使用脚本部署软件定义的网络基础结构Deploy a Software Defined Network infrastructure using scripts

适用于: Windows Server (半年频道) ,Windows Server 2016 "本主题介绍如何使用脚本部署 Microsoft 软件定义的网络 (SDN) 基础结构。Applies to: Windows Server (Semi-Annual Channel), Windows Server 2016 ' In this topic, you deploy a Microsoft Software Defined Network (SDN) infrastructure using scripts. 该基础结构包括高可用性 (HA) 网络控制器、HA 软件负载平衡器 (SLB) /MUX、虚拟网络和关联的访问控制列表 (Acl) 。The infrastructure includes a highly available (HA) network controller, an HA Software Load Balancer (SLB)/MUX, virtual networks, and associated Access Control Lists (ACLs). 此外,另一个脚本将部署一个租户工作负荷,用于验证 SDN 基础结构。Additionally, another script deploys a tenant workload for you to validate your SDN infrastructure.

如果你希望你的租户工作负荷在其虚拟网络外部进行通信,则可以设置 SLB NAT 规则、站点到站点网关隧道或第3层转发,以在虚拟和物理工作负载之间进行路由。If you want your tenant workloads to communicate outside their virtual networks, you can setup SLB NAT rules, Site-to-Site Gateway tunnels, or Layer-3 Forwarding to route between virtual and physical workloads.

你还可以使用 Virtual Machine Manager (VMM) 部署 SDN 基础结构。You can also deploy an SDN infrastructure using Virtual Machine Manager (VMM). 有关详细信息,请参阅 在 VMM 构造中设置软件定义的网络 (SDN) 基础结构For more information, see Set up a Software Defined Network (SDN) infrastructure in the VMM fabric.

部署前Pre-deployment

重要

开始部署前,必须规划并配置主机和物理网络基础结构。Before you begin deployment, you must plan and configure your hosts and physical network infrastructure. 有关详细信息,请参阅计划软件定义的网络基础结构For more information, see Plan a Software Defined Network Infrastructure.

所有 Hyper-v 主机都必须安装 Windows Server 2016。All Hyper-V hosts must have Windows Server 2016 installed.

部署步骤Deployment steps

首先,将 Hyper-v 主机的 (物理服务器配置) Hyper-v 虚拟交换机和 IP 地址分配。Start by configuring the Hyper-V host's (physical servers) Hyper-V virtual switch and IP address assignment. 可以使用与 Hyper-v 兼容的任何存储类型。Any storage type that is compatible with Hyper-V, shared or local may be used.

安装主机网络Install host networking

  1. 安装适用于 NIC 硬件的最新网络驱动程序。Install the latest network drivers available for your NIC hardware.

  2. 在所有主机上安装 Hyper-v 角色 (有关详细信息,请参阅 Windows Server 2016 上的 hyper-v 入门Install the Hyper-V role on all hosts (For more information, see Get started with Hyper-V on Windows Server 2016.

    Install-WindowsFeature -Name Hyper-V -ComputerName <computer_name> -IncludeManagementTools -Restart
    
  3. 创建 Hyper-v 虚拟交换机。Create the Hyper-V virtual switch.

    对所有主机使用相同的开关名称,例如, sdnSwitchUse the same switch name for all hosts, for example, sdnSwitch. 至少配置一个网络适配器,如果使用 "设置",则至少配置两个网络适配器。Configure at least one network adapter or, if using SET, configure at least two network adapters. 使用两个 Nic 时发生最大入站分配。Maximum inbound spreading occurs when using two NICs.

    New-VMSwitch "<switch name>" -NetAdapterName "<NetAdapter1>" [, "<NetAdapter2>" -EnableEmbeddedTeaming $True] -AllowManagementOS $True
    

    提示

    如果有单独的管理 Nic,则可以跳过步骤4和5。You can skip steps 4 and 5 if you have separate Management NICs.

