虚拟 WAN 常见问题解答Virtual WAN FAQ

用户是否需要将中心辐射型拓扑与 SD-WAN/VPN 设备配合使用才能使用 Azure 虚拟 WAN?Does the user need to have hub and spoke with SD-WAN/VPN devices to use Azure Virtual WAN?

虚拟 WAN 提供了许多内置于单个窗格中的功能,例如站点/站点到站点 VPN 连接、用户/P2S 连接、ExpressRoute 连接、虚拟网络连接、VPN ExpressRoute 互连、VNET 到 VNET 可传递连接、集中路由、Azure 防火墙和防火墙管理器安全性、监视、ExpressRoute 加密以及许多其他功能。Virtual WAN provides many functionalities built into a single pane of glass such as Site/Site-to-site VPN connectivity, User/P2S connectivity, ExpressRoute connectivity, Virtual Network connectivity, VPN ExpressRoute Interconnectivity, VNET to VNET transitive connectivity, Centralized Routing, Azure firewall and firewall manager security, Monitoring, ExpressRoute Encryption and many other capabilities. 无需所有这些用例即可开始使用虚拟 WAN。You do not have to have all of these use cases to start using Virtual WAN. 只需一个用例即可开始使用。You can simply get started with just one use case. 虚拟 WAN 体系结构是一种内置了规模和性能的中心辐射型体系结构,其中的分支(VPN/SD-WAN 设备)、用户(Azure VPN 客户端、openVPN 或 IKEv2 客户端)、ExpressRoute 线路和虚拟网络充当虚拟中心的辐条。The Virtual WAN architecture is a hub and spoke architecture with scale and performance built-in where branches (VPN/SD-WAN devices), users (Azure VPN Clients, openVPN or IKEv2 Clients), ExpressRoute circuits, Virtual Networks serve as spokes to Virtual Hub(s). 所有中心均在标准虚拟 WAN 中以完整网格的形式进行连接,使得用户能够轻松地使用 Azure 主干进行任意分支到任意分支的连接。All hubs are connected in full mesh in a Standard Virtual WAN making it easy for the user to use the Azure backbone for any-to-any (any spoke) connectivity. 对于包含 SD-WAN/VPN 设备的中心辐射型体系结构,用户可以在 Azure 虚拟 WAN 门户中手动设置该它,也可以使用虚拟 WAN 合作伙伴 CPE (SD-WAN/VPN) 来设置与 Azure 的连接。For hub and spoke with SD-WAN/VPN devices, users can either manually set it up in the Azure Virtual WAN portal or use the Virtual WAN Partner CPE (SD-WAN/VPN) to set up connectivity to Azure. 虚拟 WAN 合作伙伴提供自动进行连接的功能:将设备信息导出到 Azure 中,下载 Azure 配置,然后建立与 Azure 虚拟 WAN 中心的连接。Virtual WAN partners provide automation for connectivity which is the ability to export the device info into Azure, download the Azure configuration and establish connectivity to the Azure Virtual WAN hub. 对于点到站点/用户 VPN 连接,我们支持 Azure VPN 客户端、OpenVPN 或 IKEv2 客户端。For Point-to-site/User VPN connectivity, we support Azure VPN client, OpenVPN or IKEv2 client.

Azure 虚拟 WAN 用户 VPN(点到站点)支持什么客户端?What client does the Azure Virtual WAN User VPN (Point-to-site) support?

虚拟 WAN 支持 Azure VPN 客户端、OpenVPN 客户端或任何 IKEv2 客户端。Virtual WAN supports Azure VPN client, OpenVPN Client, or any IKEv2 client. Azure VPN 客户端支持 Azure AD 身份验证。至少需要 Windows 10 客户端 OS 17763.0 或更高版本。Azure AD authentication is supported with Azure VPN Client.A minimum of Windows 10 client OS version 17763.0 or higher is required. OpenVPN 客户端可以支持基于证书的身份验证。OpenVPN client(s) can support certificate based authentication. 在网关上选择基于证书的身份验证后,会看到需下载到设备的 .ovpn 文件。Once cert-based auth is selected on the gateway, you will see the .ovpn file to download to your device. IKEv2 支持证书和 RADIUS 身份验证。Both certificate and RADIUS auth is supported with IKEv2.

就用户 VPN(点到站点)来说,为什么将 P2S 客户端池拆分为两个路由?For User VPN (Point-to-site)- Why is the P2S client pool split into two routes?

