 的聚合静态路由添加到默认路由表中,以通过 Azure 防火墙激活分支到 VNet 流。Add an aggregated static route for VNets into the Default Route table to activate the Branch-to-VNet flow via the Azure Firewall.

    • 请记住,分支是关联的并传播到默认路由表。Remember, branches are associated and propagating to the default route table.
    • 分支不会传播到 RT_VNet 路由表。Branches do not propagate to RT_VNet route table. 这样可通过 Azure 防火墙确保 VNet 到分支的流量流。This ensures the VNet-to-Branch traffic flow via the Azure Firewall.

这将导致路由配置更改,如图 1 所示。This will result in the routing configuration changes as shown in Figure 1 .

图 1Figure 1

图 1

备注

虚拟 WAN 中心和连接的虚拟网络应当位于同一 Azure 区域中。The Virtual WAN hubs and the connected virtual networks should be in the same Azure region.

后续步骤Next steps