配置与 Azure VPN 网关的主动-主动 S2S VPN 连接Configure active-active S2S VPN connections with Azure VPN Gateways

本文逐步讲解如何使用 Resource Manager 部署模型和 PowerShell 创建主动-主动跨界连接与 VNet 到 VNet 连接。This article walks you through the steps to create active-active cross-premises and VNet-to-VNet connections using the Resource Manager deployment model and PowerShell. 还可以在 Azure 门户中配置主动-主动网关。You can also configure an active-active gateway in the Azure portal.

关于高可用性跨界连接About highly available cross-premises connections

若要实现跨界连接和 VNet 到 VNet 连接的高可用性,应该部署多个 VPN 网关,在网络与 Azure 之间建立多个并行连接。To achieve high availability for cross-premises and VNet-to-VNet connectivity, you should deploy multiple VPN gateways and establish multiple parallel connections between your networks and Azure. 有关连接选项和拓扑的概述,请参阅高可用性跨界连接与 VNet 到 VNet 连接See Highly Available Cross-Premises and VNet-to-VNet Connectivity for an overview of connectivity options and topology.

本文提供有关设置两个虚拟网络之间的主动-主动跨界 VPN 连接以及主动-主动连接的说明。This article provides the instructions to set up an active-active cross-premises VPN connection, and active-active connection between two virtual networks.

如果已有 VPN 网关,则可以:If you already have a VPN gateway, you can:

可以将这些选项结合起来,构建符合要求的更复杂、高度可用的网络拓扑。You can combine these together to build a more complex, highly available network topology that meets your needs.

重要

主动-主动模式适用于除 Basic 之外的所有 SKU。The active-active mode is available for all SKUs except Basic.

第 1 部分 - 创建并设置主动-主动 VPN 网关Part 1 - Create and configure active-active VPN gateways

以下步骤将 Azure VPN 网关配置为主动-主动模式。The following steps will configure your Azure VPN gateway in active-active modes. 主动-主动与主机-待机网关之间的重要差异:The key differences between the active-active and active-standby gateways:

  • 需要使用两个公共 IP 地址创建两个网关 IP 配置You need to create two Gateway IP configurations with two public IP addresses
  • 需要设置 EnableActiveActiveFeature 标志You need set the EnableActiveActiveFeature flag
  • 网关 SKU 必须为 VpnGw1、VpnGw2、VpnGw3 或 HighPerformance(旧 SKU)。The gateway SKU must be VpnGw1, VpnGw2, VpnGw3, or HighPerformance (legacy SKU).

其他属性与非主动-主动网关相同。The other properties are the same as the non-active-active gateways.

准备阶段Before you begin

  • 确保拥有 Azure 订阅。Verify that you have an Azure subscription. 如果还没有 Azure 订阅,可以注册一个试用帐户If you don't already have an Azure subscription, you can sign up for a trial account.
  • 需要安装 Azure Resource Manager PowerShell cmdlet。You'll need to install the Azure Resource Manager PowerShell cmdlets. 有关安装 PowerShell cmdlet 的详细信息,请参阅 Azure PowerShell 概述See Overview of Azure PowerShell for more information about installing the PowerShell cmdlets.

步骤 1 - 创建并配置 VNet1Step 1 - Create and configure VNet1

1.声明变量1. Declare your variables

对于本练习,我们首先要声明变量。For this exercise, we'll start by declaring our variables. 使用下面的示例来帮助连接:Use the following example to help you connect:

Connect-AzAccount -Environment AzureChinaCloud
Select-AzSubscription -SubscriptionName $Sub1

以下示例使用此练习中的值来声明变量。The example below declares the variables using the values for this exercise. 请务必在配置生产环境时,使用自己的值来替换该值。Be sure to replace the values with your own when configuring for production. 如果执行这些步骤是为了熟悉此类型的配置,则可以使用这些变量。You can use these variables if you are running through the steps to become familiar with this type of configuration. 修改变量,并将其复制并粘贴到 PowerShell 控制台中。Modify the variables, and then copy and paste into your PowerShell console.