每个网关都有两个实例,进行拆分是为了使每个网关实例可以独立地为连接的客户端分配客户端 IP,并将来自虚拟网络的流量路由回正确的网关实例,避免网关间的实例跃点。Each gateway has two instances, the split happens so that each gateway instance can independently allocate client IPs for connected clients and traffic from the virtual network is routed back to the correct gateway instance to avoid inter-gateway instance hop.

如何为 P2S 客户端添加 DNS 服务器?How do I add DNS servers for P2S clients?

可以通过两个选项为 P2S 客户端添加 DNS 服务器。There are two options to add DNS servers for the P2S clients.

  1. 使用 Azure 打开支持票证,并用其将你的 DNS 服务器添加到中心Open a support ticket with Azure and have them add your DNS servers to the hub
  2. 或者,如果你使用的是适用于 Windows 10 的 Azure VPN 客户端,则可修改下载的 XML 配置文件,在导入该文件之前添加 <dnsservers><dnsserver> </dnsserver></dnsservers> 标记。Or, if you are using the Azure VPN Client for Windows 10, you can modify the downloaded profile XML file and add the <dnsservers><dnsserver> </dnsserver></dnsservers> tags before importing it.
<azvpnprofile>
<clientconfig>

    <dnsservers>
        <dnsserver>x.x.x.x</dnsserver>
        <dnsserver>y.y.y.y</dnsserver>
    </dnsservers>

</clientconfig>
</azvpnprofile>

就用户 VPN(点到站点)来说,支持多少个客户端?For User VPN (Point-to-site)- how many clients are supported?

每个用户 VPN P2S 网关都有两个实例,每个实例支持的用户数会随缩放单元的变化而变化,并有一个上限。Each User VPN P2S gateway has two instances and each instance supports upto certain users as the scale unit changes. 缩放单元 1-3 支持 500 个连接,缩放单元 4-6 支持 1000 个连接,缩放单元 7-10 支持 5000 个连接,缩放单元 11+ 支持最多 10,000 个连接。Scale unit 1-3 supports 500 connections, Scale unit 4-6 supports 1000 connections, Scale unit 7-10 supports 5000 connections and Scale unit 11+ supports upto 10,000 connections. 例如,假设用户选择 1 个缩放单元。As an example, lets say the user chooses 1 scale unit. 每个缩放单元的存在都意味着已部署主动-主动网关,并且这些实例(在本例中为 2 个实例)中的每一个都支持最多 500 个连接。Each scale unit would imply an active-active gateway deployed and each of the instances (in this case 2) would support upto 500 connections. 每个网关可以获得 500 * 2 个连接,但这并不意味着你要为此缩放单元的 1000 个(而不是 500 个)连接做规划,因为系统可能需要为实例提供服务,而在服务期间,当你超过建议的连接数时,系统可能会中断这额外的 500 个连接。Since you can get 500 connections * 2 per gateway, it does not mean you plan for 1000 instead of the 500 for this scale unit as instances may need to be serviced during which connectivity for the extra 500 may be interrupted if you surpass the recommended connection count.

Azure 虚拟网络网关(VPN 网关)和 Azure 虚拟 WAN VPN 网关之间有什么区别?What is the difference between an Azure virtual network gateway (VPN Gateway) and an Azure Virtual WAN VPN gateway?

虚拟 WAN 提供大规模站点到站点连接,在设计上考虑到了吞吐量、可伸缩性和易用性。Virtual WAN provides large-scale site-to-site connectivity and is built for throughput, scalability, and ease of use. 将站点连接到虚拟 WAN VPN 网关时,它不同于使用网关类型 “VPN”的常规虚拟网络网关。When you connect a site to a Virtual WAN VPN gateway, it is different from a regular virtual network gateway that uses a gateway type 'VPN'. 同样,将 ExpressRoute 线路连接到虚拟 WAN 中心时,它对 ExpressRoute 网关使用的资源与对使用“ExpressRoute”网关类型的常规虚拟网络网关使用的资源不同。Similarly, when you connect an ExpressRoute circuit to a Virtual WAN hub, it uses a different resource for the ExpressRoute gateway than the regular virtual network gateway that uses gateway type 'ExpressRoute'. 对于 VPN 和 ExpressRoute,虚拟 WAN 最多支持 20 Gbps 聚合吞吐量。Virtual WAN supports up to 20 Gbps aggregate throughput both for VPN and ExpressRoute. 虚拟 WAN 还实现了与 CPE 分支设备合作伙伴生态系统的连接自动化。Virtual WAN also has automation for connectivity with an ecosystem of CPE branch device partners. CPE 分支设备具有自动预配并连接到 Azure 虚拟 WAN 的内置自动化。CPE branch devices have built-in automation that auto-provisions and connects into Azure Virtual WAN. 这些设备由一个不断扩张的 SD-WAN 和 VPN 合作伙伴生态系统提供。These devices are available from a growing ecosystem of SD-WAN and VPN partners. 请参阅首选合作伙伴列表See the Preferred Partner List.

