为 VPN 网关配置数据包捕获

项目
09/15/2023

与连接和性能相关的问题通常很复杂。缩小确定问题原因的范围可能需要花费大量时间和精力。数据包捕获有助于将问题范围缩小到网络的某些部分。它有助于确定问题是出现在网络的客户端、网络的 Azure 端还是两者之间的某个位置。缩小问题范围后，可以更高效地调试和采取补救措施。

可以使用一些常用数据包捕获工具。使用这些工具获取相关的数据包捕获会比较繁琐，尤其是在高流量场景中。 Azure VPN 网关数据包捕获提供的筛选功能是一项主要优势。可以将 VPN 网关数据包捕获与常用的数据包捕获工具结合使用。

关于 VPN 网关的数据包捕获

可在网关或特定连接上运行 VPN 网关数据包捕获，具体取决于你的需求。还可以同时在多个隧道上运行数据包捕获。可捕获单向或双向流量、IKE 和 ESP 流量以及内部数据包，并对 VPN 网关进行筛选。

查明高流量相关问题时，使用 5 元组筛选器（源子网、目标子网、源端口、目标端口、协议）和 TCP 标志（SYN、ACK、FIN、URG、PSH、RST）会很有帮助。

以下 JSON 和 JSON 架构示例提供每个属性的说明。运行数据包捕获时，请记住以下限制：

在此处显示的架构中，筛选器是一个数组，但目前一次只能使用一个筛选器。
无法同时运行多个网关范围的数据包捕获。
无法在同一连接上同时运行多个数据包捕获。可以同时在不同的连接上运行多个数据包捕获。
每个网关最多可以并行运行 5 个数据包捕获。这些数据包捕获可以是网关范围的数据包捕获和基于连接的数据包捕获的组合。
MaxPacketBufferSize 的单位为字节，MaxFileSize 的单位为 MB

注意

如果要同时捕获内部数据包和外部数据包，请将 CaptureSingleDirectionTrafficOnly 选项设置为 false。

示例 JSON

{
  "TracingFlags": 11,
  "MaxPacketBufferSize": 120,
  "MaxFileSize": 200,
  "Filters": [
    {
      "SourceSubnets": [
        "20.1.1.0/24"
      ],
      "DestinationSubnets": [
        "10.1.1.0/24"
      ],
      "SourcePort": [
        500
      ],
      "DestinationPort": [
        4500
      ],
      "Protocol": [
        6
      ],
      "TcpFlags": 16,
      "CaptureSingleDirectionTrafficOnly": true
    }
  ]
}