  4. 请参阅规划主题 (规划软件定义的网络基础结构) 并与网络管理员合作以获取管理 VLAN 的 vlan ID。Refer to the planning topic (Plan a Software Defined Network Infrastructure) and work with your network administrator to obtain the VLAN ID of the Management VLAN. 将新创建的虚拟交换机的管理 vNIC 附加到管理 VLAN。Attach the Management vNIC of the newly created Virtual Switch to the Management VLAN. 如果你的环境不使用 VLAN 标记,则可以省略此步骤。This step can be omitted if your environment does not use VLAN tags.

    Set-VMNetworkAdapterIsolation -ManagementOS -IsolationMode Vlan -DefaultIsolationID <Management VLAN> -AllowUntaggedTraffic $True
    
  5. 请参阅规划主题 (规划软件定义的网络基础结构) ,与网络管理员协作,使用 DHCP 或静态 IP 分配将 IP 地址分配给新创建的 VSwitch 的管理 vNIC。Refer to the planning topic (Plan a Software Defined Network Infrastructure) and work with your network administrator to use either DHCP or static IP assignments to assign an IP address to the Management vNIC of the newly created vSwitch. 下面的示例演示如何创建静态 IP 地址并将其分配给 vSwitch 的 Management vNIC:The following example shows how to create a static IP address and assign it to the Management vNIC of the vSwitch:

    New-NetIPAddress -InterfaceAlias "vEthernet (<switch name>)" -IPAddress <IP> -DefaultGateway <Gateway IP> -AddressFamily IPv4 -PrefixLength <Length of Subnet Mask - for example: 24>
    
  6. 可有可无将虚拟机部署到主机 Active Directory 域服务 (安装 Active Directory 域服务 (级别 100) 和 DNS 服务器。[Optional] Deploy a virtual machine to host Active Directory Domain Services (Install Active Directory Domain Services (Level 100) and a DNS Server.

    a.a. 将 Active Directory/DNS 服务器虚拟机连接到管理 VLAN:Connect the Active Directory/DNS Server virtual machine to the Management VLAN:

    Set-VMNetworkAdapterIsolation -VMName "<VM Name>" -Access -VlanId <Management VLAN> -AllowUntaggedTraffic $True
    

    b.b. 安装 Active Directory 域服务和 DNS。Install Active Directory Domain Services and DNS.

    备注

    网络控制器支持 Kerberos 和 x.509 证书进行身份验证。The network controller supports both Kerberos and X.509 certificates for authentication. 本指南同时使用这两种身份验证机制实现不同目的 (但) 只需要一个身份验证机制。This guide uses both authentication mechanisms for different purposes (although only one is required).

  7. 将所有 Hyper-v 主机加入到域。Join all Hyper-V hosts to the domain. 确保将 IP 地址分配到管理网络的网络适配器的 DNS 服务器条目指向可解析域名的 DNS 服务器。Ensure the DNS server entry for the network adapter that has an IP address assigned to the Management network points to a DNS server that can resolve the domain name.

    Set-DnsClientServerAddress -InterfaceAlias "vEthernet (<switch name>)" -ServerAddresses <DNS Server IP>
    

    a.a. 右键单击 " 开始",单击 " 系统",然后单击 " 更改设置"。Right-click Start, click System, and then click Change Settings. b.b. 单击“更改”****。Click Change. c.c. 单击 " " 并指定域名。Click Domain and specify the domain name. "" "d。"""" d. 单击“确定”。Click OK. e.e. 出现提示时,键入用户名和密码凭据。Type the user name and password credentials when prompted. f.f. 重新启动服务器。Restart the server.

验证Validation

使用以下步骤验证是否正确设置了主机网络。Use the following steps to validate that host networking is setup correctly.

  1. 请确保已成功创建 VM 交换机:Ensure the VM Switch was created successfully:

    Get-VMSwitch "<switch name>"
    
  2. 验证 VM 交换机上的管理 vNIC 是否已连接到管理 VLAN:Verify that the Management vNIC on the VM Switch is connected to the Management VLAN:

    备注

    仅适用于管理和租户通信共享同一 NIC 的情况。Relevant only if Management and Tenant traffic share the same NIC.

