教程:使用 Azure 虚拟 WAN 创建用户 VPN 连接Tutorial: Create a User VPN connection using Azure Virtual WAN

本教程介绍如何使用虚拟 WAN 通过 IPsec/IKE (IKEv2) 或 OpenVPN VPN 连接与 Azure 中的资源建立连接。This tutorial shows you how to use Virtual WAN to connect to your resources in Azure over an IPsec/IKE (IKEv2) or OpenVPN VPN connection. 此类连接要求在客户端计算机上配置一个客户端。This type of connection requires a client to be configured on the client computer. 有关虚拟 WAN 的详细信息,请参阅虚拟 WAN 概述For more information about Virtual WAN, see the Virtual WAN Overview

本教程介绍如何执行下列操作:In this tutorial, you learn how to:

  • 创建 WANCreate a WAN
  • 创建中心Create a hub
  • 创建 P2S 配置Create a P2S configuration
  • 下载 VPN 客户端配置文件Download a VPN client profile
  • 将 P2S 配置应用到中心Apply P2S configuration to a hub
  • 将 VNet 连接到中心Connect a VNet to a hub
  • 下载并应用 VPN 客户端配置Download and apply the VPN client configuration
  • 查看虚拟 WANView your virtual WAN

虚拟 WAN 示意图

准备阶段Before you begin

在开始配置之前,请验证是否符合以下条件:Verify that you have met the following criteria before beginning your configuration:

  • 你拥有一个要连接到的虚拟网络。You have a virtual network that you want to connect to. 确认本地网络的任何子网都不会与要连接到的虚拟网络重叠。Verify that none of the subnets of your on-premises networks overlap with the virtual networks that you want to connect to. 若要在 Azure 门户中创建虚拟网络,请参阅快速入门To create a virtual network in the Azure portal, see the quickstart.

  • 虚拟网络不包含任何虚拟网络网关。Your virtual network does not have any virtual network gateways. 如果虚拟网络包含网关(VPN 或 ExpressRoute),则必须删除所有网关。If your virtual network has a gateway (either VPN or ExpressRoute), you must remove all gateways. 此配置要求将虚拟网络改为连接到虚拟 WAN 中心网关。This configuration requires that virtual networks are connected instead, to the Virtual WAN hub gateway.

  • 获取中心区域的 IP 地址范围。Obtain an IP address range for your hub region. 该中心是虚拟 WAN 创建和使用的虚拟网络。The hub is a virtual network that is created and used by Virtual WAN. 为中心指定的地址范围不能与要连接到的任何现有虚拟网络重叠。The address range that you specify for the hub cannot overlap with any of your existing virtual networks that you connect to. 此外,它也不能与本地连接到的地址范围重叠。It also cannot overlap with your address ranges that you connect to on premises. 如果不熟悉本地网络配置中的 IP 地址范围,则咨询能够提供此类详细信息的人员。If you are unfamiliar with the IP address ranges located in your on-premises network configuration, coordinate with someone who can provide those details for you.

  • 如果没有 Azure 订阅,请创建一个试用帐户If you don't have an Azure subscription, create a trial account.

创建虚拟 WANCreate a virtual WAN

从浏览器导航到 Azure 门户并使用 Azure 帐户登录。From a browser, navigate to the Azure portal and sign in with your Azure account.

  1. 导航到“虚拟 WAN”页。Navigate to the Virtual WAN page. 在门户中,单击“+创建资源”。In the portal, click +Create a resource. 在搜索框中键入“虚拟 WAN”,然后选择 Enter。Type Virtual WAN into the search box and select Enter.

  2. 从结果中选择“虚拟 WAN”。Select Virtual WAN from the results. 在“虚拟 WAN”页上,单击“创建”以打开“创建 WAN”页。On the Virtual WAN page, click Create to open the Create WAN page.

  3. 在“创建 WAN”页的“基本信息”选项卡上,填写以下字段 :On the Create WAN page, on the Basics tab, fill in the following fields:

    虚拟 WAN

    • 订阅 - 选择要使用的订阅。Subscription - Select the subscription that you want to use.
    • 资源组 - 新建资源组或使用现有的资源组。Resource group - Create new or use existing.
    • 资源组位置 - 从下拉列表中选择资源位置。Resource group location - Choose a resource location from the dropdown. WAN 是一个全局资源,不会驻留在某个特定区域。A WAN is a global resource and does not live in a particular region. 但是,必须选择一个区域才能更轻松地管理和查找所创建的 WAN 资源。However, you must select a region in order to more easily manage and locate the WAN resource that you create.
    • 名称 - 键入要用于称呼 WAN 的名称。Name - Type the Name that you want to call your WAN.
    • 类型: 标准。Type: Standard. 如果创建基本 WAN,则只能创建基本中心。If you create a Basic WAN, you can create only a Basic hub. 基本中心仅支持 VPN 站点到站点连接。Basic hubs are capable of VPN site-to-site connectivity only.
  4. 填写完字段后,单击“审阅 + 创建”。After you finish filling out the fields, select Review +Create.

