虚拟 WAN 常见问题解答Virtual WAN FAQ

Azure 虚拟 WAN 是否已正式发布 (GA)?Is Azure Virtual WAN in GA?

是,Azure 虚拟 WAN 已正式发布 (GA)。Yes, Azure Virtual WAN is Generally Available (GA). 但是,虚拟 WAN 包含若干功能和方案。However, Virtual WAN consists of several features and scenarios. 虚拟 WAN 中有 Azure 应用“预览”标记的功能或方案。There are feature or scenarios within Virtual WAN where Azure applies the Preview tag. 在这些情况下,特定的功能或者方案本身处于预览阶段。In those cases, the specific feature, or the scenario itself, is in Preview. 如果你未使用特定的预览功能,则常规 GA 支持适用。If you do not use a specific preview feature, regular GA support applies. 有关预览版支持的详细信息,请参阅 Azure 预览版补充使用条款For more information about Preview support, see Supplemental Terms of Use for Azure Previews.

用户是否需要将中心辐射型拓扑与 SD-WAN/VPN 设备配合使用才能使用 Azure 虚拟 WAN?Does the user need to have hub and spoke with SD-WAN/VPN devices to use Azure Virtual WAN?

虚拟 WAN 提供了许多内置于单个窗格中的功能,例如站点/站点到站点 VPN 连接、用户/P2S 连接、ExpressRoute 连接、虚拟网络连接、VPN ExpressRoute 互连、VNet 到 VNet 可传递连接、集中路由、Azure 防火墙和防火墙管理器安全性、监视、ExpressRoute 加密以及许多其他功能。Virtual WAN provides many functionalities built into a single pane of glass such as Site/Site-to-site VPN connectivity, User/P2S connectivity, ExpressRoute connectivity, Virtual Network connectivity, VPN ExpressRoute Interconnectivity, VNet-to-VNet transitive connectivity, Centralized Routing, Azure Firewall and Firewall Manager security, Monitoring, ExpressRoute Encryption, and many other capabilities. 无需所有这些用例即可开始使用虚拟 WAN。You do not have to have all of these use-cases to start using Virtual WAN. 仅需一个用例即可开始使用。You can get started with just one use case.

虚拟 WAN 体系结构是一种内置了规模和性能的中心辐射型体系结构,其中的分支(VPN/SD-WAN 设备)、用户(Azure VPN 客户端、openVPN 或 IKEv2 客户端)、ExpressRoute 线路和虚拟网络充当虚拟中心的辐条。The Virtual WAN architecture is a hub and spoke architecture with scale and performance built in where branches (VPN/SD-WAN devices), users (Azure VPN Clients, openVPN, or IKEv2 Clients), ExpressRoute circuits, Virtual Networks serve as spokes to virtual hub(s). 所有中心均在标准虚拟 WAN 中以完整网格的形式进行连接,使得用户能够轻松地使用 Microsoft 主干进行任意分支到任意分支的连接。All hubs are connected in full mesh in a Standard Virtual WAN making it easy for the user to use the Microsoft backbone for any-to-any (any spoke) connectivity. 对于包含 SD-WAN/VPN 设备的中心辐射型体系结构,用户可以在 Azure 虚拟 WAN 门户中手动设置该它,也可以使用虚拟 WAN 合作伙伴 CPE (SD-WAN/VPN) 来设置与 Azure 的连接。For hub and spoke with SD-WAN/VPN devices, users can either manually set it up in the Azure Virtual WAN portal or use the Virtual WAN Partner CPE (SD-WAN/VPN) to set up connectivity to Azure.

虚拟 WAN 合作伙伴提供自动进行连接的功能:将设备信息导出到 Azure 中,下载 Azure 配置,然后建立与 Azure 虚拟 WAN 中心的连接。Virtual WAN partners provide automation for connectivity, which is the ability to export the device info into Azure, download the Azure configuration and establish connectivity to the Azure Virtual WAN hub. 对于点到站点/用户 VPN 连接,我们支持 Azure VPN 客户端、OpenVPN 或 IKEv2 客户端。For Point-to-site/User VPN connectivity, we support Azure VPN client, OpenVPN, or IKEv2 client.

可否在虚拟 WAN 中禁用全网格式中心?Can you disable fully meshed hubs in a Virtual WAN?

虚拟 WAN 有两种形式:“基本”和“标准”。Virtual WAN comes in two flavors: Basic and Standard. 在基本虚拟 WAN 中,中心不是网格式的。In Basic Virtual WAN, hubs are not meshed. 在标准虚拟 WAN 中,中心是网格式的,并且可在首次设置虚拟 WAN 后自动连接。In a Standard Virtual WAN, hubs are meshed and automatically connected when the virtual WAN is first set up. 用户无需执行任何特定操作,The user does not need to do anything specific. 也无需禁用或启用获取网格式中心的功能。The user also does not have to disable or enable the functionality to obtain meshed hubs. 虚拟 WAN 提供了许多路由选项,用于引导任何分支(VNet、VPN 或 ExpressRoute)之间的通信。Virtual WAN provides you many routing options to steer traffic between any spoke (VNet, VPN, or ExpressRoute). 它兼具全网格式中心的易用性和根据需求路由流量的灵活性。It provides the ease of fully meshed hubs, and also the flexibility of routing traffic per your needs.

Azure 虚拟 WAN 用户 VPN(点到站点)支持什么客户端?What client does the Azure Virtual WAN User VPN (Point-to-site) support?

虚拟 WAN 支持 Azure VPN 客户端、OpenVPN 客户端或任何 IKEv2 客户端。Virtual WAN supports Azure VPN client, OpenVPN Client, or any IKEv2 client. Azure VPN 客户端支持 Azure AD 身份验证。至少需要 Windows 10 客户端 OS 17763.0 或更高版本。Azure AD authentication is supported with Azure VPN Client.A minimum of Windows 10 client OS version 17763.0 or higher is required. OpenVPN 客户端可以支持基于证书的身份验证。OpenVPN client(s) can support certificate-based authentication. 在网关上选择基于证书的身份验证后,可看到需下载到设备的 .ovpn* 文件。Once cert-based auth is selected on the gateway, you will see the.ovpn* file to download to your device. IKEv2 支持证书和 RADIUS 身份验证。IKEv2 supports both certificate and RADIUS authentication.