    Get-VMNetworkAdapterIsolation -ManagementOS
    
  3. 验证所有 Hyper-v 主机和外部管理资源,例如 DNS 服务器。Validate all Hyper-V hosts and external management resources, for example, DNS servers.

    确保可以使用其管理 IP 地址和/或完全限定的域名 (FQDN) 来访问它们。Ensure they are accessible via ping using their Management IP address and/or fully qualified domain name (FQDN).

    ping <Hyper-V Host IP> ping <Hyper-V Host FQDN>

  4. 在部署主机上运行以下命令,并指定每个 Hyper-v 主机的 FQDN,以确保使用的 Kerberos 凭据提供对所有服务器的访问。Run the following command on the deployment host and specify the FQDN of each Hyper-V host to ensure the Kerberos credentials used provides access to all the servers.

    winrm id -r:<Hyper-V Host FQDN>

运行 SDN Express 脚本Run SDN Express scripts

  1. 请参阅 MICROSOFT SDN GitHub 存储库 中的安装文件。Go to the Microsoft SDN GitHub Repository for the installation files.

  2. 将安装文件从存储库下载到指定的部署计算机。Download the installation files from the repository to the designated deployment computer. 单击 " 克隆或下载 ",然后单击 " 下载 ZIP"。Click Clone or download and then click Download ZIP.

    备注

    指定的部署计算机必须运行 Windows Server 2016 或更高版本。The designated deployment computer must be running Windows Server 2016 or later.

  3. 展开 zip 文件并将 SDNExpress 文件夹复制到部署计算机的 C:\ 文件夹。Expand the zip file and copy the SDNExpress folder to the deployment computer's C:\ folder.

  4. 将该 C:\SDNExpress 文件夹共享为 "SDNExpress",并向 每个人 提供 读取/写入权限。Share the C:\SDNExpress folder as "SDNExpress" with permission for Everyone to Read/Write.

  5. 导航到 C:\SDNExpress 文件夹。Navigate to the C:\SDNExpress folder.

    你会看到以下文件夹:You see the following folders:

    文件夹名Folder Name 描述Description
    AgentConfAgentConf 保存每个 Windows Server 2016 Hyper-v 主机上 SDN 主机代理使用的 OVSDB 架构的新副本,以对网络策略进行编程。Holds fresh copies of OVSDB schemas used by the SDN Host Agent on each Windows Server 2016 Hyper-V host to program network policy.
    证书Certs NC 证书文件的临时共享位置。Temporary shared location for the NC certificate file.
    映像Images 空,将 Windows Server 2016 vhdx 映像置于此处Empty, place your Windows Server 2016 vhdx image here
    工具Tools 用于故障排除和调试的实用程序。Utilities for troubleshooting and debugging. 复制到主机和虚拟机。Copied to the hosts and virtual machines. 建议将网络监视器或 Wireshark 放在此处,以便它在需要时可用。We recommend you place Network Monitor or Wireshark here so it is available if needed.
    脚本Scripts 部署脚本。Deployment scripts.