  5. 验证通过后,选择“创建”以创建虚拟 WAN。Once validation passes, select Create to create the virtual WAN.

创建空虚拟中心Create an empty virtual hub

  1. 在虚拟 WAN 下,选择“中心”,然后单击“+新建中心”Under your virtual WAN, select Hubs and click +New Hub

    新建站点

  2. 在“创建虚拟中心”页上,请填写以下字段。On the create virtual hub page, fill in the following fields.

    区域 - 选择要在其中部署虚拟中心的区域。Region - Select the region that you want to deploy the virtual hub in.

    名称 - 输入要用于称呼虚拟中心的名称。Name - Enter the name that you want to call your virtual hub.

    中心专用地址空间 - 用 CIDR 表示法来表示的中心地址范围。Hub private address space - The hub's address range in CIDR notation.

    新建站点

  3. 单击“查看 + 创建”Click Review + create

  4. 在“验证已通过”页上,单击“创建”On the validation passed page, click create

创建 P2S 配置Create a P2S configuration

P2S 配置定义连接远程客户端的参数。A P2S configuration defines the parameters for connecting remote clients.

  1. 导航到“所有资源”。Navigate to All resources.

  2. 单击创建的虚拟 WAN。Click the virtual WAN that you created.

  3. 单击页面顶部的“+创建用户 VPN 配置”,打开“创建新的用户 VPN 配置”页。Click +Create user VPN config at the top of the page to open the Create new User VPN configuration page.

    新建站点

  4. 在“创建新的用户 VPN 配置”页上填写以下字段:On the Create new user VPN configuration page, fill in the following fields:

    配置名称 - 这是需要按其来引用配置的名称。Configuration name - This is the name by which you want to refer to your configuration.

    隧道类型 - 用于隧道的协议。Tunnel type - The protocol to use for the tunnel.

    根证书名称 - 证书的说明性名称。Root Certificate Name - A descriptive name for the certificate.

    公用证书数据 - Base-64 编码的 X.509 证书数据。Public Certificate Data - Base-64 encoded X.509 certificate data.

  5. 单击“创建”以创建配置。Click Create to create the configuration.

编辑中心分配Edit hub assignment

  1. 导航到虚拟 WAN 下的“中心”边栏选项卡Navigate to the Hubs blade under the virtual WAN

  2. 选择要将 VPN 服务器配置与之关联的中心,然后单击“...”Select the hub that you want to associate the vpn server configuration to and click ...

    新建站点

  3. 单击“编辑虚拟中心”。Click Edit virtual hub.

  4. 选中“包括点到站点网关”复选框,然后选择所需的网关缩放单元。Check the Include point-to-site gateway check box and pick the Gateway scale unit that you want.

    新建站点

    下表显示了有关可用缩放单元的详细信息The table below shows the details about the available Scale Units

    缩放单元Scale Unit 吞吐量Throughput P2S 连接P2S Connections
    11 500 Mbps500 Mbps 500500
    22 1 Gbps1 Gbps 500500
    33 1.5 Gbps1.5 Gbps 500500
    44 2 Gbps2 Gbps 10001000
    55 2.5 Gbps2.5 Gbps 10001000
    66 3 Gbps3 Gbps 10001000
    77 3.5 Gbps3.5 Gbps 50005000
    88 4 Gbps4 Gbps 50005000
    99 4.5 Gbps4.5 Gbps 50005000
    10 个10 5 Gbps5 Gbps 50005000
    1111 5.5 Gbps5.5 Gbps 50005000
    1212 6 Gbps6 Gbps 50005000
    1313 6.5 Gbps6.5 Gbps 1000010000
    1414 7 Gbps7 Gbps 1000010000
    1515 7.5 Gbps7.5 Gbps 1000010000
    1616 8 Gbps8 Gbps 1000010000
    1717 8.5 Gbps8.5 Gbps 1000010000
    1818 9 Gbps9 Gbps 1000010000
    1919 9.5 Gbps9.5 Gbps 1000010000
    20 个20 10 Gbps10 Gbps 1000010000
  5. 输入用于为 VPN 客户端分配 IP 地址的“地址池”。Enter the Address pool from which the VPN clients will be assigned IP addresses.

  6. 单击“确认”Click Confirm

  7. 完成此操作最多需要 30 分钟。The operation will can take up to 30 minutes to complete.

下载 VPN 配置文件Download VPN profile

使用 VPN 配置文件来配置客户端。Use the VPN profile to configure your clients.

  1. 在虚拟 WAN 的页面上,单击“用户 VPN 配置”。On the page for your virtual WAN, click User VPN configurations.
  2. 在页面顶部,单击“下载用户 VPN 配置”。At the top of the page, click Download user VPN config.
  3. 完成创建文件后,可以单击相应的链接下载该文件。Once the file has finished creating, you can click the link to download it.
  4. 使用此配置文件配置 VPN 客户端。Use the profile file to configure the VPN clients.

