您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

关于 ExpressRoute 虚拟网络网关About ExpressRoute virtual network gateways

若要通过 ExpressRoute 连接 Azure 虚拟网络和本地网络,必须先创建虚拟网络网关。To connect your Azure virtual network and your on-premises network via ExpressRoute, you must create a virtual network gateway first. 虚拟网络网关有两个用途: exchange IP 路由网络之间的路由和路由网络流量。A virtual network gateway serves two purposes: exchange IP routes between the networks and route network traffic. 本文介绍了各 SKU 的网关类型、网关 Sku 和估计性能。This article explains gateway types, gateway SKUs, and estimated performance by SKU. 本文还介绍了 ExpressRoute FastPath,这是一项功能,可让你的本地网络中的网络流量绕过虚拟网络网关,从而提高性能。This article also explains ExpressRoute FastPath, a feature that enables the network traffic from your on-premises network to bypass the virtual network gateway to improve performance.

网关类型Gateway types

创建虚拟网络网关时,需要指定几项设置。When you create a virtual network gateway, you need to specify several settings. 其中一个必要设置“-GatewayType”指定是否将网关用于 ExpressRoute 或 VPN 流量。One of the required settings, '-GatewayType', specifies whether the gateway is used for ExpressRoute, or VPN traffic. 两种网关类型是:The two gateway types are:

  • Vpn - 若要通过公共 Internet 发送加密流量,请使用网关类型“Vpn”。Vpn - To send encrypted traffic across the public Internet, you use the gateway type 'Vpn'. 这也称为 VPN 网关。This is also referred to as a VPN gateway. 站点到站点连接、点到站点连接和 VNet 到 VNet 连接都使用 VPN 网关。Site-to-Site, Point-to-Site, and VNet-to-VNet connections all use a VPN gateway.

  • ExpressRoute - 若要在专用连接上发送网络流量,请使用网关类型“ExpressRoute”。ExpressRoute - To send network traffic on a private connection, you use the gateway type 'ExpressRoute'. 这也称为 ExpressRoute 网关,是配置 ExpressRoute 时使用的网关类型。This is also referred to as an ExpressRoute gateway and is the type of gateway used when configuring ExpressRoute.

对于每种网关类型,每个虚拟网络只能有一个虚拟网络网关。Each virtual network can have only one virtual network gateway per gateway type. 例如,一个虚拟网络网关使用 -GatewayType Vpn,另一个使用 -GatewayType ExpressRoute。For example, you can have one virtual network gateway that uses -GatewayType Vpn, and one that uses -GatewayType ExpressRoute.

网关 SKUGateway SKUs

创建虚拟网络网关时,需要指定要使用的网关 SKU。When you create a virtual network gateway, you need to specify the gateway SKU that you want to use. 如果选择更高级的网关 SKU,则将为该网关分配更多的 CPU 和网络带宽,这样使网关能够支持到虚拟网络更高的吞吐量。When you select a higher gateway SKU, more CPUs and network bandwidth are allocated to the gateway, and as a result, the gateway can support higher network throughput to the virtual network.

ExpressRoute 虚拟网络网关可使用以下 SKU:ExpressRoute virtual network gateways can use the following SKUs:

  • 标准Standard
  • HighPerformanceHighPerformance
  • UltraPerformanceUltraPerformance

如果要将网关升级为功能更强大的网关 SKU,在大多数情况下,可以使用 "AzVirtualNetworkGateway" PowerShell cmdlet。If you want to upgrade your gateway to a more powerful gateway SKU, in most cases you can use the 'Resize-AzVirtualNetworkGateway' PowerShell cmdlet. 此方法适用于升级到 Standard 和 HighPerformance SKU。This will work for upgrades to Standard and HighPerformance SKUs. 但是,若要升级到 UltraPerformance SKU,需要重新创建网关。However, to upgrade to the UltraPerformance SKU, you will need to recreate the gateway. 重新创建网关会导致停机。Recreating a gateway incurs downtime.