虚拟 WAN 与 Azure 虚拟网络网关有何不同?How is Virtual WAN different from an Azure virtual network gateway?

虚拟网络网关 VPN 限制为 30 个隧道。A virtual network gateway VPN is limited to 30 tunnels. 对于连接,应当为大型 VPN 使用虚拟 WAN。For connections, you should use Virtual WAN for large-scale VPN. 每个区域(虚拟中心)最多可以连接 1,000 个分支连接,每个中心有 20 Gbps 聚合。You can connect up to 1,000 branch connections per region (virtual hub) with aggregate of 20 Gbps per hub. 连接是从本地 VPN 设备到虚拟中心的主动-主动隧道。A connection is an active-active tunnel from the on-premises VPN device to the virtual hub. 每个区域中可以有一个中心,这意味着你可以跨中心连接到 1,000 多个分支。You can have one hub per region, which means you can connect more than 1,000 branches across hubs.

什么是虚拟 WAN 网关缩放单元What is a Virtual WAN Gateway Scale Unit

根据定义,缩放单元要选择虚拟中心内网关的聚合吞吐量。A scale unit is an unit defined to pick an aggregate throughput of a gateway in Virtual hub. 1 个缩放单元的 VPN 为 500 Mbps。1 scale unit of VPN = 500 Mbps . 1 个缩放单元的 ExpressRoute 为 2 Gbps。1 scale unit of ExpressRoute = 2 Gbps. 示例:10 个缩放单元的 VPN:500 Mbps * 10 = 5 GbpsExample : 10 scale unit of VPN would imply 500 Mbps * 10 = 5 Gbps

支持哪些设备提供商(虚拟 WAN 合作伙伴)?Which device providers (Virtual WAN partners) are supported?

目前,许多合作伙伴都支持全自动虚拟 WAN 体验。At this time, many partners support the fully automated Virtual WAN experience. 有关详细信息,请参阅虚拟 WAN 合作伙伴For more information, see Virtual WAN partners.

虚拟 WAN 合作伙伴自动化步骤有哪些?What are the Virtual WAN partner automation steps?

有关合作伙伴自动化步骤,请参阅虚拟 WAN 合作伙伴自动化For partner automation steps, see Virtual WAN partner automation.

是否需要使用首选的合作伙伴设备?Am I required to use a preferred partner device?

否。No. 可以使用任何支持 VPN 且符合 Azure 对 IKEv2/IKEv1 IPsec 的支持要求的设备。You can use any VPN-capable device that adheres to the Azure requirements for IKEv2/IKEv1 IPsec support.

虚拟 WAN 合作伙伴如何自动与 Azure 虚拟 WAN 建立连接?How do Virtual WAN partners automate connectivity with Azure Virtual WAN?

软件定义的连接解决方案通常使用控制器或设备预配中心来管理其分支设备。Software-defined connectivity solutions typically manage their branch devices using a controller, or a device provisioning center. 控制器可以使用 Azure API 自动与 Azure 虚拟 WAN 建立连接。The controller can use Azure APIs to automate connectivity to the Azure Virtual WAN. 自动化包括上传分支信息、下载 Azure 配置、将 IPSec 隧道设置到 Azure 虚拟中心,以及自动设置从分支设备到 Azure 虚拟 WAN 的连接。The automation includes uploading branch information, downloading the Azure configuration, setting up IPSec tunnels into Azure Virtual hubs, and automatically setting up connectivity form the branch device to Azure Virtual WAN. 当有数百个分支时,可以轻松使用虚拟 WAN CPE 合作伙伴进行连接,因为载入体验无需设置、配置和管理大规模的 IPsec 连接。When you have hundreds of branches, connecting using Virtual WAN CPE Partners is easy because the onboarding experience takes away the need to set up, configure, and manage large-scale IPsec connectivity. 有关详细信息,请参阅虚拟 WAN 合作伙伴自动化For more information, see Virtual WAN partner automation.