就用户 VPN(点到站点)来说,为什么将 P2S 客户端池拆分为两个路由?For User VPN (Point-to-site)- Why is the P2S client pool split into two routes?

每个网关都有两个实例,进行拆分是为了使每个网关实例可以独立地为连接的客户端分配客户端 IP,并将来自虚拟网络的流量路由回正确的网关实例,避免网关间的实例跃点。Each gateway has two instances, the split happens so that each gateway instance can independently allocate client IPs for connected clients and traffic from the virtual network is routed back to the correct gateway instance to avoid inter-gateway instance hop.

如何为 P2S 客户端添加 DNS 服务器?How do I add DNS servers for P2S clients?

可以通过两个选项为 P2S 客户端添加 DNS 服务器。There are two options to add DNS servers for the P2S clients. 首选第一种方法,因为它将自定义 DNS 服务器添加到网关而不是客户端。The first method is preferred as it adds the custom DNS servers to the gateway instead of the client.

  1. 使用以下 PowerShell 脚本添加自定义 DNS 服务器。Use the following PowerShell script to add the custom DNS servers. 将值替换为你环境的值。Replace the values for your environment.

    // Define variables
    $rgName = "testRG1"
    $virtualHubName = "virtualHub1"
    $P2SvpnGatewayName = "testP2SVpnGateway1"
    $vpnClientAddressSpaces = 
    $vpnServerConfiguration1Name = "vpnServerConfig1"
    $vpnClientAddressSpaces = New-Object string[] 2
    $vpnClientAddressSpaces[0] = ""
    $vpnClientAddressSpaces[1] = ""
    $customDnsServers = New-Object string[] 2
    $customDnsServers[0] = ""
    $customDnsServers[1] = ""
    $virtualHub = $virtualHub = Get-AzVirtualHub -ResourceGroupName $rgName -Name $virtualHubName
    $vpnServerConfig1 = Get-AzVpnServerConfiguration -ResourceGroupName $rgName -Name $vpnServerConfiguration1Name
    // Specify custom dns servers for P2SVpnGateway VirtualHub while creating gateway
    createdP2SVpnGateway = New-AzP2sVpnGateway -ResourceGroupName $rgname -Name $P2SvpnGatewayName -VirtualHub $virtualHub -VpnGatewayScaleUnit 1 -VpnClientAddressPool $vpnClientAddressSpaces -VpnServerConfiguration $vpnServerConfig1 -CustomDnsServer $customDnsServers
    // Specify custom dns servers for P2SVpnGateway VirtualHub while updating existing gateway
    $P2SVpnGateway = Get-AzP2sVpnGateway -ResourceGroupName $rgName -Name $P2SvpnGatewayName
    $updatedP2SVpnGateway = Update-AzP2sVpnGateway -ResourceGroupName $rgName -Name $P2SvpnGatewayName  -CustomDnsServer $customDnsServers 
    // Re-generate Vpn profile either from PS/Portal for Vpn clients to have the specified dns servers
  2. 或者,如果你使用的是适用于 Windows 10 的 Azure VPN 客户端,则可修改下载的 XML 配置文件,在导入该文件之前添加 <dnsservers><dnsserver> </dnsserver></dnsservers> 标记。Or, if you are using the Azure VPN Client for Windows 10, you can modify the downloaded profile XML file and add the <dnsservers><dnsserver> </dnsserver></dnsservers> tags before importing it.


就用户 VPN(点到站点)来说,支持多少个客户端?For User VPN (Point-to-site)- how many clients are supported?

每个用户 VPN P2S 网关都有两个实例。Each User VPN P2S gateway has two instances. 每个实例在缩放单位变化时最多支持特定数量的连接。Each instance supports up to a certain number of connections as the scale unit changes. 缩放单元 1-3 支持 500 个连接,缩放单元 4-6 支持 1000 个连接,缩放单元 7-12 支持 5000 个连接,缩放单元 13-18 支持最多 10,000 个连接。Scale unit 1-3 supports 500 connections, scale unit 4-6 supports 1000 connections, scale unit 7-12 supports 5000 connections, and scale unit 13-18 supports up to 10,000 connections.

例如,假设用户选择 1 个缩放单元。For example, let's say the user chooses 1 scale unit. 每个缩放单元的存在都意味着已部署主动-主动网关,并且每个实例(在本例中为 2 个)都支持最多 500 个连接。Each scale unit would imply an active-active gateway deployed and each of the instances (in this case 2) would support up to 500 connections. 每个网关可以获得 500 * 2 个连接,但这并不意味着你要为此缩放单元的 1000 个(而不是 500 个)连接做规划。Since you can get 500 connections * 2 per gateway, it does not mean that you plan for 1000 instead of the 500 for this scale unit. 系统可能需要为实例提供服务,而在服务期间,当你超过建议的连接数时,系统可能会中断这额外的 500 个连接。Instances may need to be serviced during which connectivity for the extra 500 may be interrupted if you surpass the recommended connection count. 此外,如果决定在缩放单元上纵向扩展或缩减,或者在 VPN 网关上更改点到站点配置,请确保计划停机时间。Also, be sure to plan for downtime in case you decide to scale up or down on the scale unit, or change the point-to-site configuration on the VPN gateway.

Azure 虚拟网络网关(VPN 网关)和 Azure 虚拟 WAN VPN 网关之间有什么区别?What is the difference between an Azure virtual network gateway (VPN Gateway) and an Azure Virtual WAN VPN gateway?

虚拟 WAN 提供大规模站点到站点连接,在设计上考虑到了吞吐量、可伸缩性和易用性。Virtual WAN provides large-scale site-to-site connectivity and is built for throughput, scalability, and ease of use. 将站点连接到虚拟 WAN VPN 网关时,它不同于使用网关类型 “VPN”的常规虚拟网络网关。When you connect a site to a Virtual WAN VPN gateway, it is different from a regular virtual network gateway that uses a gateway type 'VPN'. 同样,将 ExpressRoute 线路连接到虚拟 WAN 中心时,它对 ExpressRoute 网关使用的资源与对使用“ExpressRoute”网关类型的常规虚拟网络网关使用的资源不同。Similarly, when you connect an ExpressRoute circuit to a Virtual WAN hub, it uses a different resource for the ExpressRoute gateway than the regular virtual network gateway that uses gateway type 'ExpressRoute'.