    - SDNExpress.ps1- SDNExpress.ps1
    部署和配置构造,其中包括网络控制器虚拟机、SLB Mux 虚拟机、网关池 (s) 和与池 () 相对应的 HNV 网关虚拟机 () 。Deploys and configures the fabric, including the Network controller virtual machines, SLB Mux virtual machines, gateway pool(s) and the HNV gateway virtual machine(s) corresponding to the pool(s) .
    - FabricConfig.psd1- FabricConfig.psd1
    SDNExpress 脚本的配置文件模板。A configuration file template for the SDNExpress script. 你将为你的环境自定义此。You will customize this for your environment.
    - SDNExpressTenant.ps1- SDNExpressTenant.ps1
    在具有负载平衡 VIP 的虚拟网络上部署示例租户工作负荷。Deploys a sample tenant workload on a virtual network with a load balanced VIP.
    还在连接到以前创建的租户工作负荷的服务提供商边缘网关上 (IPSec S2S VPN、GRE、L3) 提供一个或多个网络连接。Also provisions one or more network connections (IPSec S2S VPN, GRE, L3) on the service provider edge gateways which are connected to the previously created tenant workload. IPSec 和 GRE 网关可通过相应的 VIP IP 地址连接,并可通过相应的地址池连接到 L3 转发网关。The IPSec and GRE gateways are available for connectivity over the corresponding VIP IP Address, and the L3 forwarding gateway over the corresponding address pool.
    此脚本也可用于删除带有撤消选项的相应配置。This script can be used to delete the corresponding configuration with an Undo option as well.
    - TenantConfig.psd1- TenantConfig.psd1
    租户工作负荷和 S2S 网关配置的模板配置文件。A template configuration file for tenant workload and S2S gateway configuration.
    - SDNExpressUndo.ps1- SDNExpressUndo.ps1
    清理构造环境,并将其重置为启动状态。Cleans up the fabric environment and resets it to a starting state.
    - SDNExpressEnterpriseExample.ps1- SDNExpressEnterpriseExample.ps1
    预配一个或多个具有一个远程访问网关的企业站点环境,并 (可以选择) 每个站点对应的一个企业虚拟机。Provisions one or more enterprise site environments with one Remote Access Gateway and (optionally) one corresponding enterprise virtual machine per site. IPSec 或 GRE 企业网关连接到服务提供商网关对应的 VIP IP 地址,以建立 S2S 隧道。The IPSec or GRE enterprise gateways connects to the corresponding VIP IP address of the service provider gateway to establish the S2S tunnels. L3 转发网关通过相应的对等 IP 地址进行连接。The L3 Forwarding Gateway connects over the corresponding Peer IP Address.
    此脚本也可用于删除带有撤消选项的相应配置。This script can be used to delete the corresponding configuration with an Undo option as well.
    - EnterpriseConfig.psd1- EnterpriseConfig.psd1
    企业站点到站点网关和客户端 VM 配置的模板配置文件。A template configuration file for the Enterprise site-to-site gateway and Client VM configuration.

    TenantAppsTenantApps 用于部署示例租户工作负荷的文件。Files used to deploy example tenant workloads.
  6. 验证 Windows Server 2016 VHDX 文件是否位于 Images 文件夹中。Verify the Windows Server 2016 VHDX file is in the Images folder.

  7. 通过更改 " **<< 将 >>标记替换 ** 为特定值来自定义 SDNExpress\scripts\FabricConfig.psd1 文件,以适合你的实验室基础结构,其中包括" 规划网络 "主题中列出的网络的主机名、域名、用户名和密码以及网络信息。Customize the SDNExpress\scripts\FabricConfig.psd1 file by changing the << Replace >> tags with specific values to fit your lab infrastructure including host names, domain names, usernames and passwords, and network information for the networks listed in the Planning Network topic.

  8. 在 DNS 中为 NetworkControllerRestName (FQDN) 和 NetworkControllerRestIP 创建一个主机 A 记录。Create a Host A record in DNS for the NetworkControllerRestName (FQDN) and NetworkControllerRestIP.

  9. 以具有域管理员凭据的用户身份运行脚本:Run the script as a user with domain administrator credentials:

    SDNExpress\scripts\SDNExpress.ps1 -ConfigurationDataFile FabricConfig.psd1 -Verbose

  10. 若要撤消所有操作,请运行以下命令:To undo all operations, run the following command:

    SDNExpress\scripts\SDNExpressUndo.ps1 -ConfigurationDataFile FabricConfig.psd1 -Verbose

验证Validation

假设 SDN Express 脚本在不报告任何错误的情况下运行到完成,则可以执行以下步骤以确保构造资源已正确部署并且可用于租户部署。Assuming that the SDN Express script ran to completion without reporting any errors, you can perform the following step to ensure the fabric resources have been deployed correctly and are available for tenant deployment.

使用 诊断工具 确保网络控制器中的任何构造资源上无错误。Use Diagnostic Tools to ensure there are no errors on any fabric resources in the network controller.