虚拟 WAN 如何支持 SD-WAN 设备?How is Virtual WAN supporting SD-WAN devices?

虚拟 WAN 合作伙伴自动执行 Azure VPN 端点的 IPsec 连接。Virtual WAN partners automate IPsec connectivity to Azure VPN end points. 如果虚拟 WAN 合作伙伴是 SD-WAN 提供商,则表示 SD-WAN 控制器管理到 Azure VPN 端点的自动化和 IPsec 连接。If the Virtual WAN partner is an SD-WAN provider, then it is implied that the SD-WAN controller manages automation and IPsec connectivity to Azure VPN end points. 如果 SD-WAN 设备需要自己的端点而不是 Azure VPN 来实现任何专有 SD-WAN 功能,则可以在 Azure VNet 中部署 SD-WAN 端点并与 Azure 虚拟 WAN 共存。If the SD-WAN device requires its own end point instead of Azure VPN for any proprietary SD-WAN functionality, you can deploy the SD-WAN end point in an Azure VNet and coexist with Azure Virtual WAN.

虚拟 WAN 是否会更改任何现有的连接功能?Does Virtual WAN change any existing connectivity features?

不会对现有的 Azure 连接功能进行任何更改。There are no changes to existing Azure connectivity features.

虚拟 WAN 是否有新的可用资源管理器资源?Are there new Resource Manager resources available for Virtual WAN?

是的,虚拟 WAN 引入了新的资源管理器资源。Yes, Virtual WAN introduces new Resource Manager resources. 有关详细信息,请参阅概述For more information, please see the Overview.

允许多少 VPN 设备连接到单个中心?How many VPN devices can connect to a single hub?

每个虚拟中心最多支持 1,000 个连接。Up to 1,000 connections are supported per virtual hub. 每个连接包括四条链路,每条链路连接支持采用主动-主动配置的两个隧道。Each connection consists of four links and each link connection supports two tunnels that are in an active-active configuration. 隧道在 Azure 虚拟中心 vpngateway 中终止。The tunnels terminate in an Azure virtual hub vpngateway.

本地 VPN 设备是否可以连接到多个中心?Can the on-premises VPN device connect to multiple Hubs?

是的。Yes. 开始时的流量流将从本地设备发送到最近的 Azure 网络边缘,然后才发送到虚拟中心。Traffic flow, when commencing, is from the on-premises device to the closest Azure network edge, and then to the virtual hub.

是否可以在 Azure 虚拟 WAN 中部署和使用我偏爱的网络虚拟设备(在 NVA VNet 中)?Can I deploy and use my favorite network virtual appliance (in an NVA VNet) with Azure Virtual WAN?

是的,可以将你偏爱的网络虚拟设备 (NVA) VNet 连接到 Azure Virtual WAN。Yes, you can connect your favorite network virtual appliance (NVA) VNet to the Azure Virtual WAN. 首先,使用中心虚拟网络连接将网络虚拟设备 VNet 连接到中心。First, connect the network virtual appliance VNet to the hub with a Hub Virtual Network connection. 然后,使用指向虚拟设备的下一跃点创建一个虚拟中心路由。Then, create a virtual hub route with a next hop pointing to the Virtual Appliance. 可以将多个路由应用于虚拟中心路由表。You can apply multiple routes to the virtual hub Route Table. 此外,连接到 NVA VNet 的任何辐射还必须连接到虚拟中心,以确保辐射 VNet 路由传播到本地系统。Any spokes connected to the NVA VNet must additionally be connected to the virtual hub to ensure that the spoke VNet routes are propagated to on-premises systems.

可以在虚拟中心内创建网络虚拟设备吗?Can I create a Network Virtual Appliance inside the virtual hub?

无法在虚拟中心内部署网络虚拟设备 (NVA)。A Network Virtual Appliance (NVA) cannot be deployed inside a virtual hub. 但是,可以在连接到虚拟中心的辐射 VNet 中创建它,并允许中心内的路由通过 (NIC) NVA IP 地址定向目标 VNet 的流量。However, you can create it in a spoke VNet that is connected to the virtual hub and enable a route in the hub to direct traffic for destination VNet via the NVA IP address (of the NIC).

辐射 VNet 是否可以包含虚拟网络网关?Can a spoke VNet have a virtual network gateway?