对于 VPN 和 ExpressRoute,虚拟 WAN 最多支持 20 Gbps 聚合吞吐量。Virtual WAN supports up to 20 Gbps aggregate throughput both for VPN and ExpressRoute. 虚拟 WAN 还实现了与 CPE 分支设备合作伙伴生态系统的连接自动化。Virtual WAN also has automation for connectivity with an ecosystem of CPE branch device partners. CPE 分支设备具有自动预配并连接到 Azure 虚拟 WAN 的内置自动化。CPE branch devices have built-in automation that autoprovisions and connects into Azure Virtual WAN. 这些设备由一个不断扩张的 SD-WAN 和 VPN 合作伙伴生态系统提供。These devices are available from a growing ecosystem of SD-WAN and VPN partners. 请参阅首选合作伙伴列表See the Preferred Partner List.

虚拟 WAN 与 Azure 虚拟网络网关有何不同?How is Virtual WAN different from an Azure virtual network gateway?

虚拟网络网关 VPN 限制为 30 个隧道。A virtual network gateway VPN is limited to 30 tunnels. 对于连接,应当为大型 VPN 使用虚拟 WAN。For connections, you should use Virtual WAN for large-scale VPN. 每个区域(虚拟中心)最多可以连接 1,000 个分支连接,每个中心有 20 Gbps 聚合。You can connect up to 1,000 branch connections per region (virtual hub) with aggregate of 20 Gbps per hub. 连接是从本地 VPN 设备到虚拟中心的主动-主动隧道。A connection is an active-active tunnel from the on-premises VPN device to the virtual hub. 每个区域中可以有一个中心,这意味着你可以跨中心连接到 1,000 多个分支。You can have one hub per region, which means you can connect more than 1,000 branches across hubs.

什么是虚拟 WAN 网关缩放单元?What is a Virtual WAN gateway scale unit?

根据定义,缩放单元是用于选择虚拟中心内网关的聚合吞吐量的单位。A scale unit is a unit defined to pick an aggregate throughput of a gateway in Virtual hub. 1 个缩放单元的 VPN 为 500 Mbps。1 scale unit of VPN = 500 Mbps. 1 个缩放单元的 ExpressRoute 为 2 Gbps。1 scale unit of ExpressRoute = 2 Gbps. 示例:10 个缩放单元的 VPN:500 Mbps * 10 = 5 GbpsExample: 10 scale unit of VPN would imply 500 Mbps * 10 = 5 Gbps

支持哪些设备提供商(虚拟 WAN 合作伙伴)?Which device providers (Virtual WAN partners) are supported?

目前,许多合作伙伴都支持全自动虚拟 WAN 体验。At this time, many partners support the fully automated Virtual WAN experience. 有关详细信息,请参阅虚拟 WAN 合作伙伴For more information, see Virtual WAN partners.

虚拟 WAN 合作伙伴自动化步骤有哪些?What are the Virtual WAN partner automation steps?

有关合作伙伴自动化步骤,请参阅虚拟 WAN 合作伙伴自动化For partner automation steps, see Virtual WAN partner automation.

是否需要使用首选的合作伙伴设备?Am I required to use a preferred partner device?

不是。No. 可以使用任何支持 VPN 且符合 Azure 对 IKEv2/IKEv1 IPsec 的支持要求的设备。You can use any VPN-capable device that adheres to the Azure requirements for IKEv2/IKEv1 IPsec support. 虚拟 WAN 还具有 CPE 合作伙伴解决方案,该解决方案可自动连接到 Azure 虚拟 WAN,使大规模设置 IPsec VPN 连接变得更加容易。Virtual WAN also has CPE partner solutions that automate connectivity to Azure Virtual WAN making it easier to set up IPsec VPN connections at scale.

虚拟 WAN 合作伙伴如何自动与 Azure 虚拟 WAN 建立连接?How do Virtual WAN partners automate connectivity with Azure Virtual WAN?

软件定义的连接解决方案通常使用控制器或设备预配中心来管理其分支设备。Software-defined connectivity solutions typically manage their branch devices using a controller, or a device provisioning center. 控制器可以使用 Azure API 自动与 Azure 虚拟 WAN 建立连接。The controller can use Azure APIs to automate connectivity to the Azure Virtual WAN. 自动化包括上传分支信息、下载 Azure 配置、将 IPsec 隧道设置到 Azure 虚拟中心,以及自动设置从分支设备到 Azure 虚拟 WAN 的连接。The automation includes uploading branch information, downloading the Azure configuration, setting up IPsec tunnels into Azure Virtual hubs, and automatically setting up connectivity form the branch device to Azure Virtual WAN. 当有数百个分支时,可以轻松使用虚拟 WAN CPE 合作伙伴进行连接,因为载入体验无需设置、配置和管理大规模的 IPsec 连接。When you have hundreds of branches, connecting using Virtual WAN CPE Partners is easy because the onboarding experience takes away the need to set up, configure, and manage large-scale IPsec connectivity. 有关详细信息,请参阅虚拟 WAN 合作伙伴自动化For more information, see Virtual WAN partner automation.

如果使用的设备不在虚拟 WAN 合作伙伴列表中,该怎么办?What if a device I am using is not in the Virtual WAN partner list? 还可以用它来连接到 Azure 虚拟 WAN VPN 吗?Can I still use it to connect to Azure Virtual WAN VPN?

是的,只要设备支持 IPsec IKEv1 或 IKEv2 即可。Yes as long as the device supports IPsec IKEv1 or IKEv2. 虚拟 WAN 合作伙伴自动执行设备到 Azure VPN 端点的连接。Virtual WAN partners automate connectivity from the device to Azure VPN end points. 这表示自动执行“分支信息上传”、“IPsec 和配置”以及“连接”等步骤。This implies automating steps such as 'branch information upload', 'IPsec and configuration' and 'connectivity'. 由于设备不是来自虚拟 WAN 合作伙伴生态系统,因此需要大量手动执行 Azure 配置和更新设备才能建立 IPsec 连接。Because your device is not from a Virtual WAN partner ecosystem, you will need to do the heavy lifting of manually taking the Azure configuration and updating your device to set up IPsec connectivity.