$Sub1 = "Ross"
$RG1 = "TestAARG1"
$Location1 = "China North"
$VNetName1 = "TestVNet1"
$FESubName1 = "FrontEnd"
$BESubName1 = "Backend"
$GWSubName1 = "GatewaySubnet"
$VNetPrefix11 = "10.11.0.0/16"
$VNetPrefix12 = "10.12.0.0/16"
$FESubPrefix1 = "10.11.0.0/24"
$BESubPrefix1 = "10.12.0.0/24"
$GWSubPrefix1 = "10.12.255.0/27"
$VNet1ASN = 65010
$DNS1 = "8.8.8.8"
$GWName1 = "VNet1GW"
$GW1IPName1 = "VNet1GWIP1"
$GW1IPName2 = "VNet1GWIP2"
$GW1IPconf1 = "gw1ipconf1"
$GW1IPconf2 = "gw1ipconf2"
$Connection12 = "VNet1toVNet2"
$Connection151 = "VNet1toSite5_1"
$Connection152 = "VNet1toSite5_2"

2.创建新的资源组2. Create a new resource group

使用以下示例创建新资源组:Use the example below to create a new resource group:

New-AzResourceGroup -Name $RG1 -Location $Location1

3.创建 TestVNet13. Create TestVNet1

以下示例创建一个名为 TestVNet1 的虚拟网络和三个子网:一个名为 GatewaySubnet、一个名为 FrontEnd,还有一个名为 Backend。The sample below creates a virtual network named TestVNet1 and three subnets, one called GatewaySubnet, one called FrontEnd, and one called Backend. 替换值时,请务必始终将网关子网特意命名为 GatewaySubnet。When substituting values, it's important that you always name your gateway subnet specifically GatewaySubnet. 如果命名为其他名称,网关创建会失败。If you name it something else, your gateway creation fails.

$fesub1 = New-AzVirtualNetworkSubnetConfig -Name $FESubName1 -AddressPrefix $FESubPrefix1
$besub1 = New-AzVirtualNetworkSubnetConfig -Name $BESubName1 -AddressPrefix $BESubPrefix1
$gwsub1 = New-AzVirtualNetworkSubnetConfig -Name $GWSubName1 -AddressPrefix $GWSubPrefix1

New-AzVirtualNetwork -Name $VNetName1 -ResourceGroupName $RG1 -Location $Location1 -AddressPrefix $VNetPrefix11,$VNetPrefix12 -Subnet $fesub1,$besub1,$gwsub1

步骤 2 - 使用主动-主动模式创建 TestVNet1 的 VPN 网关Step 2 - Create the VPN gateway for TestVNet1 with active-active mode

1.创建公共 IP 地址和网关 IP 配置1. Create the public IP addresses and gateway IP configurations

请求两个公共 IP 地址,分配给要为 VNet 创建的网关。Request two public IP addresses to be allocated to the gateway you will create for your VNet. 你还要定义所需的子网和 IP 配置。You'll also define the subnet and IP configurations required.

$gw1pip1 = New-AzPublicIpAddress -Name $GW1IPName1 -ResourceGroupName $RG1 -Location $Location1 -AllocationMethod Dynamic
$gw1pip2 = New-AzPublicIpAddress -Name $GW1IPName2 -ResourceGroupName $RG1 -Location $Location1 -AllocationMethod Dynamic

$vnet1 = Get-AzVirtualNetwork -Name $VNetName1 -ResourceGroupName $RG1
$subnet1 = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet1
$gw1ipconf1 = New-AzVirtualNetworkGatewayIpConfig -Name $GW1IPconf1 -Subnet $subnet1 -PublicIpAddress $gw1pip1
$gw1ipconf2 = New-AzVirtualNetworkGatewayIpConfig -Name $GW1IPconf2 -Subnet $subnet1 -PublicIpAddress $gw1pip2

2.使用主动-主动配置创建 VPN 网关2. Create the VPN gateway with active-active configuration

为 TestVNet1 创建虚拟网络网关。Create the virtual network gateway for TestVNet1. 请注意有两个 GatewayIpConfig 条目,并且已设置 EnableActiveActiveFeature 标志。Note that there are two GatewayIpConfig entries, and the EnableActiveActiveFeature flag is set. 创建网关可能需要花费一段时间(45 分钟或更久才能完成)。Creating a gateway can take a while (45 minutes or more to complete).