否。No. 如果辐射 VNet 已连接到虚拟中心,则不能包含虚拟网络网关。The spoke VNet cannot have a virtual network gateway if it is connected to the virtual hub.

是否支持 BGP?Is there support for BGP?

是的,支持 BGP。Yes, BGP is supported. 创建 VPN 站点时,可以在其中提供 BGP 参数。When you create a VPN site, you can provide the BGP parameters in it. 这表示在 Azure 中为该站点创建的任何连接都将启用 BGP。This will imply that any connections created in Azure for that site will be enabled for BGP. 此外,如果 VNet 具有 NVA 且此 NVA VNet 已附加到虚拟 WAN 中心,为了确保适当地公布来自 NVA VNet 的路由,附加到 NVA VNet 的辐射必须禁用 BGP。Additionally, if you had a VNet with an NVA, and if this NVA VNet was attached to a Virtual WAN hub, in order to ensure that routes from an NVA VNet are advertised appropriately, spokes that are attached to NVA VNet must disable BGP. 此外,请将这些辐射 VNet 连接到虚拟中心 VNet,以确保辐射 VNet 路由传播到本地系统。Additionally, connect these spoke VNets to the virtual hub VNet to ensure spoke VNet routes are propagated to on-premises systems.

是否可以在虚拟中心使用 UDR 定向流量?Can I direct traffic using UDR in the virtual hub?

是的,可以使用虚拟中心路由表将流量定向到 VNet。Yes, you can direct traffic to a VNet using a virtual hub route table. 这样,可以通过特定的 IP 地址(通常为 NVA NIC)在 Azure 中设置目标 Vnet 的路由。This allows you to set routes for destination VNets in Azure via a specific IP address (typically of the NVA NIC).

虚拟 WAN 是否有任何许可或定价信息?Is there any licensing or pricing information for Virtual WAN?

是的。Yes. 请参阅定价页面。See the Pricing page.

如何计算中心的价格?How do I calculate price of a hub?

  • 根据使用的中心服务付费。You would pay for the services in the hub. 例如,你有 10 个需要连接到 Azure 虚拟 WAN 的分支或本地设备表示连接到中心的 VPN 端点。For example, lets say you have 10 branches or on-premises devices requiring to connect to Azure Virtual WAN would imply connecting to VPN end points in the hub. 离开 Azure 的数据流量也将收费。Data charges for traffic leaving Azure apply.

  • 还有其他的中心费用。There is additional hub charge. 请参阅定价页面。See the Pricing page.

  • 如果由于 ExpressRoute 线路连接到虚拟中心而拥有 ExpressRoute 网关,则需支付缩放单元价格。If you had ExpressRoute gateway due to ExpressRoute circuits connecting to a virtual hub, then you would pay for the scale unit price. ER 中的每个缩放单元都是 2 Gbps,每个连接单元按与 VPN 连接单元相同的速率进行收费。Each scale unit in ER is 2 Gbps and each connection unit is charged at the same rate as the VPN Connection unit.

  • 如果分支 VNET 已连接到中心,则分支 VNET 的对等互连费用仍然适用。If you had Spoke VNETs connected to the hub, peering charges at the Spoke VNETs still apply.

没有在启动合作伙伴列表中列出的新合作伙伴如何加入?How do new partners that are not listed in your launch partner list get onboarded?

所有虚拟 WAN API 都是开放式 API。All virtual WAN APIs are open API. 可以重新查看文档,评估技术可行性。You can go over the documentation to assess technical feasibility. 如有任何问题,请向 azurevirtualwan@microsoft.com 发送电子邮件。If you have any question, send an email to azurevirtualwan@microsoft.com. 理想的合作伙伴具有可以预配 IKEv1 或 IKEv2 IPsec 连接的设备。An ideal partner is one that has a device that can be provisioned for IKEv1 or IKEv2 IPsec connectivity.

如果使用的设备不在虚拟 WAN 合作伙伴列表中,该怎么办?What if a device I am using is not in the Virtual WAN partner list? 还可以用它来连接到 Azure 虚拟 WAN VPN 吗?Can I still use it to connect to Azure Virtual WAN VPN?