配置用户 VPN 客户端Configure user VPN clients

使用下载的配置文件配置远程访问客户端。Use the downloaded profile to configure the remote access clients. 每个操作系统的过程并不相同,请按照下面的正确说明操作:The procedure for each operating system is different, please follow the correct instructions below:

Microsoft WindowsMicrosoft Windows

OpenVPNOpenVPN
  1. 从官方网站下载并安装 OpenVPN 客户端。Download and install the OpenVPN client from the official website.
  2. 下载网关的 VPN 配置文件。Download the VPN profile for the gateway. 这可以通过 Azure 门户中的“用户 VPN 配置”选项卡或 PowerShell 中的 New-AzureRmVpnClientConfiguration 来完成。This can be done from the User VPN configurations tab in Azure portal, or New-AzureRmVpnClientConfiguration in PowerShell.
  3. 解压缩该配置文件。Unzip the profile. 从记事本中的 OpenVPN 文件夹中打开 vpnconfig.ovpn 配置文件。Open the vpnconfig.ovpn configuration file from the OpenVPN folder in notepad.
  4. 使用 base64 中的 P2S 客户端证书公钥填写 P2S 客户端证书部分。Fill in the P2S client certificate section with the P2S client certificate public key in base64. 在 PEM 格式的证书中,可以直接打开 .cer 文件并在证书标头之间复制 base64 密钥。In a PEM formatted certificate, you can simply open the .cer file and copy over the base64 key between the certificate headers. 有关步骤,请参阅如何导出证书以获取已编码的公钥For steps, see How to export a certificate to get the encoded public key.
  5. 使用 base64 中的 P2S 客户端证书私钥填写私钥部分。Fill in the private key section with the P2S client certificate private key in base64. 有关步骤,请参阅如何提取私钥For steps, see How to extract private key..
  6. 不要更改任何其他字段。Do not change any other fields. 使用客户端输入中的已填充的配置连接到 VPN。Use the filled in configuration in client input to connect to the VPN.
  7. 将 vpnconfig.ovpn 文件复制到 C:\Program Files\OpenVPN\config 文件夹。Copy the vpnconfig.ovpn file to C:\Program Files\OpenVPN\config folder.
  8. 右键单击系统托盘中的 OpenVPN 图标,然后单击“连接”。Right-click the OpenVPN icon in the system tray and click connect.
IKEv2IKEv2
  1. 根据 Windows 计算机的体系结构选择 VPN 客户端配置文件。Select the VPN client configuration files that correspond to the architecture of the Windows computer. 对于 64 位处理器体系结构,请选择“VpnClientSetupAmd64”安装程序包。For a 64-bit processor architecture, choose the 'VpnClientSetupAmd64' installer package. 对于 32 位处理器体系结构,请选择“VpnClientSetupX86”安装程序包。For a 32-bit processor architecture, choose the 'VpnClientSetupX86' installer package.
  2. 双击所需的包进行安装。Double-click the package to install it. 如果显示 SmartScreen 弹出窗口,请单击“更多信息”,并单击“仍要运行”。If you see a SmartScreen popup, click More info, then Run anyway.
  3. 在客户端计算机上,导航到“网络设置”,并单击“VPN”。On the client computer, navigate to Network Settings and click VPN. VPN 连接显示所连接到的虚拟网络的名称。The VPN connection shows the name of the virtual network that it connects to.
  4. 尝试连接前,请验证客户端计算机上是否已安装客户端证书。Before you attempt to connect, verify that you have installed a client certificate on the client computer. 使用本机 Azure 证书身份验证类型时,客户端证书是身份验证必需的。A client certificate is required for authentication when using the native Azure certificate authentication type. 有关生成证书的详细信息,请参阅生成证书For more information about generating certificates, see Generate Certificates. 有关如何安装客户端证书的信息,请参阅安装客户端证书For information about how to install a client certificate, see Install a client certificate.

查看虚拟 WANView your virtual WAN

  1. 导航到虚拟 WAN。Navigate to the virtual WAN.
  2. 在“概述”页上,地图中的每个点表示一个中心。On the Overview page, each point on the map represents a hub.
  3. 在“中心和连接”部分,可以查看中心状态、站点、区域、VPN 连接状态和传入与传出字节数。In the Hubs and connections section, you can view hub status, site, region, VPN connection status, and bytes in and out.

清理资源Clean up resources

如果不再需要这些资源,可以使用 Remove-AzureRmResourceGroup 删除资源组及其包含的所有资源。When you no longer need these resources, you can use Remove-AzureRmResourceGroup to remove the resource group and all of the resources it contains. 将“myResourceGroup”替换为资源组的名称,并运行以下 PowerShell 命令:Replace "myResourceGroup" with the name of your resource group and run the following PowerShell command:

Remove-AzResourceGroup -Name myResourceGroup -Force

后续步骤Next steps

若要详细了解虚拟 WAN,请参阅虚拟 WAN 概述页。To learn more about Virtual WAN, see the Virtual WAN Overview page.