下载用于 S2S VPN 连接的 VPN 设备配置脚本Download VPN device configuration scripts for S2S VPN connections

本文逐步讲解如何使用 Azure 资源管理器下载采用 Azure VPN 网关的 S2S VPN 连接的 VPN 设备配置脚本。This article walks you through downloading VPN device configuration scripts for S2S VPN connections with Azure VPN Gateways using Azure Resource Manager. 下图展示了概要工作流。The following diagram shows the high-level workflow.

download-script

以下设备具有可用的脚本:The following devices have available scripts:

供应商Vendor 设备系列Device family 固件版本Firmware version
CiscoCisco ISRISR IOS 15.1(预览版)IOS 15.1 (Preview)
CiscoCisco ASAASA ASA ( * ) RouteBased(IKEv2- 无 BGP),对于低于 9.8 版的 ASAASA ( * ) RouteBased (IKEv2- No BGP) for ASA below 9.8
CiscoCisco ASAASA ASA RouteBased(IKEv2 - 无 BGP),对于 ASA 9.8+ASA RouteBased (IKEv2 - No BGP) for ASA 9.8+
JuniperJuniper SRX_GASRX_GA 12.x12.x
JuniperJuniper SSG_GASSG_GA ScreenOS 6.2.xScreenOS 6.2.x
JuniperJuniper JSeries_GAJSeries_GA JunOS 12.xJunOS 12.x
JuniperJuniper SRXSRX JunOS 12.x RouteBased BGPJunOS 12.x RouteBased BGP
UbiquitiUbiquiti EdgeRouterEdgeRouter EdgeOS v1.10x RouteBased VTIEdgeOS v1.10x RouteBased VTI
UbiquitiUbiquiti EdgeRouterEdgeRouter EdgeOS v1.10x RouteBased BGPEdgeOS v1.10x RouteBased BGP

Note

( * ) 必需:NarrowAzureTrafficSelectors(启用 UsePolicyBasedTrafficSelectors 选项)和 CustomAzurePolicies (IKE/IPsec)( * ) Required: NarrowAzureTrafficSelectors (enable UsePolicyBasedTrafficSelectors option) and CustomAzurePolicies (IKE/IPsec)

关于 VPN 设备配置脚本About VPN device configuration scripts

跨界 VPN 连接包含一个 Azure VPN 网关、一个本地 VPN 设备,以及将两者相连接的 IPsec S2S VPN 隧道。A cross-premises VPN connection consists of an Azure VPN gateway, an on-premises VPN device, and an IPsec S2S VPN tunnel connecting the two. 典型的工作流包括以下步骤:The typical work flow includes the following steps:

  1. 创建并配置 Azure VPN 网关(虚拟网络网关)Create and configure an Azure VPN gateway (virtual network gateway)
  2. 创建并配置代表本地网络和 VPN 设备的 Azure 本地网络网关Create and configure an Azure local network gateway that represents your on-premises network and VPN device
  3. 在 Azure VPN 网关与本地网络网关之间创建并配置 Azure VPN 连接Create and configure an Azure VPN connection between the Azure VPN gateway and the local network gateway
  4. 配置本地网络网关代表的本地 VPN 设备,以便与 Azure VPN 网关建立实际 S2S VPN 隧道Configure the on-premises VPN device represented by the local network gateway to establish the actual S2S VPN tunnel with the Azure VPN gateway

可以使用 Azure 门户PowerShellCLI 完成步骤 1 到 3。You can complete steps 1 through 3 using the Azure portal, PowerShell, or CLI. 最后一个步骤涉及到在 Azure 外部配置本地 VPN 设备。The last step involves configuring the on-premises VPN devices outside of Azure. 使用此功能可下载 VPN 设备的配置脚本,其中已填写 Azure VPN 网关、虚拟网络、本地网络地址前缀和 VPN 连接属性等的相应值。This feature allows you to download a configuration script for your VPN device with the corresponding values of your Azure VPN gateway, virtual network, and on-premises network address prefixes, and VPN connection properties, etc. already filled in. 可以使用此脚本作为起点,或者通过配置控制台将它直接应用到本地 VPN 设备。You can use the script as a starting point, or apply the script directly to your on-premises VPN devices via the configuration console.