是的,只要设备支持 IPsec IKEv1 或 IKEv2 即可。Yes as long as the device supports IPsec IKEv1 or IKEv2. 虚拟 WAN 合作伙伴自动执行设备到 Azure VPN 端点的连接。Virtual WAN partners automate connectivity from the device to Azure VPN end points. 这表示自动执行“分支信息上传”、“IPsec 和配置”以及“连接”等步骤。由于设备不是来自虚拟 WAN 合作伙伴生态系统,因此需要大量手动执行 Azure 配置和更新设备才能建立 IPsec 连接。This implies automating steps such as 'branch information upload', 'IPsec and configuration' and 'connectivity'.Since your device is not from a Virtual WAN partner ecosystem, you will need to do the heavy lifting of manually taking the Azure configuration and updating your device to set up IPsec connectivity.

是否可以使用资源管理器模板构造 Azure 虚拟 WAN?Is it possible to construct Azure Virtual WAN with a Resource Manager template?

可以使用快速入门模板创建具有单个中心和单个 VPN 站点的单个虚拟 WAN 的简单配置。A simple configuration of one Virtual WAN with one hub and one vpnsite can be created using an quickstart template. 虚拟 WAN 从根本上来说是一种 REST 或门户驱动的服务。Virtual WAN is primarily a REST or portal driven service.

Azure 虚拟 WAN 是否支持全局 VNet 对等互连?Is Global VNet peering supported with Azure Virtual WAN?

可以在与虚拟 WAN 不同的区域中连接 VNet。You can connect a VNet in a different region than your virtual WAN.

连接到虚拟中心的分支 VNet 能否相互通信(V2V 传输)?Can spoke VNets connected to a virtual hub communicate with each other (V2V Transit)?

是的。Yes. 标准虚拟 WAN 支持通过 VNet 所连接到的虚拟 WAN 中心建立 VNet 到 VNet 传输连接。Standard Virtual WAN supports Vnet to Vnet transitive connectivity via the Virtual WAN hub that the Vnets are connected to. 在虚拟 WAN 术语中,我们将这些路径称为“本地虚拟 WAN VNet 传输”(用于连接到单个区域内的虚拟 WAN 中心的 VNet)和“全局虚拟 WAN VNet 传输”(用于通过跨两个或多个区域的多个虚拟 WAN 中心连接的 VNet)。In Virtual WAN terminology, we refer to these paths as "local Virtual WAN VNet transit" for VNets connected to a Virtual Wan Hub within a single region, and "global Virtual WAN VNet transit" for VNets connected through multiple Virtual WAN Hubs across two or more regions. 公共预览版的 VNet 传输最多支持 3 Gbps 吞吐量。VNet transit supports up to 3 Gbps of throughput during public preview. 全局传输推出正式版后,吞吐量将会提高。Throughput will expanded when global transit goes GA.

注意:目前,需要在虚拟中心部署 VPN 网关来触发启动路由元素,才能使用 V2V 传输预览版。NOTE: Currently V2V transit preview requires a VPN GW to be deployed in a Virtual Hub to trigger the routing elements to be launched. 此 VPN 网关不用于 V2V 传输路径。This VPN GW is not used for the V2V transit path. 这是一个已知限制,将在 V2V 正式版发布时移除。This is a known limitation and will be removed at the time of V2V GA. VPN 网关完全启动后,可在中心内删除该网关,因此它不是实现 V2V 传输功能的必需项。You can delete the VPN Gateway in the hub(s) after it is fully launched as it is not needed for V2V transit functionality.

对于某些方案,除了使用本地或全局虚拟 WAN VNet 传输以外,还可以使用虚拟网络对等互连将各个辐射 VNet 直接对等互连。For some scenarios, spoke Vnets can also be directly peered with each other using Virtual Network Peering in addition to local or global Virtual WAN VNet transit. 在这种情况下,VNet 对等互连优先于通过虚拟 WAN 中心建立的传输连接。In this case, Vnet Peering takes precedence over the transitive connection via the Virtual WAN hub.

到 Azure 虚拟 WAN 的分支连接是什么?What is a branch connection to Azure Virtual WAN?

从分支设备到 Azure 虚拟 WAN 的连接最多支持四条链路。A connection from a branch device into Azure Virtual WAN supports up to four links. 链路是分支位置的物理连接链路(例如:ATT、Verizon 等)。A link is the physical connectivity link at the branch location (for example: ATT, Verizon etc.). 每个链路连接都包含两个主动/主动 IPsec 隧道。Each link connection is composed of two active/active IPsec tunnels.

虚拟 WAN 中是否允许分支到分支连接?Is branch-to-branch connectivity allowed in Virtual WAN?

