为 VPN 网关配置数据包捕获Configure packet captures for VPN gateways

连接和性能相关的问题往往很复杂,缩小其原因排查范围需要花费大量的时间和精力。Connectivity and performance-related issues are often complex and take significant amount of time and effort just to narrow down the cause of the problem. 数据包捕获功能有助于大大缩短将问题范围缩小到特定网络部分所花费的时间,例如,问题是在网络的客户一端、网络的 Azure 一端,还是在两者之间的某个位置发生。Ability to packet capture greatly helps reduce time in narrowing down the scope of the problem to certain parts of the network, such as whether the issue is on the customer side of the network, the Azure side of the network, or somewhere in between. 缩小问题的范围后,调试和采取补救措施就要高效得多。Once the issue has been narrowed down, it is much more efficient to debug and take remedial action.

可以使用一些常用的工具来获取数据包捕获。There are some commonly available tools for packet capture. 使用这些工具获取相关的数据包捕获会比较繁琐,尤其是在处理高流量的情况下。Getting relevant packet captures with these tools can be cumbersome, especially when working with high volume traffic scenarios. VPN 网关数据包捕获提供的筛选功能已成为一项主要优势。Filtering capabilities provided by a VPN gateway packet capture becomes a major differentiator. 除了常用的数据包捕获工具以外,也可以使用 VPN 网关数据包捕获。You may use a VPN gateway packet capture in addition to commonly available packet capture tools.

VPN 网关数据包捕获筛选功能VPN gateway packet capture filtering capabilities

VPN 网关数据包捕获可在网关上运行,或者在特定的连接上运行,具体取决于客户的需求。VPN gateway packet captures can be run on the gateway or on a specific connection depending on customer needs. 还可以同时在多个隧道上运行数据包捕获。You can also run packet captures on multiple tunnels at the same time. 可以捕获单向或双向流量、IKE 和 ESP 流量以及内部数据包,并可对 VPN 网关进行筛选。You can capture single or bi-direction traffic, IKE and ESP traffic, and inner packets along with filtering on a VPN gateway.

查明高流量相关问题时,使用 5 元组筛选器(源子网、目标子网、源端口、目标端口、协议)和 TCP 标志(SYN、ACK、FIN、URG、PSH、RST)将很有帮助。Using a five-tuple filter (source subnet, destination subnet, source port, destination port, protocol) and TCP flags (SYN, ACK, FIN, URG, PSH, RST) is helpful when isolating issues on a high volume traffic.

下面是 JSON 和 JSON 架构的示例,以及对每个属性的说明。See below an example of JSON and JSON schema with explanation of each property. 另外,请注意运行数据包捕获时的一些限制:Also, note some limitations while running the packet captures:

  • 在架构中,筛选条件显示为一个数组,但目前一次只能使用一个筛选条件。In the schema, filter is shown as an array but at present only one filter can be used at a time.
  • 不允许同时捕获多个网关范围的数据包。Multiple gateway-wide packet captures at the same time are not allowed.
  • 不允许在同一连接上同时捕获多个数据包。Multiple packet captures on the same connection at the same time are not allowed. 可以同时在不同的连接上运行数据包捕获。You can run packet captures on different connections at the same time.
  • 每个网关最多可以并行运行 5 个数据包捕获。A maximum of five packet captures can be run in parallel per gateway. 这些数据包捕获可以是网关范围的数据包捕获或基于连接的数据包捕获的组合。These packet captures can be a combination of gateway-wide packet capture or per connection packet capture.

示例 JSONExample JSON

{
  "TracingFlags": 11,
  "MaxPacketBufferSize": 120,
  "MaxFileSize": 200,
  "Filters": [
    {
      "SourceSubnets": [
        "20.1.1.0/24"
      ],
      "DestinationSubnets": [
        "10.1.1.0/24"
      ],
      "SourcePort": [
        500
      ],
      "DestinationPort": [
        4500
      ],
      "Protocol": [
        6
      ],
      "TcpFlags": 16,
      "CaptureSingleDirectionTrafficOnly": true
    }
  ]
}