New-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1 -Location $Location1 -IpConfigurations $gw1ipconf1,$gw1ipconf2 -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -Asn $VNet1ASN -EnableActiveActiveFeature -Debug

3.获取网关公共 IP 地址和 BGP 对等 IP 地址3. Obtain the gateway public IP addresses and the BGP Peer IP address

创建网关后,需要在 Azure VPN 网关上获取 BGP 对等节点 IP 地址。Once the gateway is created, you will need to obtain the BGP Peer IP address on the Azure VPN Gateway. 需要此地址才能将 Azure VPN 网关配置为本地 VPN 设备的 BGP 对等节点。This address is needed to configure the Azure VPN Gateway as a BGP Peer for your on-premises VPN devices.

$gw1pip1 = Get-AzPublicIpAddress -Name $GW1IPName1 -ResourceGroupName $RG1
$gw1pip2 = Get-AzPublicIpAddress -Name $GW1IPName2 -ResourceGroupName $RG1
$vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1

使用以下 cmdlet 显示针对 VPN 网关分配的两个公共 IP 地址,以及每个网关实例的对应 BGP 对等 IP 地址:Use the following cmdlets to show the two public IP addresses allocated for your VPN gateway, and their corresponding BGP Peer IP addresses for each gateway instance:

PS D:\> $gw1pip1.IpAddress
40.112.190.5

PS D:\> $gw1pip2.IpAddress
138.91.156.129

PS D:\> $vnet1gw.BgpSettingsText
{
  "Asn": 65010,
  "BgpPeeringAddress": "10.12.255.4,10.12.255.5",
  "PeerWeight": 0
}

网关实例的公共 IP 地址顺序与对应的 BGP 对等连接地址相同。The order of the public IP addresses for the gateway instances and the corresponding BGP Peering Addresses are the same. 在本示例中,公共 IP 为 40.112.190.5 的网关 VM 使用 10.12.255.4 作为其 BGP 对等连接地址,公共 IP 为 138.91.156.129 的网关使用 10.12.255.5。In this example, the gateway VM with public IP of 40.112.190.5 will use 10.12.255.4 as its BGP Peering Address, and the gateway with 138.91.156.129 will use 10.12.255.5. 设置连接到主动-主动网关的本地 VPN 设备时需要此信息。This information is needed when you set up your on premises VPN devices connecting to the active-active gateway. 下图显示了网关和所有地址:The gateway is shown in the diagram below with all addresses:

主动-主动网关

创建网关后,可以使用此网关创建主动-主动跨界连接或 VNet 到 VNet 连接。Once the gateway is created, you can use this gateway to establish active-active cross-premises or VNet-to-VNet connection. 以下各节介绍完成该练习所需的步骤。The following sections walk through the steps to complete the exercise.

第 2 部分 - 建立主动-主动跨界连接Part 2 - Establish an active-active cross-premises connection

要建立跨界连接,你需要创建本地网关来表示本地 VPN 设备,并创建连接将 Azure VPN 网关与本地网关连接在一起。To establish a cross-premises connection, you need to create a Local Network Gateway to represent your on-premises VPN device, and a Connection to connect the Azure VPN gateway with the local network gateway. 在本示例中,Azure VPN 网关处于主动-主动模式。In this example, the Azure VPN gateway is in active-active mode. 因此,即使只有一个本地 VPN 设备(本地网关)和一个连接资源,两个 Azure VPN 网关实例也都与该本地设备建立 S2S VPN 隧道。As a result, even though there is only one on-premises VPN device (local network gateway) and one connection resource, both Azure VPN gateway instances will establish S2S VPN tunnels with the on-premises device.

在继续下一步之前,请确保已完成本练习的 第 1 部分Before proceeding, please make sure you have completed Part 1 of this exercise.

步骤 1 - 创建和配置本地网关Step 1 - Create and configure the local network gateway

1.声明变量1. Declare your variables

此练习将继续生成图中所示的配置。This exercise will continue to build the configuration shown in the diagram. 请务必将值替换为要用于配置的值。Be sure to replace the values with the ones that you want to use for your configuration.