是的,对于 VPN 和 VPN 到 ExpressRoute,分支到分支连接在虚拟 WAN 中可用。Yes, branch-to-branch connectivity is available in Virtual WAN for VPN and VPN to ExpressRoute.

分支到分支流量是否可以通过 Azure 虚拟 WAN?Does branch-to-branch traffic traverse through the Azure Virtual WAN?

是的。Yes.

虚拟 WAN 是否要求每个站点中都有 ExpressRoute?Does Virtual WAN require ExpressRoute from each site?

否,虚拟 WAN 不要求每个站点中都有 ExpressRoute。No, the Virtual WAN does not require ExpressRoute from each site. 它通过 Internet 链路使用从设备到 Azure 虚拟 WAN 中心的标准 IPsec 站点到站点连接。It uses standard IPsec site-to-site connectivity via internet links from the device to an Azure Virtual WAN hub. 可以使用 ExpressRoute 线路将站点连接到提供商网络。Your sites may be connected to a provider network using an ExpressRoute circuit. 对于使用虚拟中心内的 ExpressRoute 进行连接的站点,站点在 VPN 与 ExpressRoute 之间可能有分支到分支流量流。For Sites that are connected using ExpressRoute in a virtual hub, sites can have branch to branch traffic flow between VPN and ExpressRoute.

使用 Azure 虚拟 WAN 时是否存在网络吞吐量限制?Is there a network throughput limit when using Azure Virtual WAN?

分支数限制为每个中心/区域 1000 个连接,中心内总带宽为 20 Gbps。Number of branches is limited to 1000 connections per hub/region and a total of 20 Gbps in the hub. 每个区域可以有 1 个中心。You can have 1 hub per region.

一个虚拟 WAN 中心支持多少个 VPN 连接?How many VPN connections does a Virtual WAN hub support?

一个 Azure 虚拟 WAN 中心可以同时支持最多 1,000 个 S2S 连接接、10,000 个 P2S 连接和 4 个 ExpressRoute 连接。An Azure Virtual WAN hub can support up to 1,000 S2S connections, 10,000 P2S connections, and 4 ExpressRoute connections simultaneously.

一个 VPN 隧道和一个连接的总 VPN 吞吐量是多少?What is the total VPN throughput of a VPN tunnel and a connection?

一个中心的总 VPN 吞吐量最多为 20 Gbps,具体取决于所选缩放单元。The total VPN throughput of a hub is up to 20 Gbps based on the chosen scale unit. 吞吐量由所有现有连接共享。Throughput is shared by all existing connections. 连接中的每个隧道最多可以支持 1 Gbps。Each tunnel in a connection can support up to 1 Gbps.

我在门户中看不到虚拟中心的 20 Gbps 设置。I don't see the 20 Gbps setting for the virtual hub in the portal. 我该如何配置它?How do I configure that?

导航到门户上中心内的 VPN 网关,并单击缩放单元,将其更改为适当的设置。Navigate to the VPN gateway inside a hub on the portal and click on the scale unit to change it to the appropriate setting.

虚拟 WAN 是否允许本地设备并行利用多个 ISP?亦或它始终为单个 VPN 隧道?Does Virtual WAN allow the on-premises device to utilize multiple ISPs in parallel, or is it always a single VPN tunnel?

使用分支提供的链路与建立虚拟 WAN VPN 连接始终是主动-主动隧道(在同一中心/区域具有复原能力)。A connection coming into a virtual WAN VPN is always an active-active tunnel (for resiliency within the same hub/region) using a link available at the branch. 此链接可以是本地分支的 ISP 链接。This link may be an ISP link at the on-premises branch. 虚拟 WAN“VPNSite”提供将链路信息添加到站点的能力。Virtual WAN 'VPNSite' provides the ability to add link information to the site. 如果分支有多个 ISP,并且每个 ISP 提供了一条链路,则可在 Azure 中的 VPN 站点信息中设置该信息。If you have multiple ISPs at the branch and each of the ISPs provided a link, that information can be set up in the VPN site info in Azure. 但是,在分支机构之间管理跨 ISP 的故障转移完全是以分支为中心的路由操作。However, managing failover across ISPs at the branch is completely a branch-centric routing operation.

什么是全局传输体系结构?What is global transit architecture?

有关全局传输体系结构的信息,请参阅全局传输网络体系结构和虚拟 WANFor information about global transit architecture, see Global transit network architecture and Virtual WAN.

流量在 Azure 主干网上是如何路由的?How is traffic routed on the Azure backbone?