JSON 架构JSON schema

{
    "type": "object",
    "title": "The Root Schema",
    "description": "The root schema input JSON filter for packet capture",
    "default": {},
    "additionalProperties": true,
    "required": [
        "TracingFlags",
        "MaxPacketBufferSize",
        "MaxFileSize",
        "Filters"
    ],
    "properties": {
        "TracingFlags": {
            "$id": "#/properties/TracingFlags",
            "type": "integer",
            "title": "The Tracingflags Schema",
            "description": "Tracing flags that customer can pass to define which packets are to be captured. Supported values are CaptureESP = 1, CaptureIKE = 2, CaptureOVPN = 8. The final value is OR of the bits.",
            "default": 11,
            "examples": [
                11
            ]
        },
        "MaxPacketBufferSize": {
            "$id": "#/properties/MaxPacketBufferSize",
            "type": "integer",
            "title": "The Maxpacketbuffersize Schema",
            "description": "Maximum buffer size of each packet. The capture will only contain contents of each packet truncated to this size.",
            "default": 120,
            "examples": [
                120
            ]
        },
        "MaxFileSize": {
            "$id": "#/properties/MaxFileSize",
            "type": "integer",
            "title": "The Maxfilesize Schema",
            "description": "Maximum file size of the packet capture file. It is a circular buffer.",
            "default": 100,
            "examples": [
                100
            ]
        },
        "Filters": {
            "$id": "#/properties/Filters",
            "type": "array",
            "title": "The Filters Schema",
            "description": "An array of filters that can be passed to filter inner ESP traffic.",
            "default": [],
            "examples": [
                [
                    {
                        "Protocol": [
                            6
                        ],
                        "CaptureSingleDirectionTrafficOnly": true,
                        "SourcePort": [
                            500
                        ],
                        "DestinationPort": [
                            4500
                        ],
                        "TcpFlags": 16,
                        "SourceSubnets": [
                            "20.1.1.0/24"
                        ],
                        "DestinationSubnets": [
                            "10.1.1.0/24"
                        ]
                    }
                ]
            ],
            "additionalItems": true,
            "items": {
                "$id": "#/properties/Filters/items",
                "type": "object",
                "title": "The Items Schema",
                "description": "An explanation about the purpose of this instance.",
                "default": {},
                "examples": [
                    {
                        "SourcePort": [
                            500
                        ],
                        "DestinationPort": [
                            4500
                        ],
                        "TcpFlags": 16,
                        "SourceSubnets": [
                            "20.1.1.0/24"
                        ],
                        "DestinationSubnets": [
                            "10.1.1.0/24"
                        ],
                        "Protocol": [
                            6
                        ],
                        "CaptureSingleDirectionTrafficOnly": true
                    }
                ],
                "additionalProperties": true,
                "required": [
                    "SourceSubnets",
                    "DestinationSubnets",
                    "SourcePort",
                    "DestinationPort",
                    "Protocol",
                    "TcpFlags",
                    "CaptureSingleDirectionTrafficOnly"
                ],
                "properties": {
                    "SourceSubnets": {
                        "$id": "#/properties/Filters/items/properties/SourceSubnets",
                        "type": "array",
                        "title": "The Sourcesubnets Schema",
                        "description": "An array of source subnets that need to match the Source IP address of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                "20.1.1.0/24"
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/SourceSubnets/items",
                            "type": "string",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": "",
                            "examples": [
                                "20.1.1.0/24"
                            ]
                        }
                    },
                    "DestinationSubnets": {
                        "$id": "#/properties/Filters/items/properties/DestinationSubnets",
                        "type": "array",
                        "title": "The Destinationsubnets Schema",
                        "description": "An array of destination subnets that need to match the Destination IP address of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                "10.1.1.0/24"
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/DestinationSubnets/items",
                            "type": "string",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": "",
                            "examples": [
                                "10.1.1.0/24"
                            ]
                        }
                    },
                    "SourcePort": {
                        "$id": "#/properties/Filters/items/properties/SourcePort",
                        "type": "array",
                        "title": "The Sourceport Schema",
                        "description": "An array of source ports that need to match the Source port of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                500
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/SourcePort/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                500
                            ]
                        }
                    },
                    "DestinationPort": {
                        "$id": "#/properties/Filters/items/properties/DestinationPort",
                        "type": "array",
                        "title": "The Destinationport Schema",
                        "description": "An array of destination ports that need to match the Destination port of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                4500
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/DestinationPort/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                4500
                            ]
                        }
                    },
                    "Protocol": {
                        "$id": "#/properties/Filters/items/properties/Protocol",
                        "type": "array",
                        "title": "The Protocol Schema",
                        "description": "An array of protocols that need to match the Protocol of a packet. Packet can match any one value in the array of inputs.",
                        "default": [],
                        "examples": [
                            [
                                6
                            ]
                        ],
                        "additionalItems": true,
                        "items": {
                            "$id": "#/properties/Filters/items/properties/Protocol/items",
                            "type": "integer",
                            "title": "The Items Schema",
                            "description": "An explanation about the purpose of this instance.",
                            "default": 0,
                            "examples": [
                                6
                            ]
                        }
                    },
                    "TcpFlags": {
                        "$id": "#/properties/Filters/items/properties/TcpFlags",
                        "type": "integer",
                        "title": "The Tcpflags Schema",
                        "description": "A list of TCP flags. The TCP flags set on the packet must match any flag in the list of flags provided. FIN = 0x01,SYN = 0x02,RST = 0x04,PSH = 0x08,ACK = 0x10,URG = 0x20,ECE = 0x40,CWR = 0x80. An OR of flags can be provided.",
                        "default": 0,
                        "examples": [
                            16
                        ]
                    },
                    "CaptureSingleDirectionTrafficOnly": {
                        "$id": "#/properties/Filters/items/properties/CaptureSingleDirectionTrafficOnly",
                        "type": "boolean",
                        "title": "The Capturesingledirectiontrafficonly Schema",
                        "description": "A flags which when set captures reverse traffic also.",
                        "default": false,
                        "examples": [
                            true
                        ]
                    }
                }
            }
        }
    }
}