$RG5 = "TestAARG5"
$Location5 = "China North"
$LNGName51 = "Site5_1"
$LNGPrefix51 = "10.52.255.253/32"
$LNGIP51 = "131.107.72.22"
$LNGASN5 = 65050
$BGPPeerIP51 = "10.52.255.253"

关于本地网关参数,有几个事项需要注意:A couple of things to note regarding the local network gateway parameters:

  • 本地网关可以与 VPN 网关在相同或不同的位置和资源组中。The local network gateway can be in the same or different location and resource group as the VPN gateway. 本示例显示它们位于不同的资源组,但位于相同的 Azure 位置。This example shows them in different resource groups but in the same Azure location.
  • 如果只有一个本地 VPN 设备(如上所示),则不管是否使用 BGP 协议,主动-主动连接都可正常工作。If there is only one on-premises VPN device as shown above, the active-active connection can work with or without BGP protocol. 本示例对跨界连接使用 BGP。This example uses BGP for the cross-premises connection.
  • 如果 BGP 已启用,需要为本地网关声明的最小前缀是 VPN 设备上的 BGP 对等节点 IP 地址中的主机地址。If BGP is enabled, the prefix you need to declare for the local network gateway is the host address of your BGP Peer IP address on your VPN device. 在此示例中,它是“10.52.255.253/32”中的 /32 前缀。In this case, it's a /32 prefix of "10.52.255.253/32".
  • 提醒一下,在本地网络与 Azure VNet 之间必须使用不同的 BGP ASN。As a reminder, you must use different BGP ASNs between your on-premises networks and Azure VNet. 如果它们是相同的,则需要更改 VNet ASN(如果本地 VPN 设备已使用该 ASN 与其他 BGP 邻居对等)。If they are the same, you need to change your VNet ASN if your on-premises VPN device already uses the ASN to peer with other BGP neighbors.

2.为 Site5 创建本地网关2. Create the local network gateway for Site5

继续操作之前,请确保仍与订阅 1 保持连接。Before you continue, please make sure you are still connected to Subscription 1. 创建资源组(如果尚未创建)。Create the resource group if it is not yet created.

New-AzResourceGroup -Name $RG5 -Location $Location5
New-AzLocalNetworkGateway -Name $LNGName51 -ResourceGroupName $RG5 -Location $Location5 -GatewayIpAddress $LNGIP51 -AddressPrefix $LNGPrefix51 -Asn $LNGASN5 -BgpPeeringAddress $BGPPeerIP51

步骤 2 - 连接 VPN 网关和本地网关Step 2 - Connect the VPN gateway and local network gateway

1.获取这两个网关1. Get the two gateways

$vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1  -ResourceGroupName $RG1
$lng5gw1 = Get-AzLocalNetworkGateway  -Name $LNGName51 -ResourceGroupName $RG5

2.创建 TestVNet1 到 Site5 的连接2. Create the TestVNet1 to Site5 connection

在本步骤中,创建从 TestVNet1 到 Site5_1 的连接,其“EnableBGP”设置为 $True。In this step, you create the connection from TestVNet1 to Site5_1 with "EnableBGP" set to $True.

New-AzVirtualNetworkGatewayConnection -Name $Connection151 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng5gw1 -Location $Location1 -ConnectionType IPsec -SharedKey 'AzureA1b2C3' -EnableBGP $True

3.本地 VPN 设备的 VPN 和 BGP 参数3. VPN and BGP parameters for your on-premises VPN device

下面的示例列出了可在本地 VPN 设备上的 BGP 配置节中为此练习输入的参数:The example below lists the parameters you will enter into the BGP configuration section on your on-premises VPN device for this exercise:

- Site5 ASN            : 65050
- Site5 BGP IP         : 10.52.255.253
- Prefixes to announce : (for example) 10.51.0.0/16 and 10.52.0.0/16
- Azure VNet ASN       : 65010
- Azure VNet BGP IP 1  : 10.12.255.4 for tunnel to 40.112.190.5
- Azure VNet BGP IP 2  : 10.12.255.5 for tunnel to 138.91.156.129
- Static routes        : Destination 10.12.255.4/32, nexthop the VPN tunnel interface to 40.112.190.5
                         Destination 10.12.255.5/32, nexthop the VPN tunnel interface to 138.91.156.129
- eBGP Multihop        : Ensure the "multihop" option for eBGP is enabled on your device if needed