流量遵循以下模式:分支设备 -> ISP -> Microsoft 网络边缘 -> Microsoft DC(中心 VNet)-> Microsoft 网络边缘 -> ISP -> 分支设备The traffic follows the pattern: branch device ->ISP->Microsoft network edge->Microsoft DC (hub VNet)->Microsoft network edge->ISP->branch device

在此模型中,需要在每个站点执行什么操作?In this model, what do you need at each site? 只需要创建 Internet 连接?Just an internet connection?

是的。Yes. 支持 IPsec 的 Internet 连接和物理设备,最好是来自我们的集成虚拟 WAN 合作伙伴An internet connection and physical device that supports IPsec, preferably from our integrated Virtual WAN partners. 还可以从你偏爱的设备手动管理 Azure 的配置和连接。Optionally, you can manually manage the configuration and connectivity to Azure from your preferred device.

如何在连接(VPN、ExpressRoute 或虚拟网络)中启用默认路由 (0.0.0.0/0):How do I enable default route (0.0.0.0/0) in a connection (VPN, ExpressRoute, or Virtual Network):

如果连接上的标志为“已启用”,则虚拟中心可将获知的默认路由传播到虚拟网络/站点到站点 VPN/ExpressRoute 连接。A virtual hub can propagate a learned default route to a virtual network/site-to-site VPN/ExpressRoute connection if the flag is 'Enabled' on the connection. 当用户编辑虚拟网络连接、VPN 连接或 ExpressRoute 连接时,将显示此标志。This flag is visible when the user edits a virtual network connection, a VPN connection, or an ExpressRoute connection. 默认情况下,当站点或 ExpressRoute 线路连接到中心时,将禁用此标志。By default, this flag is disabled when a site or an ExpressRoute circuit is connected to a hub. 如果添加虚拟网络连接以将 VNet 连接到虚拟中心,则默认情况下启用此功能。It is enabled by default when a virtual network connection is added to connect a VNet to a virtual hub. 默认路由不是源自虚拟 WAN 中心;只有当虚拟 WAN 中心由于在中心部署防火墙而获知默认路由或另一个连接的站点已启用强制隧道时,此标志才会将默认路由传播到连接。The default route does not originate in the Virtual WAN hub; the default route is propagated if it is already learned by the Virtual WAN hub as a result of deploying a firewall in the hub, or if another connected site has forced-tunneling enabled.

虚拟 WAN 中的虚拟中心如何从多个中心选择路由的最佳路径How does the virtual hub in a Virtual WAN select the best path for a route from multiple hubs

如果某个虚拟中心从多个远程中心获知同一路由,则其决定顺序如下所示If a Virtual Hub learns the same route from multiple remote hubs, the order in which it decides is as follows

  1. 路由源 a) 网络路由 - 虚拟中心网关直接获知的 VNET 前缀 b) BGP c) 中心 RouteTable(静态配置的路由) d) 中心间路由Route Origin a) Network routes - VNET prefixes directly learnt by the Virtual Hub gateways b) BGP c) Hub RouteTable (statically configured routes) d) InterHub routes
  2. 路由指标:虚拟 WAN 首选 ExpressRoute,而不是 VPN。Route metric : Virtual WAN prefers ExpressRoute over VPN. 与 VPN 对等机相比,ExpressRoute 对等机具有更高的权重ExpressRoute peer have a higher weightage compared to the VPN peer
  3. AS 路径长度AS path length

虚拟 WAN 类型(基本和标准)之间的区别是什么?What are the differences between the Virtual WAN types (Basic and Standard)?

“基本”WAN 类型允许创建基本中心(SKU = 基本)。The 'Basic' WAN type lets you create a basic hub (SKU = Basic). “标准”WAN 类型允许创建标准中心(SKU = 标准)。A 'Standard' WAN type lets you create standard hub (SKU = Standard). 基本中心只支持站点到站点 VPN 功能。Basic hubs are limited to site-to-site VPN functionality. 利用标准中心,可以通过中心使用 ExpressRoute、用户 VPN (P2S)、完整网格中心和 VNet 到 VNet 传输。Standard hubs let you have ExpressRoute, User VPN (P2S), full mesh hub, and VNet-to-VNet transit through the hubs. 有关详细信息,请参阅基本和标准虚拟 WANFor more information, see Basic and Standard virtual WANs. 如需了解定价,请参阅定价页面。For pricing, see the Pricing page.