使用 PowerShell 设置数据包捕获Setup packet capture using PowerShell

请参阅以下示例来了解如何使用 PowerShell 命令启动和停止数据包捕获。See the examples below for PowerShell commands to start and stop packet captures. 有关参数选项的详细信息,请参阅此 PowerShell 文档For more information on parameter options, see this PowerShell document.

启动 VPN 网关的数据包捕获Start packet capture for a VPN gateway

Start-AzVirtualnetworkGatewayPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayName"

可选参数 -FilterData 可用于应用筛选器。Optional parameter -FilterData can be used to apply filter.

停止 VPN 网关的数据包捕获Stop packet capture for a VPN gateway

Stop-AzVirtualNetworkGatewayPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayName" -SasUrl "YourSASURL"

启动 VPN 网关连接的数据包捕获Start packet capture for a VPN gateway connection

Start-AzVirtualNetworkGatewayConnectionPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayConnectionName"

可选参数 -FilterData 可用于应用筛选器。Optional parameter -FilterData can be used to apply filter.

在 VPN 网关连接上停止数据包捕获Stop packet capture on a VPN gateway connection

Stop-AzVirtualNetworkGatewayConnectionPacketCapture -ResourceGroupName "YourResourceGroupName" -Name "YourVPNGatewayConnectionName" -SasUrl "YourSASURL"

重要注意事项Key considerations

  • 运行数据包捕获可能会影响性能。Running packet captures may affect performance. 不需要数据包捕获时,请记得将其停止。Remember to stop the packet capture when it is not needed.
  • 建议的最短数据包捕获持续时间为 600 秒。Suggested minimum packet capture duration is 600 seconds. 由于路径中多个组件之间的同步问题,使用较短的数据包捕获持续时间可能无法提供完整的数据。Having shorter packet capture duration may not provide complete data due to sync up issues among multiple components on the path.
  • 数据包捕获数据文件以 PCAP 格式生成。Packet capture data files are generated in PCAP format. 使用 Wireshark 或其他常用应用程序打开 PCAP 文件。Use Wireshark or other commonly available applications to open PCAP files.

后续步骤Next steps

有关 VPN 网关的详细信息,请参阅关于 VPN 网关For more information about VPN Gateway, see About VPN Gateway