没有在启动合作伙伴列表中列出的新合作伙伴如何加入?How do new partners that are not listed in your launch partner list get onboarded?

所有虚拟 WAN API 都是开放式 API。All virtual WAN APIs are open API. 可以重新查看文档虚拟 WAN 合作伙伴自动化,评估技术可行性。You can go over the documentation Virtual WAN partner automation to assess technical feasibility. 理想的合作伙伴具有可以预配 IKEv1 或 IKEv2 IPsec 连接的设备。An ideal partner is one that has a device that can be provisioned for IKEv1 or IKEv2 IPsec connectivity. 在公司根据上面提供的自动化指导原则完成其 CPE 设备的自动化工作后,你可以联系 azurevirtualwan@microsoft.com,以便将自己纳入通过合作伙伴建立连接列表中。Once the company has completed the automation work for their CPE device based on the automation guidelines provided above, you can reach out to azurevirtualwan@microsoft.com to be listed here Connectivity through partners. 如果你是一位客户,并且希望将某个公司的解决方案列为虚拟 WAN 合作伙伴,请让该公司通过向 azurevirtualwan@microsoft.com 发送电子邮件联系虚拟 WAN。If you are a customer that would like a certain company solution to be listed as a Virtual WAN partner, have the company contact the Virtual WAN by sending an email to azurevirtualwan@microsoft.com.

虚拟 WAN 如何支持 SD-WAN 设备?How is Virtual WAN supporting SD-WAN devices?

虚拟 WAN 合作伙伴自动执行 Azure VPN 端点的 IPsec 连接。Virtual WAN partners automate IPsec connectivity to Azure VPN end points. 如果虚拟 WAN 合作伙伴是 SD-WAN 提供商,则表示 SD-WAN 控制器管理到 Azure VPN 端点的自动化和 IPsec 连接。If the Virtual WAN partner is an SD-WAN provider, then it is implied that the SD-WAN controller manages automation and IPsec connectivity to Azure VPN end points. 如果 SD-WAN 设备需要自己的端点而不是 Azure VPN 来实现任何专有 SD-WAN 功能,则可以在 Azure VNet 中部署 SD-WAN 端点并与 Azure 虚拟 WAN 共存。If the SD-WAN device requires its own end point instead of Azure VPN for any proprietary SD-WAN functionality, you can deploy the SD-WAN end point in an Azure VNet and coexist with Azure Virtual WAN.

允许多少 VPN 设备连接到单个中心?How many VPN devices can connect to a single hub?

每个虚拟中心最多支持 1,000 个连接。Up to 1,000 connections are supported per virtual hub. 每个连接包括四条链路,每条链路连接支持采用主动-主动配置的两个隧道。Each connection consists of four links and each link connection supports two tunnels that are in an active-active configuration. 隧道在 Azure 虚拟中心 VPN 网关中终止。The tunnels terminate in an Azure virtual hub VPN gateway. 链接表示分支/VPN 设备上的物理 ISP 链接。Links represent the physical ISP link at the branch/VPN device.

到 Azure 虚拟 WAN 的分支连接是什么?What is a branch connection to Azure Virtual WAN?

从分支或 VPN 设备到 Azure 虚拟 WAN 的连接是一个 VPN 连接,它实际上连接了虚拟中心内的 VPN 站点和 Azure VPN 网关。A connection from a branch or VPN device into Azure Virtual WAN is a VPN connection that connects virtually the VPN Site and the Azure VPN Gateway in a virtual hub.

如果本地 VPN 设备只有 1 个隧道通往一个 Azure 虚拟 WAN VPN 网关,会发生什么情况?What happens if the on-premises VPN device only has 1 tunnel to an Azure Virtual WAN VPN gateway?

Azure 虚拟 WAN 连接包含 2 个隧道。An Azure Virtual WAN connection is composed of 2 tunnels. 虚拟 WAN VPN 网关以主动-主动模式部署在虚拟中心,这意味着本地设备中有单独的隧道在单独的实例上终止。A Virtual WAN VPN gateway is deployed in a virtual hub in active-active mode, which implies that there are separate tunnels from on-premises devices terminating on separate instances. 建议所有用户都采用这种形式。This is the recommendation for all users. 但是,如果用户选择只有 1 个隧道通往一个虚拟 WAN VPN 网关实例,那么当出于任何原因(维护、修补等),网关实例处于脱机状态时,该隧道将移动到辅助活动实例,并且用户可能会遭遇重新连接的情况。However, if the user chooses to only have 1 tunnel to one of the Virtual WAN VPN gateway instances, if for any reason (maintenance, patches etc.) the gateway instance is taken offline, the tunnel will be moved to the secondary active instance and the user may experience a reconnect. BGP 会话不会在实例之间移动。BGP sessions will not move across instances.

本地 VPN 设备是否可以连接到多个中心?Can the on-premises VPN device connect to multiple hubs?

是的。Yes. 开始时的流量流将从本地设备发送到最近的 Azure 网络边缘,然后才发送到虚拟中心。Traffic flow, when commencing, is from the on-premises device to the closest Azure network edge, and then to the virtual hub.

虚拟 WAN 是否有新的可用资源管理器资源?Are there new Resource Manager resources available for Virtual WAN?

是的,虚拟 WAN 有新的资源管理器资源。Yes, Virtual WAN has new Resource Manager resources. 有关详细信息,请参阅概述For more information, please see the Overview.

是否可以在 Azure 虚拟 WAN 中部署和使用我偏爱的网络虚拟设备(在 NVA VNet 中)?Can I deploy and use my favorite network virtual appliance (in an NVA VNet) with Azure Virtual WAN?

是的,可以将你偏爱的网络虚拟设备 (NVA) VNet 连接到 Azure Virtual WAN。Yes, you can connect your favorite network virtual appliance (NVA) VNet to the Azure Virtual WAN.