连接应在几分钟后建立,BGP 对等会话会在建立 IPsec 连接后启动。The connection should be established after a few minutes, and the BGP peering session will start once the IPsec connection is established. 本示例到目前为止只配置了一个本地 VPN 设备,如下图所示:This example so far has configured only one on-premises VPN device, resulting in the diagram shown below:

active-active-crossprem

步骤 3 - 将两个本地 VPN 设备连接到主动-主动 VPN 网关Step 3 - Connect two on-premises VPN devices to the active-active VPN gateway

如果同一个本地网络上有两个 VPN 设备,可以通过将 Azure VPN 网关连接到第二个 VPN 设备来实现双重冗余。If you have two VPN devices at the same on-premises network, you can achieve dual redundancy by connecting the Azure VPN gateway to the second VPN device.

1.为 Site5 创建第二个本地网关1. Create the second local network gateway for Site5

第二个本地网络网关的网关 IP地址、地址前缀和 BGP 对等连接地址不能与同一个本地网络的前一个本地网络网关重叠。The gateway IP address, address prefix, and BGP peering address for the second local network gateway must not overlap with the previous local network gateway for the same on-premises network.

$LNGName52 = "Site5_2"
$LNGPrefix52 = "10.52.255.254/32"
$LNGIP52 = "131.107.72.23"
$BGPPeerIP52 = "10.52.255.254"
New-AzLocalNetworkGateway -Name $LNGName52 -ResourceGroupName $RG5 -Location $Location5 -GatewayIpAddress $LNGIP52 -AddressPrefix $LNGPrefix52 -Asn $LNGASN5 -BgpPeeringAddress $BGPPeerIP52

2.连接 VPN 网关与第二个本地网关2. Connect the VPN gateway and the second local network gateway

创建从 TestVNet1 到 Site5_2 的连接,其“EnableBGP”设置为 $TrueCreate the connection from TestVNet1 to Site5_2 with "EnableBGP" set to $True

$lng5gw2 = Get-AzLocalNetworkGateway -Name $LNGName52 -ResourceGroupName $RG5
New-AzVirtualNetworkGatewayConnection -Name $Connection152 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng5gw2 -Location $Location1 -ConnectionType IPsec -SharedKey 'AzureA1b2C3' -EnableBGP $True

3.第二个本地 VPN 设备的 VPN 和 BGP 参数3. VPN and BGP parameters for your second on-premises VPN device

下面列出了要输入到第二个 VPN 设备的参数:Similarly, below lists the parameters you will enter into the second VPN device:

- Site5 ASN            : 65050
- Site5 BGP IP         : 10.52.255.254
- Prefixes to announce : (for example) 10.51.0.0/16 and 10.52.0.0/16
- Azure VNet ASN       : 65010
- Azure VNet BGP IP 1  : 10.12.255.4 for tunnel to 40.112.190.5
- Azure VNet BGP IP 2  : 10.12.255.5 for tunnel to 138.91.156.129
- Static routes        : Destination 10.12.255.4/32, nexthop the VPN tunnel interface to 40.112.190.5
                         Destination 10.12.255.5/32, nexthop the VPN tunnel interface to 138.91.156.129
- eBGP Multihop        : Ensure the "multihop" option for eBGP is enabled on your device if needed

建立连接(隧道)后,便已获得了连接到本地网络和 Azure 的双重冗余 VPN 设备和隧道:Once the connection (tunnels) are established, you will have dual redundant VPN devices and tunnels connecting your on-premises network and Azure:

dual-redundancy-crossprem

第 3 部分 - 建立主动-主动 VNet 到 VNet 连接Part 3 - Establish an active-active VNet-to-VNet connection

本部分使用 BGP 创建主动-主动 VNet 到 VNet 连接。This section creates an active-active VNet-to-VNet connection with BGP.