Debug-NetworkControllerConfigurationState -NetworkController <FQDN of Network Controller Rest Name>

使用软件负载平衡器部署示例租户工作负荷Deploy a sample tenant workload with the software load balancer

现在已部署了构造资源,你可以通过部署示例租户工作负荷来端到端地验证 SDN 部署。Now that fabric resources have been deployed, you can validate your SDN deployment end-to-end by deploying a sample tenant workload. 此租户工作负荷包括两个虚拟子网 (web 层和数据库层) 使用 SDN 分布式防火墙 (ACL) 规则通过访问控制列表进行保护。This tenant workload consists of two virtual subnets (web tier and database tier) protected via Access Control List (ACL) rules using the SDN distributed firewall. 可以通过 SLB/MUX 使用虚拟 IP (VIP) 地址来访问 web 层的虚拟子网。The web tier's virtual subnet is accessible through the SLB/MUX using a Virtual IP (VIP) address. 脚本会自动部署两个 web 层虚拟机和一个数据库层虚拟机,并将这些虚拟机连接到虚拟子网。The script automatically deploys two web tier virtual machines and one database tier virtual machine and connects these to the virtual subnets.

  1. 通过更改<< FabricConfig.psd将 ** >>标记替换 ** 为特定值来自定义 SDNExpress\scripts\TenantConfig.psd1 文件 (例如: VHD 映像名称、网络控制器 REST 名称、vSwitch 名称等。Customize the SDNExpress\scripts\TenantConfig.psd1 file by changing the << Replace >> tags with specific values (for example: VHD image name, network controller REST name, vSwitch Name, etc. as previously defined in the FabricConfig.psd1 file)

  2. 运行该脚本。Run the script. 例如:For example:

    SDNExpress\scripts\SDNExpressTenant.ps1 -ConfigurationDataFile TenantConfig.psd1 -Verbose

  3. 若要撤消配置,请运行包含 undo 参数的同一个脚本。To undo the configuration, run the same script with the undo parameter. 例如:For example:

    SDNExpress\scripts\SDNExpressTenant.ps1 -Undo -ConfigurationDataFile TenantConfig.psd1 -Verbose

验证Validation

若要验证租户部署是否成功,请执行以下操作:To validate that the tenant deployment was successful, do the following:

  1. 登录到数据库层虚拟机,尝试 ping 某个 web 层虚拟机的 IP 地址 (确保 Windows 防火墙在 web 层虚拟机) 中处于关闭状态。Log into the database tier virtual machine and try to ping the IP address of one of the web tier virtual machines (ensure Windows Firewall is turned off in web tier virtual machines).

  2. 检查网络控制器租户资源是否有任何错误。Check the network controller tenant resources for any errors. 从具有与网络控制器的第3层连接的任何 Hyper-v 主机运行以下内容:Run the following from any Hyper-V host with Layer-3 connectivity to the network controller:

    Debug-NetworkControllerConfigurationState -NetworkController <FQDN of Network Controller REST Name>

  3. 若要验证负载均衡器是否正常运行,请从任何 Hyper-v 主机运行以下内容:To verify that the load balancer is running correctly, run the following from any Hyper-V host:

    wget <VIP IP address>/unique.htm -disablekeepalive -usebasicparsing

    其中 <VIP IP address> ,是在 TenantConfig.psd1 文件中配置的 web 层 VIP IP 地址。where <VIP IP address> is the web tier VIP IP address you configured in the TenantConfig.psd1 file.

    提示

    VIPIP在 TenantConfig.psd1 中搜索变量。Search for the VIPIP variable in TenantConfig.psd1.

    运行此多个时间以查看可用 Dip 之间的负载均衡器开关。Run this muliple times to see the load balancer switch between the available DIPs. 你还可以使用 web 浏览器查看此行为。You can also observe this behavior using a web browser. 浏览到 <VIP IP address>/unique.htmBrowse to <VIP IP address>/unique.htm. 关闭浏览器并打开一个新的实例,然后重新浏览。Close the brower and open a new instance and browse again. 你将看到蓝页和绿色页备用,除非浏览器在缓存超时前缓存页面。You will see the blue page and the green page alternate, except when the browser caches the page before the cache times out.