可以在虚拟中心内创建网络虚拟设备吗?Can I create a Network Virtual Appliance inside the virtual hub?

无法在虚拟中心内部署网络虚拟设备 (NVA)。A Network Virtual Appliance (NVA) cannot be deployed inside a virtual hub. 但是,可以在连接到虚拟中心的分支 VNet 中创建它,并根据需要启用适当的路由定向流量。However, you can create it in a spoke VNet that is connected to the virtual hub and enable appropriate routing to direct traffic per your needs.

辐射 VNet 是否可以包含虚拟网络网关?Can a spoke VNet have a virtual network gateway?

不是。No. 如果辐射 VNet 已连接到虚拟中心,则不能包含虚拟网络网关。The spoke VNet cannot have a virtual network gateway if it is connected to the virtual hub.

VPN 连接是否支持 BGP?Is there support for BGP in VPN connectivity?

是的,支持 BGP。Yes, BGP is supported. 创建 VPN 站点时,可以在其中提供 BGP 参数。When you create a VPN site, you can provide the BGP parameters in it. 这表示在 Azure 中为该站点创建的任何连接都将启用 BGP。This will imply that any connections created in Azure for that site will be enabled for BGP.

虚拟 WAN 是否有任何许可或定价信息?Is there any licensing or pricing information for Virtual WAN?

是的。Yes. 请参阅定价页面。See the Pricing page.

是否可以使用资源管理器模板构造 Azure 虚拟 WAN?Is it possible to construct Azure Virtual WAN with a Resource Manager template?

可以使用快速入门模板创建具有单个中心和单个 VPN 站点的单个虚拟 WAN 的简单配置。A simple configuration of one Virtual WAN with one hub and one vpnsite can be created using an quickstart template. 虚拟 WAN 从根本上来说是一种 REST 或门户驱动的服务。Virtual WAN is primarily a REST or portal driven service.

连接到虚拟中心的分支 VNet 能否相互通信(V2V 传输)?Can spoke VNets connected to a virtual hub communicate with each other (V2V Transit)?

是的。Yes. 标准虚拟 WAN 支持通过 VNet 所连接到的虚拟 WAN 中心建立 VNet 到 VNet 可传递连接。Standard Virtual WAN supports VNet-to-VNet transitive connectivity via the Virtual WAN hub that the VNets are connected to. 在虚拟 WAN 的术语中,对于已连接到单个区域中的虚拟 WAN 中心的 VNet,这些路径被称为“本地虚拟 WAN VNet 传输”,而对于通过多个虚拟 WAN 中心跨两个或更多个区域连接的 VNet,则称为“全局虚拟 WAN VNet 传输”。In Virtual WAN terminology, we refer to these paths as “local Virtual WAN VNet transit” for VNets connected to a Virtual Wan hub within a single region, and “global Virtual WAN VNet transit” for VNets connected through multiple Virtual WAN hubs across two or more regions.

在某些方案中,除了本地或全局虚拟 WAN VNet 传输,还可使用虚拟网络对等互连将各分支 VNet 直接对等互连。In some scenarios, spoke VNets can also be directly peered with each other using virtual network peering in addition to local or global Virtual WAN VNet transit. 在这种情况下,VNet 对等互连优先于通过虚拟 WAN 中心建立的可传递连接。In this case, VNet Peering takes precedence over the transitive connection via the Virtual WAN hub.

虚拟 WAN 中是否允许分支到分支连接?Is branch-to-branch connectivity allowed in Virtual WAN?

是的,分支到分支连接在虚拟 WAN 中可用。Yes, branch-to-branch connectivity is available in Virtual WAN. 分支在概念上适用于 VPN 站点、ExpressRoute 线路或点到站点/用户 VPN 用户。Branch is conceptually applicable to VPN Site, ExpressRoute circuits, or Point-to-Site/User VPN users. “启用分支到分支”设置默认启用,你可在 WAN 配置设置中找到它。Enabling branch-to-branch is enabled by default and can be located in WAN Configuration settings. 这使得 VPN 分支/用户能够连接到其他 VPN 分支,还可在 VPN 和 ExpressRoute 用户之间启用传输连接。This lets VPN branches/users connect to other VPN branches and transit connectivity is also enabled between VPN and ExpressRoute users.

分支到分支流量是否可以通过 Azure 虚拟 WAN?Does branch-to-branch traffic traverse through the Azure Virtual WAN?

是的。Yes. 分支到分支流量会通过 Azure 虚拟 WAN。Branch-to-branch traffic traverses through Azure Virtual WAN.

虚拟 WAN 是否要求每个站点中都有 ExpressRoute?Does Virtual WAN require ExpressRoute from each site?

不是。No. 虚拟 WAN 不要求每个站点中都有 ExpressRoute。Virtual WAN does not require ExpressRoute from each site. 可以使用 ExpressRoute 线路将站点连接到提供商网络。Your sites may be connected to a provider network using an ExpressRoute circuit. 对于使用 ExpressRoute 连接到虚拟中心以及将 IPsec VPN 连接到同一中心的站点,虚拟中心提供了 VPN 和 ExpressRoute 用户之间的传输连接。For sites that are connected using ExpressRoute to a virtual hub and IPsec VPN into the same hub, virtual hub provides transit connectivity between the VPN and ExpressRoute user.

使用 Azure 虚拟 WAN 时是否存在网络吞吐量或连接限制?Is there a network throughput or connection limit when using Azure Virtual WAN?

网络吞吐量基于虚拟 WAN 中心的每项服务。Network throughput is per service in a virtual WAN hub. 尽管你可以根据需要拥有任意数量的虚拟 WAN,但是每个虚拟 WAN 只允许每个区域有 1 个中心。While you can have as many virtual WANs as you like, each Virtual WAN allows 1 hub per region. 在每个中心,VPN 聚合吞吐量最高可达 20 Gbps,ExpressRoute 聚合吞吐量最高可达 20 Gbps,用户 VPN/点到站点 VPN 聚合吞吐量最高可达 20 Gbps。In each hub, the VPN Aggregate throughput is up to 20 Gbps, the ExpressRoute aggregate throughput is up to 20 Gbps and the User VPN/Point-to-site VPN aggregate throughput is up to 20 Gbps. 虚拟中心的路由器最多支持 50 Gbps 的 VNet 到 VNet 流量流,并假设连接到单个虚拟中心的所有 VNet 总共有 2000 个 VM 工作负载。The router in virtual hub supports up to 50 Gbps for VNet-to-VNet traffic flows and assumes a total of 2000 VM workload across all VNets connected to a single virtual hub.