下面的说明延续上面所列的前述步骤。The instructions below continue from the previous steps listed above. 必须完成 第 1 部分 ,使用 BGP 创建和配置 TestVNet1 与 VPN 网关。You must complete Part 1 to create and configure TestVNet1 and the VPN Gateway with BGP.

步骤 1 - 创建 TestVNet2 和 VPN 网关Step 1 - Create TestVNet2 and the VPN gateway

必须确保新虚拟网络的 IP 地址空间 TestVNet2 不与任何 VNet 范围重叠。It is important to make sure that the IP address space of the new virtual network, TestVNet2, does not overlap with any of your VNet ranges.

1.声明变量1. Declare your variables

请务必将值替换为要用于配置的值。Be sure to replace the values with the ones that you want to use for your configuration.

$RG2 = "TestAARG2"
$Location2 = "China North"
$VNetName2 = "TestVNet2"
$FESubName2 = "FrontEnd"
$BESubName2 = "Backend"
$GWSubName2 = "GatewaySubnet"
$VNetPrefix21 = "10.21.0.0/16"
$VNetPrefix22 = "10.22.0.0/16"
$FESubPrefix2 = "10.21.0.0/24"
$BESubPrefix2 = "10.22.0.0/24"
$GWSubPrefix2 = "10.22.255.0/27"
$VNet2ASN = 65020
$DNS2 = "8.8.8.8"
$GWName2 = "VNet2GW"
$GW2IPName1 = "VNet2GWIP1"
$GW2IPconf1 = "gw2ipconf1"
$GW2IPName2 = "VNet2GWIP2"
$GW2IPconf2 = "gw2ipconf2"
$Connection21 = "VNet2toVNet1"
$Connection12 = "VNet1toVNet2"

2.在新资源组中创建 TestVNet22. Create TestVNet2 in the new resource group

New-AzResourceGroup -Name $RG2 -Location $Location2

$fesub2 = New-AzVirtualNetworkSubnetConfig -Name $FESubName2 -AddressPrefix $FESubPrefix2
$besub2 = New-AzVirtualNetworkSubnetConfig -Name $BESubName2 -AddressPrefix $BESubPrefix2
$gwsub2 = New-AzVirtualNetworkSubnetConfig -Name $GWSubName2 -AddressPrefix $GWSubPrefix2

New-AzVirtualNetwork -Name $VNetName2 -ResourceGroupName $RG2 -Location $Location2 -AddressPrefix $VNetPrefix21,$VNetPrefix22 -Subnet $fesub2,$besub2,$gwsub2

3.创建 TestVNet2 的主动-主动 VPN 网关3. Create the active-active VPN gateway for TestVNet2

请求两个公共 IP 地址,分配给要为 VNet 创建的网关。Request two public IP addresses to be allocated to the gateway you will create for your VNet. 你还要定义所需的子网和 IP 配置。You'll also define the subnet and IP configurations required.

$gw2pip1 = New-AzPublicIpAddress -Name $GW2IPName1 -ResourceGroupName $RG2 -Location $Location2 -AllocationMethod Dynamic
$gw2pip2 = New-AzPublicIpAddress -Name $GW2IPName2 -ResourceGroupName $RG2 -Location $Location2 -AllocationMethod Dynamic

$vnet2 = Get-AzVirtualNetwork -Name $VNetName2 -ResourceGroupName $RG2
$subnet2 = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet2
$gw2ipconf1 = New-AzVirtualNetworkGatewayIpConfig -Name $GW2IPconf1 -Subnet $subnet2 -PublicIpAddress $gw2pip1
$gw2ipconf2 = New-AzVirtualNetworkGatewayIpConfig -Name $GW2IPconf2 -Subnet $subnet2 -PublicIpAddress $gw2pip2

使用 AS 编号和“EnableActiveActiveFeature”标志创建 VPN 网关。Create the VPN gateway with the AS number and the "EnableActiveActiveFeature" flag. 请注意,必须覆盖 Azure VPN 网关上的默认 ASN。Note that you must override the default ASN on your Azure VPN gateways. 连接的 VNet 的 ASN 必须不同,才能启用 BGP 和传输路由。The ASNs for the connected VNets must be different to enable BGP and transit routing.