JSON 架构

{
    "type": "object",
    "title": "The Root Schema",
    "description": "The root schema input JSON filter for packet capture",
    "default": {},
    "additionalProperties": true,
    "required": [
        "TracingFlags",
        "MaxPacketBufferSize",
        "MaxFileSize",
        "Filters"
    ],
    "properties": {
        "TracingFlags": {
            "$id": "#/properties/TracingFlags",
            "type": "integer",
            "title": "The Tracingflags Schema",
            "description": "Tracing flags that customer can pass to define which packets are to be captured. Supported values are CaptureESP = 1, CaptureIKE = 2, CaptureOVPN = 8. The final value is OR of the bits.",
            "default": 11,
            "examples": [
                11
            ]
        },
        "MaxPacketBufferSize": {
            "$id": "#/properties/MaxPacketBufferSize",
            "type": "integer",
            "title": "The Maxpacketbuffersize Schema",
            "description": "Maximum buffer size of each packet. The capture will only contain contents of each packet truncated to this size.",
            "default": 120,
            "examples": [
                120
            ]
        },
        "MaxFileSize": {
            "$id": "#/properties/MaxFileSize",
            "type": "integer",
            "title": "The Maxfilesize Schema",
            "description": "Maximum file size of the packet capture file. It is a circular buffer.",
            "default": 100,
            "examples": [
                100
            ]
        },
        "Filters": {
            "$id": "#/properties/Filters",
            "type": "array",
            "title": "The Filters Schema",
            "description": "An array of filters that can be passed to filter inner ESP traffic.",
            "default": [],
            "examples": [
                [
                    {
                        "Protocol": [
                            6
                        ],
                        "CaptureSingleDirectionTrafficOnly": true,
                        "SourcePort": [
                            500
                        ],
                        "DestinationPort": [
                            4500
                        ],
                        "TcpFlags": 16,
                        "SourceSubnets": [
                            "20.1.1.0/24"
                        ],
                        "DestinationSubnets": [
                            "10.1.1.0/24"
                        ]
                    }
                ]
            ],
            "additionalItems": true,
            "items": {
                "$id": "#/properties/Filters/items",
                "type": "object",
                "title": "The Items Schema",
                "description": "An explanation about the purpose of this instance.",
                "default": {},
                "examples": [
                    {
                        "SourcePort": [
                            500
                        ],
                        "DestinationPort": [
                            4500
                        ],
                        "TcpFlags": 16,
                        "SourceSubnets": [
                            "20.1.1.0/24"
                        ],
                        "DestinationSubnets": [
                            "10.1.1.0/24"
                        ],
                        "Protocol": [
                            6
                        ],
                        "CaptureSingleDirectionTrafficOnly": true
                    }
                ],
                "additionalProperties": true,
                "required": [
                    "SourceSubnets",
                    "DestinationSubnets",
                    "SourcePort",
                    "DestinationPort",
                    "Protocol",
                    "TcpFlags",
                    "CaptureSingleDirectionTrafficOnly"
                ],
                "properties": {
                    "SourceSubnets": {
                        "$id": "#/properties/Filters/items/properties/SourceSubnets",
                        "type": "array",
                        "title": "The Sourcesubnets Schema",
                        "description": "An array of source subnets that need to match the Source IP address of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                "20.1.1.0/24"
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/SourceSubnets/items",
                            "type": "string",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": "",
                            "examples": [
                                "20.1.1.0/24"
                            ]
                        }
                    },
                    "DestinationSubnets": {
                        "$id": "#/properties/Filters/items/properties/DestinationSubnets",
                        "type": "array",
                        "title": "The Destinationsubnets Schema",
                        "description": "An array of destination subnets that need to match the Destination IP address of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                "10.1.1.0/24"
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/DestinationSubnets/items",
                            "type": "string",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": "",
                            "examples": [
                                "10.1.1.0/24"
                            ]
                        }
                    },
                    "SourcePort": {
                        "$id": "#/properties/Filters/items/properties/SourcePort",
                        "type": "array",
                        "title": "The Sourceport Schema",
                        "description": "An array of source ports that need to match the Source port of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                500
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/SourcePort/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                500
                            ]
                        }
                    },
                    "DestinationPort": {
                        "$id": "#/properties/Filters/items/properties/DestinationPort",
                        "type": "array",
                        "title": "The Destinationport Schema",
                        "description": "An array of destination ports that need to match the Destination port of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                4500
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/DestinationPort/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                4500
                            ]
                        }
                    },
                    "Protocol": {
                        "$id": "#/properties/Filters/items/properties/Protocol",
                        "type": "array",
                        "title": "The Protocol Schema",
                        "description": "An array of protocols that need to match the Protocol of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                6
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/Protocol/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                6
                            ]
                        }
                    },
                    "TcpFlags": {
                        "$id": "#/properties/Filters/items/properties/TcpFlags",
                        "type": "integer",
                        "title": "The Tcpflags Schema",
                        "description": "A list of TCP flags. The TCP flags set on the packet must match any flag in the list of flags provided. FIN = 0x01,SYN = 0x02,RST = 0x04,PSH = 0x08,ACK = 0x10,URG = 0x20,ECE = 0x40,CWR = 0x80. An OR of flags can be provided.",
                        "default": 0,
                        "examples": [
                            16
                        ]
                    },
                    "CaptureSingleDirectionTrafficOnly": {
                        "$id": "#/properties/Filters/items/properties/CaptureSingleDirectionTrafficOnly",
                        "type": "boolean",
                        "title": "The Capturesingledirectiontrafficonly Schema",
                        "description": "A flags which when set captures reverse traffic also.",
                        "default": false,
                        "examples": [
                            true
                        ]
                    }
                }
            }
        }
    }
}