当 VPN 站点连接到中心时,它们通过连接来完成此操作。When VPN sites connect into a hub, they do so with connections. 对于每个虚拟中心,虚拟 WAN 最多支持 1000 个连接或 2000 个 IPsec 隧道。Virtual WAN supports up to 1000 connections or 2000 IPsec tunnels per virtual hub. 当远程用户连接到虚拟中心时,他们将连接到 P2S VPN 网关,该网关最多支持 10000 位用户,具体取决于为虚拟中心的 P2S VPN 网关选择的缩放单元(带宽)。When remote users connect into virtual hub, they connect to the P2S VPN gateway, which supports up to 10,000 users depending on the scale unit(bandwidth) chosen for the P2S VPN gateway in the virtual hub.

一个 VPN 隧道和一个连接的总 VPN 吞吐量是多少?What is the total VPN throughput of a VPN tunnel and a connection?

一个中心的总 VPN 吞吐量最多为 20 Gbps,具体取决于为 VPN 网关选择的缩放单元。The total VPN throughput of a hub is up to 20 Gbps based on the chosen scale unit of the VPN gateway. 吞吐量由所有现有连接共享。Throughput is shared by all existing connections. 连接中的每个隧道最多可以支持 1 Gbps。Each tunnel in a connection can support up to 1 Gbps.

可在 VPN 连接上使用 NAT-T 吗?Can I use NAT-T on my VPN connections?

可以,支持 NAT 遍历 (NAT-T)。Yes, NAT traversal (NAT-T) is supported. 虚拟 WAN VPN 网关将不在指向/来自 IPsec 隧道的内部数据包上执行任何类似 NAT 的功能。The Virtual WAN VPN gateway will NOT perform any NAT-like functionality on the inner packets to/from the IPsec tunnels. 在此配置中,请确保本地设备启动 IPsec 隧道。In this configuration, ensure the on-premises device initiates the IPsec tunnel.

我在门户中看不到虚拟中心的 20 Gbps 设置。I don't see the 20 Gbps setting for the virtual hub in portal. 我该如何配置它?How do I configure that?

导航到门户上中心内的 VPN 网关,然后单击缩放单元,将其更改为适当的设置。Navigate to the VPN gateway inside a hub on the portal, then click on the scale unit to change it to the appropriate setting.

虚拟 WAN 是否允许本地设备并行利用多个 ISP?亦或它始终为单个 VPN 隧道?Does Virtual WAN allow the on-premises device to utilize multiple ISPs in parallel, or is it always a single VPN tunnel?

本地设备解决方案可以应用流量策略,以引导流量通过多个隧道进入 Azure 虚拟 WAN 中心(虚拟中心的 VPN 网关)。On-premises device solutions can apply traffic policies to steer traffic across multiple tunnels into the Azure Virtual WAN hub (VPN gateway in the virtual hub).

什么是全局传输体系结构?What is global transit architecture?

有关全局传输体系结构的信息,请参阅全局传输网络体系结构和虚拟 WANFor information about global transit architecture, see Global transit network architecture and Virtual WAN.

流量在 Azure 主干网上是如何路由的?How is traffic routed on the Azure backbone?

流量遵循以下模式:分支设备 -> ISP -> Microsoft 网络边缘 -> Microsoft DC(中心 VNet)-> Microsoft 网络边缘 -> ISP -> 分支设备The traffic follows the pattern: branch device ->ISP->Microsoft network edge->Microsoft DC (hub VNet)->Microsoft network edge->ISP->branch device

在此模型中,需要在每个站点执行什么操作?In this model, what do you need at each site? 只需要创建 Internet 连接?Just an internet connection?

是的。Yes. 支持 IPsec 的 Internet 连接和物理设备,最好是来自我们的集成虚拟 WAN 合作伙伴An internet connection and physical device that supports IPsec, preferably from our integrated Virtual WAN partners. 还可以从你偏爱的设备手动管理 Azure 的配置和连接。Optionally, you can manually manage the configuration and connectivity to Azure from your preferred device.

如何对连接(VPN、ExpressRoute 或虚拟网络)启用默认路由 ( do I enable default route ( for a connection (VPN, ExpressRoute, or Virtual Network)?

如果连接上的标志为“已启用”,则虚拟中心可将获知的默认路由传播到虚拟网络/站点到站点 VPN/ExpressRoute 连接。A virtual hub can propagate a learned default route to a virtual network/site-to-site VPN/ExpressRoute connection if the flag is 'Enabled' on the connection. 当用户编辑虚拟网络连接、VPN 连接或 ExpressRoute 连接时,将显示此标志。This flag is visible when the user edits a virtual network connection, a VPN connection, or an ExpressRoute connection. 默认情况下,当站点或 ExpressRoute 线路连接到中心时,将禁用此标志。By default, this flag is disabled when a site or an ExpressRoute circuit is connected to a hub. 如果添加虚拟网络连接以将 VNet 连接到虚拟中心,则默认情况下启用此功能。It is enabled by default when a virtual network connection is added to connect a VNet to a virtual hub.

默认路由不是源自虚拟 WAN 中心;只有当虚拟 WAN 中心由于在中心部署防火墙而获知默认路由或另一个连接的站点已启用强制隧道时,此标志才会将默认路由传播到连接。The default route does not originate in the Virtual WAN hub; the default route is propagated if it is already learned by the Virtual WAN hub as a result of deploying a firewall in the hub, or if another connected site has forced-tunneling enabled. 默认路由不在中心之间(中心间)传播。A default route does not propagate between hubs (inter-hub).

虚拟 WAN 中的虚拟中心如何从多个中心选择路由的最佳路径?How does the virtual hub in a virtual WAN select the best path for a route from multiple hubs?

如果某个虚拟中心从多个远程中心获知同一路由,则其决定顺序如下所示:If a virtual hub learns the same route from multiple remote hubs, the order in which it decides is as follows:

  1. 最长前缀匹配。Longest prefix match.
  2. 本地路由优先于中心间路由(虚拟中心为中心间 AS 分配65520-65520)。Local routes over interhub (Virtual hub assigns 65520-65520 for interhub AS).
  3. 静态路由优先于 BGP 路由:这与虚拟中心路由器做出的决定有关。Static routes over BGP: This is in context to the decision being made by the virtual hub router. 但是,如果决策者是其中的站点通过 BGP 播发路由的 VPN 网关,或者是提供静态地址前缀的 VPN 网关,则静态路由可能优先于 BGP 路由。However, if the decision maker is the VPN gateway where a site advertises routes via BGP or provides static address prefixes, static routes may be preferred over BGP routes.
  4. ExpressRoute (ER) 优先于 VPN:在本地中心,ER 优先于 VPN。ExpressRoute (ER) over VPN: ER is preferred over VPN when the context is a local hub. ExpressRoute 线路之间的传输连接只能通过 Global Reach 提供。Transit connectivity between ExpressRoute circuits is only available through Global Reach. 因此,当有一个 ExpressRoute 线路连接到一个中心,并且有另一个 ExpressRoute 线路通过 VPN 连接连接到其他中心时,对于中心间路由方案,VPN 可能是首选项。Therefore, in scenarios where ExpressRoute circuit is connected to one hub and there is another ExpressRoute circuit connected to a different hub with VPN connection, VPN may be preferred for inter-hub scenarios.
  5. AS 路径长度。AS path length.

虚拟 WAN 中心是否允许 ExpressRoute 线路之间的连接?Does the Virtual WAN hub allow connectivity between ExpressRoute circuits?

ER 到 ER 之间的传输始终通过 Global Reach 进行。Transit between ER-to-ER is always via Global reach. 虚拟中心网关部署在 DC 或 Azure 区域中。Virtual hub gateways are deployed in DC or Azure regions. 当两条 ExpressRoute 线路通过 Global Reach 连接时,不需要流量完全从边缘路由器传递到虚拟中心 DC。When two ExpressRoute circuits connect via Global reach, there is no need for the traffic to come all the way from the edge routers to the virtual hub DC.

Azure 虚拟 WAN ExpressRoute 线路或 VPN 连接中是否存在权重的概念Is there a concept of weight in Azure Virtual WAN ExpressRoute circuits or VPN connections

当多个 ExpressRoute 线路连接到一个虚拟中心时,该连接上的路由权重为虚拟中心的 ExpressRoute 提供了选择优先线路的机制。When multiple ExpressRoute circuits are connected to a virtual hub, routing weight on the connection provides a mechanism for the ExpressRoute in the virtual hub to prefer one circuit over the other. 没有用于在 VPN 连接上设置权重的机制。There is no mechanism to set a weight on a VPN connection. 与单个中心内,Azure 始终优先选择 ExpressRoute 连接而非 VPN 连接。Azure always prefers an ExpressRoute connection over a VPN connection within a single hub.

对于传出 Azure 的流量,虚拟 WAN 是否优先选择 ExpressRoute 而非 VPNDoes Virtual WAN prefer ExpressRoute over VPN for traffic egressing Azure

是的。Yes. 对于传出 Azure 的流量,虚拟 WAN 优先选择 ExpressRoute 而非 VPN。Virtual WAN prefers ExpressRoute over VPN for traffic egressing Azure.

当虚拟 WAN 中心具有 ExpressRoute 线路和连接到该线路的 VPN 站点时,什么原因会导致优先选择 VPN 连接而非 ExpressRoute?When a Virtual WAN hub has an ExpressRoute circuit and a VPN Site connected to it, what would cause a VPN connection route to be preferred over ExpressRoute?

当 ExpressRoute 线路连接到虚拟中心时,Azure 边缘路由器是在本地与 Azure 之间进行通信的第一个节点。When an ExpressRoute circuit is connected to virtual hub, the Azure edge routers are the first node for communication between on-premises and Azure. 这些边缘路由器与虚拟 WAN ExpressRoute 网关通信,而这些网关从控制虚拟 WAN 中任何网关之间的所有路由的虚拟中心路由器获知路由。These edge routers communicate with the Virtual WAN ExpressRoute gateways that, in turn, learn routes from the virtual hub router that controls all routes between any gateways in Virtual WAN. Azure 边缘路由器优先处理虚拟中心 ExpressRoute 路由而非从本地获知的路由。The Azure edge routers process virtual hub ExpressRoute routes with higher preference over routes learned from on-premises. 如果 VPN 连接因任何原因而成为虚拟中心获知路由的主要媒介(例如 ExpressRoute 和 VPN 之间的故障转移方案),那么除非 VPN 站点具有较长的 AS 路径长度,否则虚拟中心将继续与 ExpressRoute 网关分享获知的 VPN 路由,这将导致 Microsoft 边缘路由器优先处理 VPN 路由而非本地路由。Due to any reason, if the VPN connection becomes the primary medium for the virtual hub to learn routes from (e.g failover scenarios between ExpressRoute and VPN), unless the VPN Site has a longer AS Path length, the virtual hub will continue to share VPN learned routes with the ExpressRoute gateway, causing the Microsoft Edge routers to prefer VPN routes over on-premises routes.

如果 VPN 连接因任何原因而成为虚拟中心获知路由的主要媒介(例如 ExpressRoute 和 VPN 之间的故障转移方案),那么除非 VPN 站点具有较长的 AS 路径长度,否则虚拟中心将继续与 ExpressRoute 网关分享获知的 VPN 路由。For any reason, if the VPN connection becomes the primary medium for the virtual hub to learn routes from (e.g failover scenarios between ExpressRoute and VPN), unless the VPN Site has a longer AS Path length, the virtual hub will continue to share VPN learned routes with the ExpressRoute gateway. 这将导致 Microsoft 边缘路由器优先处理 VPN 路由而非本地路由。This causes the Microsoft edge routers to prefer VPN routes over on-premises routes.