New-AzVirtualNetworkGateway -Name $GWName2 -ResourceGroupName $RG2 -Location $Location2 -IpConfigurations $gw2ipconf1,$gw2ipconf2 -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -Asn $VNet2ASN -EnableActiveActiveFeature

步骤 2 - 连接 TestVNet1 和 TestVNet2 网关Step 2 - Connect the TestVNet1 and TestVNet2 gateways

在此示例中,这两个网关位于同一订阅中。In this example, both gateways are in the same subscription. 可以在同一 PowerShell 会话中完成此步骤。You can complete this step in the same PowerShell session.

1.获取这两个网关1. Get both gateways

请确保登录并连接到订阅 1。Make sure you log in and connect to Subscription 1.

$vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1
$vnet2gw = Get-AzVirtualNetworkGateway -Name $GWName2 -ResourceGroupName $RG2

2.创建两个连接2. Create both connections

此步骤创建从 TestVNet1 到 TestVNet2 的连接,以及从 TestVNet2 到 TestVNet1 的连接。In this step, you will create the connection from TestVNet1 to TestVNet2, and the connection from TestVNet2 to TestVNet1.

New-AzVirtualNetworkGatewayConnection -Name $Connection12 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -VirtualNetworkGateway2 $vnet2gw -Location $Location1 -ConnectionType Vnet2Vnet -SharedKey 'AzureA1b2C3' -EnableBgp $True

New-AzVirtualNetworkGatewayConnection -Name $Connection21 -ResourceGroupName $RG2 -VirtualNetworkGateway1 $vnet2gw -VirtualNetworkGateway2 $vnet1gw -Location $Location2 -ConnectionType Vnet2Vnet -SharedKey 'AzureA1b2C3' -EnableBgp $True

重要

请确保为这两个连接启用 BGP。Be sure to enable BGP for BOTH connections.

完成这些步骤后,连接会在几分钟内建立,完成具有双重冗余的 VNet 到 VNet 连接后,BGP 对等会话就会启动:After completing these steps, the connection will be establish in a few minutes, and the BGP peering session will be up once the VNet-to-VNet connection is completed with dual redundancy:

active-active-v2v

更新现有 VPN 网关Update an existing VPN gateway

将主动-待机网关更改为主动-主动网关时,也将创建另一个公共 IP 地址,然后添加第二个网关 IP 配置。When you change an active-standby gateway to active-active, you create another public IP address, then add a second Gateway IP configuration. 此部分有助于使用 PowerShell 将现有 Azure VPN 网关从主动-待机模式更改为主动-主动模式,或反之。This section helps you change an existing Azure VPN gateway from active-standby to active-active mode, or vice versa using PowerShell. 还可以在 Azure 门户的“配置”页上为虚拟网络网关更改网关。You can also change a gateway in the Azure portal on the Configuration page for your virtual network gateway.

将主动-待机网关更改为主动-主动网关Change an active-standby gateway to an active-active gateway

以下示例将主动-待机网关转换为主动-主动网关。The following example converts an active-standby gateway into an active-active gateway.

1.声明变量1. Declare your variables

将以下用于示例的参数替换为个人配置所需的设置,然后声明这些变量。Replace the following parameters used for the examples with the settings that you require for your own configuration, then declare these variables.

$GWName = "TestVNetAA1GW"
$VNetName = "TestVNetAA1"
$RG = "TestVPNActiveActive01"
$GWIPName2 = "gwpip2"
$GWIPconf2 = "gw1ipconf2"

在声明变量后,可以将此示例复制粘贴到 PowerShell 控制台。After declaring the variables, you can copy and paste this example to your PowerShell console.