预估性能(按网关 SKU)Estimated performances by gateway SKU

下表显示网关类型和估计性能。The following table shows the gateway types and the estimated performances. 此表适用于 Resource Manager 与经典部署模型。This table applies to both the Resource Manager and classic deployment models.

每秒兆位Megabits per second 每秒的数据包数Packets per second 每秒连接数Connections per second VPN 网关和 ExpressRoute 共存VPN Gateway and ExpressRoute coexist FastPathFastPath
基本 SKU(已弃用)Basic SKU (deprecated) 500500 未知Unknown 未知Unknown NoNo NoNo
标准 SKU/ErGw1AZStandard SKU/ErGw1AZ 1,0001,000 100,000100,000 7,0007,000 Yes NoNo
高性能 SKU/ErGw2AZHigh Performance SKU/ErGw2AZ 2,0002,000 250,000250,000 14,00014,000 Yes NoNo
超高性能 SKU/ErGw3AZUltra Performance SKU/ErGw3AZ 10,00010,000 1,000,0001,000,000 28,00028,000 Yes Yes

重要

应用程序性能取决于多种因素,例如端到端延迟和应用程序打开的流量数。Application performance depends on multiple factors, such as the end-to-end latency, and the number of traffic flows the application opens. 表中的数字表示应用程序在理想环境下理论上可达到的上限。The numbers in the table represent the upper limit that the application can theoretically achieve in an ideal environment.

网关子网Gateway subnet

创建 ExpressRoute 网关之前,必须先创建网关子网。Before you create an ExpressRoute gateway, you must create a gateway subnet. 网关子网包含虚拟网络网关 VM 和服务使用的 IP 地址。The gateway subnet contains the IP addresses that the virtual network gateway VMs and services use. 创建虚拟网络网关时,会将网关 Vm 部署到网关子网,并配置所需的 ExpressRoute 网关设置。When you create your virtual network gateway, gateway VMs are deployed to the gateway subnet and configured with the required ExpressRoute gateway settings. 不要将任何其他内容(例如,其他 Vm)部署到网关子网。Never deploy anything else (for example, additional VMs) to the gateway subnet. 网关子网必须命名为“GatewaySubnet”才能正常工作。The gateway subnet must be named 'GatewaySubnet' to work properly. 将网关子网命名为“GatewaySubnet”,可以让 Azure 知道这就是要将虚拟网络网关 VM 和服务部署到的目标子网。Naming the gateway subnet 'GatewaySubnet' lets Azure know that this is the subnet to deploy the virtual network gateway VMs and services to.

备注

不支持在 GatewaySubnet 上使用 0.0.0.0/0 Destination 和 nsg 的用户定义路由。User defined routes with a 0.0.0.0/0 destination and NSGs on the GatewaySubnet are not supported. 将阻止创建通过此配置创建的网关。Gateways created with this configuration will be blocked from creation. 网关需要访问管理控制器才能正常工作。Gateways require access to the management controllers in order to function properly.

创建网关子网时,请指定子网包含的 IP 地址数。When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. 将网关子网中的 IP 地址分配到网关 VM 和网关服务。The IP addresses in the gateway subnet are allocated to the gateway VMs and gateway services. 有些配置需要具有比其他配置更多的 IP 地址。Some configurations require more IP addresses than others.

规划网关子网大小时,请参阅你计划创建的配置的相关文档。When you are planning your gateway subnet size, refer to the documentation for the configuration that you are planning to create. 例如,ExpressRoute/VPN 网关共存配置所需的网关子网比大多数其他配置要大。For example, the ExpressRoute/VPN Gateway coexist configuration requires a larger gateway subnet than most other configurations. 此外,可能需要确保网关子网包含足够多的 IP 地址,以便应对将来可能会添加的配置。Additionally, you may want to make sure your gateway subnet contains enough IP addresses to accommodate possible future additional configurations. 虽然你可以创建小到/29 的网关子网,但如果你有可用的地址空间,则建议你创建/27 或更大(/27、/26 等)的网关子网。While you can create a gateway subnet as small as /29, we recommend that you create a gateway subnet of /27 or larger (/27, /26 etc.) if you have the available address space to do so. 这将适合大多数配置。This will accommodate most configurations.