Important

  • 每个 VPN 设备配置脚本的语法各不相同,在很大程度上取决于型号和固件版本。The syntax for each VPN device configuration script is different, and heavily dependent on the models and firmware versions. 请特别注意设备型号和版本信息是否与可用的模板相符。Pay special attention to your device model and version information against the available templates.
  • 某些参数值在设备上必须唯一,在不访问设备的情况下无法确定。Some parameter values must be unique on the device, and cannot be determined without accessing the device. Azure 生成的配置脚本会预先填充这些值,但你需要确保提供的值在设备上有效。The Azure-generated configuration scripts pre-fill these values, but you need to ensure the provided values are valid on your device. 例如:For examples:
    • 接口编号Interface numbers
    • 访问控制列表编号Access control list numbers
    • 策略名称或编号,等等。Policy names or numbers, etc.
  • 在应用该脚本之前,请查找脚本中嵌入的关键字“REPLACE”,找到需要验证的参数。Look for the keyword, "REPLACE", embedded in the script to find the parameters you need to verify before applying the script.
  • 某些模板包含“CLEANUP”节,应用此节可以删除配置。Some templates include a "CLEANUP" section you can apply to remove the configurations. cleanup 节默认已注释掉。The cleanup sections are commented out by default.

从 Azure 门户下载配置脚本Download the configuration script from Azure portal

创建 Azure VPN 网关、本地网络网关,以及连接两者的连接资源。Create an Azure VPN gateway, local network gateway, and a connection resource connecting the two. 以下页面将引导你完成每个步骤:The following page guides you through the steps:

创建连接资源后,遵照以下说明下载 VPN 设备配置脚本:Once the connection resource is created, follow the instructions below to download the VPN device configuration scripts:

  1. 在浏览器中导航到 Azure 门户,并根据需要使用 Azure 帐户登录。From a browser, navigate to the Azure portal and, if necessary, sign in with your Azure account

  2. 转到创建的连接资源。Go to the connection resource you created. 依次单击“所有服务”、“网络”和“连接”可以找到所有连接资源的列表。You can find the list of all connection resources by clicking "All services", then "NETWORKING", and "Connections."

    connection-list

  3. 单击要配置的连接。Click on the connection you want to configure.

    connection-overview

  4. 单击“连接概述”页中以红色突出显示的“下载配置”链接,打开“下载配置”页。Click on the "Download configuration" link as highlighted in red in the Connection overview page; this opens the "Download configuration" page.

    download-script-1

  5. 选择 VPN 设备的型号系列和固件版本,然后单击“下载配置”按钮。Select the model family and firmware version for your VPN device, then click on the "Download configuration" button.

    download66-script-2

  6. 浏览器会提示是否保存下载的脚本(文本文件)。You are prompted to save the downloaded script (a text file) from your browser.

  7. 下载配置脚本后,使用文本编辑器将它打开,搜索关键字“REPLACE”来识别并检查可能需要替换的参数。Once you downloaded the configuration script, open it with a text editor and search for the keyword "REPLACE" to identify and examine the parameters that may need to be replaced.

    edit-script

使用 Azure PowerShell 下载配置脚本Download the configuration script using Azure PowerShell

也可以使用 Azure PowerShell 下载配置脚本,如以下示例中所示:You can also download the configuration script using Azure PowerShell, as shown in the following example:

$RG          = "TestRG1"
$GWName      = "VNet1GW"
$Connection  = "VNet1toSite1"

# List the available VPN device models and versions
Get-AzVirtualNetworkGatewaySupportedVpnDevice -Name $GWName -ResourceGroupName $RG

# Download the configuration script for the connection
Get-AzVirtualNetworkGatewayConnectionVpnDeviceConfigScript -Name $Connection -ResourceGroupName $RG -DeviceVendor Juniper -DeviceFamily Juniper_SRX_GA -FirmwareVersion Juniper_SRX_12.x_GA

将配置脚本应用到 VPN 设备Apply the configuration script to your VPN device

下载并验证配置脚本后,下一步是将脚本应用到 VPN 设备。After you have downloaded and validated the configuration script, the next step is to apply the script to your VPN device. 实际过程根据 VPN 设备的品牌和型号而有所不同。The actual procedure varies based on your VPN device makes and models. 请查阅 VPN 设备的操作手册或说明书。Consult the operation manuals or the instruction pages for your VPN devices.

后续步骤Next steps

继续配置站点到站点连接Continue configuring your Site-to-Site connection.