$vnet = Get-AzVirtualNetwork -Name $VNetName -ResourceGroupName $RG
$subnet = Get-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -VirtualNetwork $vnet
$gw = Get-AzVirtualNetworkGateway -Name $GWName -ResourceGroupName $RG
$location = $gw.Location

2.创建公共 IP 地址,并添加第二个网关 IP 配置2. Create the public IP address, then add the second gateway IP configuration

$gwpip2 = New-AzPublicIpAddress -Name $GWIPName2 -ResourceGroupName $RG -Location $location -AllocationMethod Dynamic
Add-AzVirtualNetworkGatewayIpConfig -VirtualNetworkGateway $gw -Name $GWIPconf2 -Subnet $subnet -PublicIpAddress $gwpip2

3.启用主动-主动模式并更新网关3. Enable active-active mode and update the gateway

在此步骤中,启用主动-主动模式并更新网关。In this step, you enable active-active mode and update the gateway. 在此示例中,VPN 网关当前正在使用旧的标准 SKU。In the example, the VPN gateway is currently using a legacy Standard SKU. 但是,主动-主动模式不支持此标准 SKU。However, active-active does not support the Standard SKU. 若要将旧的 SKU 调整为受支持的版本(在此情况下,为 HighPerformance),只需指定要使用的受支持旧 SKU。To resize the legacy SKU to one that is supported (in this case, HighPerformance), you simply specify the supported legacy SKU that you want to use.

  • 使用此步骤无法将旧的 SKU 更改为新的 SKU。You can't change a legacy SKU to one of the new SKUs using this step. 只能将旧的 SKU 调整为另一个受支持的旧 SKU。You can only resize a legacy SKU to another supported legacy SKU. 例如,无法将 SKU 从标准更改为 VpnGw1(即使主动-主动支持 VpnGw1 ),因为标准是旧的 SKU,而 VpnGw1 是当前的 SKU。For example, you can't change the SKU from Standard to VpnGw1 (even though VpnGw1 is supported for active-active) because Standard is a legacy SKU and VpnGw1 is a current SKU. 有关调整和迁移 SKU 的详细信息,请参阅网关 SKUFor more information about resizing and migrating SKUs, see Gateway SKUs.

  • 如果想要调整当前 SKU 的大小,例如将 VpnGw1 调整为 VpnGw3,可以使用此步骤,因为这些 SKU 都属于相同的 SKU 系列。If you want to resize a current SKU, for example VpnGw1 to VpnGw3, you can do so using this step because the SKUs are in the same SKU family. 为此,可以使用此值:-GatewaySku VpnGw3To do so, you would use the value: -GatewaySku VpnGw3

在你的环境中使用时,如果不需要调整网关大小,也就不需要指定 -GatewaySku。When you are using this in your environment, if you don't need to resize the gateway, you won't need to specify the -GatewaySku. 请注意在此步骤中,必须在 PowerShell 中设置网关对象以触发实际更新。Notice that in this step, you must set the gateway object in PowerShell to trigger the actual update. 即使不调整网关,此更新也可能需要花费 30 到 45 分钟。This update can take 30 to 45 minutes, even if you are not resizing your gateway.

Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -EnableActiveActiveFeature -GatewaySku HighPerformance

将主动-主动网关更改为主动-待机网关Change an active-active gateway to an active-standby gateway

1.声明变量1. Declare your variables

将以下用于示例的参数替换为个人配置所需的设置,然后声明这些变量。Replace the following parameters used for the examples with the settings that you require for your own configuration, then declare these variables.

$GWName = "TestVNetAA1GW"
$RG = "TestVPNActiveActive01"

声明变量后,获取要删除的 IP 配置的名称。After declaring the variables, get the name of the IP configuration you want to remove.

$gw = Get-AzVirtualNetworkGateway -Name $GWName -ResourceGroupName $RG
$ipconfname = $gw.IpConfigurations[1].Name

2.删除网关 IP 配置并禁用主动-主动模式2. Remove the gateway IP configuration and disable the active-active mode

使用此示例删除网关 IP 配置并禁用主动-主动模式。Use this example to remove the gateway IP configuration and disable active-active mode. 请注意,必须在 PowerShell 中设置网关对象以触发实际更新。Notice that you must set the gateway object in PowerShell to trigger the actual update.

Remove-AzVirtualNetworkGatewayIpConfig -Name $ipconfname -VirtualNetworkGateway $gw
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -DisableActiveActiveFeature

这种更新最多可能需要 30 到 45 分钟。This update can take up to 30 to 45 minutes.

后续步骤Next steps

连接完成后,即可将虚拟机添加到虚拟网络。Once your connection is complete, you can add virtual machines to your virtual networks. 请参阅 创建虚拟机 以获取相关步骤。See Create a Virtual Machine for steps.