如果连接了两个中心(中心 1 和 2),并且有一条 ExpressRoute 线路以蝴蝶结的形式连接到这两个中心,那么连接到中心 1 的 VNet 通过什么路径到达中心 2 中连接的 VNet?When two hubs (hub 1 and 2) are connected and there is an ExpressRoute circuit connected as a bow-tie to both the hubs, what is the path for a VNet connected to hub 1 to reach a VNet connected in hub 2?

对于 VNet 到 VNet 连接,当前行为优先选择 ExpressRoute 线路路径而非中心到中心。The current behavior is to prefer the ExpressRoute circuit path over hub-to-hub for VNet-to-VNet connectivity. 但是,不建议在虚拟 WAN 设置中进行此选择。However, this is not encouraged in a virtual WAN setup. 虚拟 WAN 团队正在研究修补程序,以支持优先选择中心到中心而非 ExpressRoute 路径。The Virtual WAN team is working on a fix to enable the preference for hub-to-hub over the ExpressRoute path. 对于区域间流量流,建议将多个 ExpressRoute 线路(不同提供商)连接到一个中心,并使用虚拟 WAN 提供的中心到中心连接。The recommendation is for multiple ExpressRoute circuits (different providers) to connect to one hub and use the hub-to-hub connectivity provided by Virtual WAN for inter-region traffic flows.

是否可以在虚拟 WAN 的不同资源组中创建中心?Can hubs be created in different resource group in Virtual WAN?

是的。Yes. 目前只能通过 PowerShell 使用此选项。This option is currently available via PowerShell only. 虚拟 WAN 门户要求中心与虚拟 WAN 资源本身位于同一资源组中。The Virtual WAN portal requires that the hubs are in the same resource group as the Virtual WAN resource itself.

建议的虚拟 WAN 中心地址空间为 /23。The recommended Virtual WAN hub address space is /23. 虚拟 WAN 中心将子网分配到各种网关(ExpressRoute、站点到站点 VPN、点到站点 VPN、Azure 防火墙、虚拟中心路由器)。Virtual WAN hub assigns subnets to various gateways (ExpressRoute, Site-to-site VPN, Point-to-site VPN, Azure Firewall, Virtual hub Router). 对于在虚拟中心内部署 NVA 的情况,通常为 NVA 实例划分 /28。For scenarios where NVAs are deployed inside a virtual hub, a /28 is typically carved out for the NVA instances. 但如果用户预配多个 NVA,则可以分配 /27 子网。However if the user were to provision multiple NVAs, a /27 subnet may be assigned . 因此请在操作时考虑到未来的体系结构,虽然虚拟 WAN 中心的最小部署大小为 /24,但建议用户在创建时输入 /23 的中心地址空间。Therefore keeping a future architecture in mind, while Virtual WAN hubs are deployed with a minimum size of /24, the recommended hub address space at creation time for user to input is /23.

虚拟 WAN 是否支持 IPv6?Is there support for IPv6 in Virtual WAN?

虚拟 WAN 中心及其网关不支持 IPv6。IPv6 is not supported in the Virtual WAN hub and its gateways. 如果你具有支持 IPv4 和 IPv6 的 VNet,并且要将 VNet 连接到虚拟 WAN,那么当前不支持此方案。If you have a VNet that has IPv4 and IPv6 support and you would like to connect the VNet to Virtual WAN, this scenario not currently supported.

对于通过 Azure 防火墙打开 Internet 接入点的点到站点(用户)VPN 方案,你可能需要关闭客户端设备上的 IPv6 连接,以强制流量流向虚拟 WAN 中心。For the point-to-site User VPN scenario with internet breakout via Azure Firewall, you will likely have to turn off IPv6 connectivity on your client device to force traffic to the Virtual WAN hub. 这是因为新式设备默认使用 IPv6 地址。This is because modern devices, by default, use IPv6 addresses.

所需的最低版本为 05-01-2020(2020 年 5 月 1 日)。A minimum version of 05-01-2020 (May 1 2020) is required.

是否存在虚拟 WAN 限制?Are there any Virtual WAN limits?

请参阅“订阅和服务限制”页上的虚拟 WAN 限制部分。See the Virtual WAN limits section on the Subscription and service limits page.

虚拟 WAN 类型(基本和标准)之间的区别是什么?What are the differences between the Virtual WAN types (Basic and Standard)?

请参阅基本和标准虚拟 WANSee Basic and Standard Virtual WANs. 如需了解定价,请参阅定价页面。For pricing, see the Pricing page.

虚拟 WAN 是否会存储客户数据?Does Virtual WAN store customer data?

不是。No. 虚拟 WAN 不存储任何客户数据。Virtual WAN does not store any customer data.

虚拟 WAN 中心路由与 VNet 中的 Azure 路由服务器有何不同?How does Virtual WAN Hub routing differ from Azure Route Server in a VNet?

Azure 路由服务器提供边界网关协议 (BGP) 对等互连服务,该服务可由 NVA (网络虚拟设备) 用于了解 DIY 中心 VNet 中路由服务器的路由。Azure Route Server provides a Border Gateway Protocol (BGP) peering service that can be used by NVAs (Network Virtual Appliance) to learn routes from the route server in a DIY hub VNet. 虚拟 WAN 路由提供多种功能,其中包括 VNet 到 VNet 传输路由、自定义路由、自定义路由关联和传播、零接触全网状中心服务,以及与 ExpressRoute、Site VPN、远程用户/大型 P2S VPN 的连接服务,和安全中心(Azure 防火墙)功能。Virtual WAN routing provides multiple capabilities including VNet-to-VNet transit routing, custom routing, custom route association and propagation, and a zero-touch fully meshed hub service along with connectivity services of ExpressRoute, Site VPN, Remote User/Large Scale P2S VPN, and Secure hub (Azure Firewall) capabilities. 当你在 NVA 与 Azure 路由服务器之间建立 BGP 对等互连时,可以将 NVA 中的 IP 地址播发到虚拟网络。When you establish a BGP peering between your NVA and Azure Route Server, you can advertise IP addresses from your NVA to your virtual network. 对于所有高级路由功能(例如传输路由、自定义路由等),可以使用虚拟 WAN 路由。For all advanced routing capabilities such as transit routing, custom routing, etc., you can use Virtual WAN routing.