以下 Resource Manager PowerShell 示例显示名为 GatewaySubnet 的网关子网。The following Resource Manager PowerShell example shows a gateway subnet named GatewaySubnet. 可以看到,CIDR 表示法指定了 /27,这可提供足够的 IP 地址供大多数现有配置使用。You can see the CIDR notation specifies a /27, which allows for enough IP addresses for most configurations that currently exist.

Add-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -AddressPrefix 10.0.3.0/27

重要

使用网关子网时,避免将网络安全组 (NSG) 与网关子网关联。When working with gateway subnets, avoid associating a network security group (NSG) to the gateway subnet. 将网络安全组关联到此子网可能导致虚拟网络网关(VPN、快速路由网关)停止按预期方式工作。Associating a network security group to this subnet may cause your Virtual Network gateway(VPN, Express Route gateway) to stop functioning as expected. 有关网络安全组的详细信息,请参阅什么是网络安全组?For more information about network security groups, see What is a network security group?

区域冗余型网关 SKUZone-redundant gateway SKUs

也可以在 Azure 可用性区域中部署 ExpressRoute 网关。You can also deploy ExpressRoute gateways in Azure Availability Zones. 这在物理上和逻辑上将它们分成不同的可用区域,从而保护本地网络与 Azure 的连接免受区域级故障的影响。This physically and logically separates them into different Availability Zones, protecting your on-premises network connectivity to Azure from zone-level failures.

区域冗余型 ExpressRoute 网关

区域冗余型网关使用 ExpressRoute 网关的特定新网关 SKU。Zone-redundant gateways use specific new gateway SKUs for ExpressRoute gateway.

  • ErGw1AZErGw1AZ
  • ErGw2AZErGw2AZ
  • ErGw3AZErGw3AZ

新的网关 SKU 还支持其他部署选项,以最好地满足你的需求。The new gateway SKUs also support other deployment options to best match your needs. 使用新网关 SKU 创建虚拟网络网关时,还可以选择在特定区域中部署网关。When creating a virtual network gateway using the new gateway SKUs, you also have the option to deploy the gateway in a specific zone. 这称为区域网关。This is referred to as a zonal gateway. 部署区域网关时,网关的所有实例都部署在同一可用性区域中。When you deploy a zonal gateway, all the instances of the gateway are deployed in the same Availability Zone.

FastPathFastPath

ExpressRoute 虚拟网络网关旨在交换网络路由和路由网络流量。ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath 旨在提高本地网络与虚拟网络之间的数据路径性能。FastPath is designed to improve the data path performance between your on-premises network and your virtual network. 启用后,FastPath 会将网络流量直接发送到虚拟网络中的虚拟机,绕过网关。When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

有关 FastPath 的详细信息,包括限制和要求,请参阅关于 FastPathFor more information about FastPath, including limitations and requirements, see About FastPath.

REST API 和 PowerShell cmdletREST APIs and PowerShell cmdlets

有关将 REST API 和 PowerShell cmdlet 用于虚拟网络网关配置的其他技术资源和特定语法要求,请参阅以下页面:For additional technical resources and specific syntax requirements when using REST APIs and PowerShell cmdlets for virtual network gateway configurations, see the following pages:

经典Classic 资源管理器Resource Manager
PowerShellPowerShell PowerShellPowerShell
REST APIREST API REST APIREST API

后续步骤Next steps

有关可用连接配置的详细信息,请参阅ExpressRoute 概述For more information about available connection configurations, see ExpressRoute Overview.

有关创建 ExpressRoute 网关的详细信息,请参阅为ExpressRoute 创建虚拟网络网关For more information about creating ExpressRoute gateways, see Create a virtual network gateway for ExpressRoute.

有关配置区域冗余网关的详细信息,请参阅创建区域冗余虚拟网络网关For more information about configuring zone-redundant gateways, see Create a zone-redundant virtual network gateway.

有关 FastPath 的详细信息,请参阅关于 FastPathFor more information about FastPath, see About FastPath.