重要注意事项

运行数据包捕获会影响性能。不需要数据包捕获时，请记得将其停止。
建议的最短数据包捕获持续时间为 600 秒。由于路径上多个组件之间的同步问题，较短的数据包捕获可能无法提供完整的数据。
数据包捕获数据文件以 PCAP 格式生成。使用 Wireshark 或其他常用应用程序打开 PCAP 文件。
基于策略的网关不支持数据包捕获。
数据包捕获数据文件的最大文件大小为 500MB。
如果 SASurl 参数配置不正确，则跟踪可能会失败，并显示 Azure 存储错误。有关如何正确生成 SASurl 参数的示例，请参阅 SASurl。
如果要配置用户委托 SAS，请确保向用户帐户授予对存储帐户的适当 RBAC 权限（例如，存储 Blob 数据所有者）。

数据包捕获 - 门户

本部分可帮助你使用 Azure 门户启动和停止数据包捕获。

启动数据包捕获 - 门户

可以在 Azure 门户中设置数据包捕获。

在 Azure 门户中转到 VPN 网关。
在左侧选择“VPN 网关数据包捕获”，以打开“VPN 网关数据包捕获”页。
选择“启动数据包捕获”。
在“启动数据包捕获”页上，进行任何必要的调整。如果要同时捕获内部数据包和外部数据包，请勿选择“仅捕获单向流量”选项。
配置设置后，单击“启动数据包捕获”。

停止数据包捕获 - 门户

要完成数据包捕获，需要提供具有读/写访问权限的有效 SAS（或共享访问签名）URL。停止数据包捕获后，数据包捕获的输出会写入由 SAS URL 引用的容器。

要获取 SAS URL，请转到存储帐户。
转到要使用的容器并右键单击以显示下拉列表。选择“生成 SAS”以打开“生成 SAS”页。
在“生成 SAS”页上配置设置。确保已授予读取和写入访问权限。
单击“生成 SAS 令牌和 URL”。
此时将生成 SAS 令牌和 SAS URL，并立即显示在按钮下方。复制 Blob SAS URL。
返回到 Azure 门户中的“VPN 网关数据包捕获”页，然后单击“停止数据包捕获”按钮。
将 SAS URL（来自上一步）粘贴到“输出 SAS Url”文本框中，然后单击“停止数据包捕获”。
数据包捕获 (pcap) 文件将存储在指定的帐户中。

数据包捕获 - PowerShell

以下示例显示使用 PowerShell 命令启动和停止数据包捕获。有关参数选项的详细信息，请参阅 Start-AzVirtualnetworkGatewayPacketCapture。

先决条件

数据包捕获数据需要记录到订阅上的存储帐户中。请参阅创建存储帐户。
要停止数据包捕获，需要为存储帐户生成 SASUrl。请参阅创建用户委派 SAS。

启动 VPN 网关的数据包捕获

Start-AzVirtualnetworkGatewayPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayName"

可以使用可选参数 -FilterData 来应用筛选器。

停止 VPN 网关的数据包捕获

Stop-AzVirtualNetworkGatewayPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayName" -SasUrl "YourSASURL"

有关参数选项的详细信息，请参阅 Stop-AzVirtualNetworkGatewayPacketCapture。

启动 VPN 网关连接的数据包捕获

Start-AzVirtualNetworkGatewayConnectionPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayConnectionName"