Azure App Service 混合式連線Azure App Service Hybrid Connections

混合式連線既是 Azure 服務,也是 Azure App Service 功能。Hybrid Connections is both a service in Azure and a feature in Azure App Service. 作為服務時,它具有 App Service 所利用之用途和功能以外的用途和功能。As a service, it has uses and capabilities beyond those that are used in App Service. 若要深入了解混合式連線及其在 App Service 之外的使用方式,請參閱 Azure 轉送混合式連線To learn more about Hybrid Connections and their usage outside App Service, see Azure Relay Hybrid Connections.

在 App Service 中,您可以使用混合式連線來存取任何網路中的應用程式資源,這些資源可以透過埠443對 Azure 進行輸出呼叫。Within App Service, Hybrid Connections can be used to access application resources in any network that can make outbound calls to Azure over port 443. 混合式連線可讓您從應用程式存取 TCP 端點,而且不會啟用新的方式來存取您的應用程式。Hybrid Connections provides access from your app to a TCP endpoint and does not enable a new way to access your app. 和在 App Service 中使用時相同,每個「混合式連線」都會與單一 TCP 主機和連接埠的組合相互關聯。As used in App Service, each Hybrid Connection correlates to a single TCP host and port combination. 這可讓您的應用程式存取任何 OS 上的資源(前提是它是 TCP 端點)。This enables your apps to access resources on any OS, provided it is a TCP endpoint. 混合式連線不會知道 (或不在意) 應用程式通訊協定為何,或您要存取什麼資源。The Hybrid Connections feature does not know or care what the application protocol is, or what you are accessing. 它只會提供網路存取。It simply provides network access.

運作方式How it works

混合式連線需要部署轉送代理程式,讓它可以同時連線到所需的端點以及 Azure。Hybrid Connections requires a relay agent to be deployed where it can reach both the desired endpoint as well as to Azure. 轉送代理程式混合式連線管理員 (HCM) ,會透過埠443呼叫 Azure 轉送。The relay agent, Hybrid Connection Manager (HCM), calls out to Azure Relay over port 443. 從 web 應用程式網站,App Service 基礎結構也會代表您的應用程式連接到 Azure 轉送。From the web app site, the App Service infrastructure also connects to Azure Relay on your application's behalf. 透過已加入的連接,您的應用程式就能夠存取所需的端點。Through the joined connections, your app is able to access the desired endpoint. 連線會使用 TLS 1.2 以求安全性,並使用共用存取簽章 (SAS) 金鑰來進行驗證和授權。The connection uses TLS 1.2 for security and shared access signature (SAS) keys for authentication and authorization.

混合式連線概要流程圖表

當應用程式提出的 DNS 要求與所設定的「混合式連線」端點相符時,系統就會透過「混合式連線」將輸出 TCP 流量重新導向。When your app makes a DNS request that matches a configured Hybrid Connection endpoint, the outbound TCP traffic will be redirected through the Hybrid Connection.

注意

這表示您應該嘗試一律對混合式連線使用 DNS 名稱。This means that you should try to always use a DNS name for your Hybrid Connection. 如果端點改為使用 IP 位址,某些用戶端軟體不會執行 DNS 查閱。Some client software does not do a DNS lookup if the endpoint uses an IP address instead.

App Service 混合式連線優點App Service Hybrid Connection benefits

「混合式連線」功能有一些優點,包括:There are a number of benefits to the Hybrid Connections capability, including:

  • 應用程式可以安全地存取內部部署系統和服務。Apps can access on-premises systems and services securely.
  • 此功能不需要可存取網際網路的端點。The feature does not require an internet-accessible endpoint.
  • 安裝速度快且過程簡單。It is quick and easy to set up. 不需要閘道No gateways required
  • 每個「混合式連線」都會與單一的「主機:連接埠」組合對應,有助於提高安全性。Each Hybrid Connection matches to a single host:port combination, helpful for security.
  • 通常不需要在防火牆開洞。It normally does not require firewall holes. 連線全都是透過標準的 Web 連接埠輸出。The connections are all outbound over standard web ports.
  • 由於這是網路層級的功能,因此不會因為應用程式所使用的語言及端點所使用的技術而受到影響。Because the feature is network level, it is agnostic to the language used by your app and the technology used by the endpoint.
  • 它可用來讓您從單一應用程式存取多個網路。It can be used to provide access in multiple networks from a single app.
  • 適用于 Windows 原生應用程式的 GA 支援,並且在 Linux 應用程式中為預覽狀態。It is supported in GA for Windows native apps and is in preview for Linux apps. Windows 容器應用程式不支援此功能。It is not supported for Windows container apps.

混合式連線無法執行的作業Things you cannot do with Hybrid Connections

混合式連線無法執行的作業包括:Things you cannot do with Hybrid Connections include:

  • 裝載磁碟。Mount a drive.
  • 使用 UDP。Use UDP.
  • 存取使用動態連接埠的 TCP 型服務 (例如「FTP 被動模式」或「延伸被動模式」)。Access TCP-based services that use dynamic ports, such as FTP Passive Mode or Extended Passive Mode.
  • 支援 LDAP,因為它需要 UDP。Support LDAP, because it can require UDP.
  • 支援 Active Directory,因為您無法將 App Service 背景工作角色加入網域。Support Active Directory, because you cannot domain join an App Service worker.

在您的應用程式中新增和建立混合式連線Add and Create Hybrid Connections in your app

若要建立「混合式連線」,請移至 Azure 入口網站,然後選取您的應用程式。To create a Hybrid Connection, go to the Azure portal and select your app. 選取 [網路] > 設定您的混合式連接端點Select Networking > Configure your Hybrid Connection endpoints. 您可以在這裡看到為您應用程式設定的「混合式連線」。Here you can see the Hybrid Connections that are configured for your app.

混合式連線清單的螢幕擷取畫面

若要新增混合式連線,請選取 [[+] 新增混合式連線]。To add a new Hybrid Connection, select [+] Add hybrid connection. 您會看見已建立的混合式連線清單。You'll see a list of the Hybrid Connections that you already created. 若要在應用程式中新增其中的一或多個混合式連線,請按一下您想要的混合式連線,然後選取 [新增選取的混合式連線]。To add one or more of them to your app, select the ones you want, and then select Add selected Hybrid Connection.

混合式連線入口網站的螢幕擷取畫面

如果您想要建立新的「混合式連線」,請選取 [建立新的混合式連線]。If you want to create a new Hybrid Connection, select Create new hybrid connection. 指定下列項目:Specify the:

  • 混合式連線名稱。Hybrid Connection name.
  • 端點主機名稱。Endpoint hostname.
  • 端點連接埠。Endpoint port.
  • 您想要使用的「服務匯流排」命名空間。Service Bus namespace you want to use.

[建立新的混合式連線] 對話方塊螢幕擷取畫面

每個「混合式連線」都會繫結至一個「服務匯流排」命名空間,而每個「服務匯流排」命名空間都位於 Azure 區域中。Every Hybrid Connection is tied to a Service Bus namespace, and each Service Bus namespace is in an Azure region. 請務必嘗試使用與應用程式位於相同區域的「服務匯流排」命名空間,以避免網路所引發的延遲。It's important to try to use a Service Bus namespace in the same region as your app, to avoid network induced latency.

如果您想要移除應用程式中的「混合式連線」,請對它按一下滑鼠右鍵,然後選取 [中斷連線]。If you want to remove your Hybrid Connection from your app, right-click it and select Disconnect.

將「混合式連線」新增至應用程式之後,您只要選取它就可以查看詳細資料。When a Hybrid Connection is added to your app, you can see details on it simply by selecting it.

混合式連線詳細資料的螢幕擷取畫面

在 Azure 轉送入口網站中建立混合式連線Create a Hybrid Connection in the Azure Relay portal

除了透過入口網站從您應用程式內進行的方式之外,您也可以從「Azure 轉送」入口網站內建立「混合式連線」。In addition to the portal experience from within your app, you can create Hybrid Connections from within the Azure Relay portal. 若要讓 App Service 使用混合式連線,必須:For a Hybrid Connection to be used by App Service, it must:

  • 要求用戶端授權。Require client authorization.
  • 擁有一個以「主機:連接埠」組合作為值的中繼資料項目具名端點。Have a metadata item, named endpoint, that contains a host:port combination as the value.

混合式連線和 App Service 方案Hybrid Connections and App Service plans

只有在「基本」、「標準」、「進階」及「隔離」定價 SKU 中,才有提供「App Service 混合式連線」。App Service Hybrid Connections are only available in Basic, Standard, Premium, and Isolated pricing SKUs. 定價方案會有相關聯的限制。There are limits tied to the pricing plan.

定價方案Pricing plan 方案中可用的混合式連線數目Number of Hybrid Connections usable in the plan
BasicBasic 每個方案 5 個5 per plan
標準Standard 每個方案 25 個25 per plan
>premiumv2PremiumV2 每個應用程式 200 個200 per app
隔離Isolated 每個應用程式 200 個200 per app

App Service 方案 UI 會顯示您正在使用的混合式連線數目,以及由哪些應用程式使用。The App Service plan UI shows you how many Hybrid Connections are being used and by what apps.

App Service 方案屬性的螢幕擷取畫面

請選取 [混合式連線] 以查看詳細資料。Select the Hybrid Connection to see details. 您可以看到在應用程式檢視中所看到的所有資訊。You can see all the information that you saw at the app view. 您也可以查看在相同的方案中,有多少其他的應用程式使用了該混合式連線。You can also see how many other apps in the same plan are using that Hybrid Connection.

可用於 App Service 方案的混合式連線端點數目有其上限。There is a limit on the number of Hybrid Connection endpoints that can be used in an App Service plan. 不過,每個使用的混合式連線,則可用於方案中任何數目的應用程式上。Each Hybrid Connection used, however, can be used across any number of apps in that plan. 例如,一個在「App Service 方案」中 5 個個別應用程式上使用的「混合式連線」,只算 1 個「混合式連線」。For example, a single Hybrid Connection that is used in five separate apps in an App Service plan counts as one Hybrid Connection.

定價Pricing

除了有 App Service 方案 SKU 的需求,還有使用混合式連線的額外成本。In addition to there being an App Service plan SKU requirement, there is an additional cost to using Hybrid Connections. 混合式連線所使用的每個接聽程式皆會產生費用。There is a charge for each listener used by a Hybrid Connection. 接聽程式是混合式連線管理員。The listener is the Hybrid Connection Manager. 如果由兩個混合式連線管理員支援的混合式連線有五個,那就有 10 個接聽程式。If you had five Hybrid Connections supported by two Hybrid Connection Managers, that would be 10 listeners. 如需詳細資訊,請參閱服務匯流排價格For more information, see Service Bus pricing.

混合式連線管理員Hybrid Connection Manager

「混合式連線」功能需要在裝載「混合式連線」端點的網路中有轉送代理程式。The Hybrid Connections feature requires a relay agent in the network that hosts your Hybrid Connection endpoint. 該轉送代理程式稱為混合式連線管理員 (HCM)。That relay agent is called the Hybrid Connection Manager (HCM). 若要下載 HCM,請在 Azure 入口網站 中,從您的應用程式選取 [網路] > [設定您的混合式連接端點]。To download HCM, from your app in the Azure portal, select Networking > Configure your Hybrid Connection endpoints.

此工具可在 Windows Server 2012 和更新版本上執行。This tool runs on Windows Server 2012 and later. HCM 以服務形式執行,並向外連線到連接埠 443 上的 Azure 轉送。The HCM runs as a service and connects outbound to Azure Relay on port 443.

在安裝 HCM 之後,您可以執行 HybridConnectionManagerUi.exe 來使用工具的 UI。After installing HCM, you can run HybridConnectionManagerUi.exe to use the UI for the tool. 此檔案位於混合式連線管理員的安裝目錄下。This file is in the Hybrid Connection Manager installation directory. 在 Windows 10 中,您也可以在搜尋方塊中搜尋「混合式連線管理員 UI」即可。In Windows 10, you can also just search for Hybrid Connection Manager UI in your search box.

混合式連線管理員的螢幕擷取畫面

啟動 HCM UI 時,您會先看到一個表格,當中會列出與這個 HCM 執行個體搭配設定的所有「混合式連線」。When you start the HCM UI, the first thing you see is a table that lists all the Hybrid Connections that are configured with this instance of the HCM. 如果您想要進行任何變更,請先向 Azure 進行驗證。If you want to make any changes, first authenticate with Azure.

若要在 HCM 中新增一或多個混合式連線︰To add one or more Hybrid Connections to your HCM:

  1. 啟動 HCM UI。Start the HCM UI.

  2. 選取 [設定另一個混合式連線]。Select Configure another Hybrid Connection. 設定新的混合式連線螢幕擷取畫面Screenshot of Configure New Hybrid Connections

  3. 使用您的 Azure 帳戶登入,以取得您的訂用帳戶可用的混合式連線。Sign in with your Azure account to get your Hybrid Connections available with your subscriptions. HCM 不會繼續使用您的 Azure 帳戶超過該帳戶。The HCM does not continue to use your Azure account beyond that.

  4. 選擇訂用帳戶。Choose a subscription.

  5. 選取您要讓 HCM 轉送的「混合式連線」。Select the Hybrid Connections that you want the HCM to relay. 混合式連線的螢幕擷取畫面Screenshot of Hybrid Connections

  6. 選取 [儲存]。Select Save.

現在可以看到您新增的「混合式連線」。You can now see the Hybrid Connections you added. 您也可以選取已設定的混合式連線,以查看詳細資料。You can also select the configured Hybrid Connection to see details.

混合式連線詳細資料的螢幕擷取畫面

若要讓 HCM 能夠支援所設定與其搭配的「混合式連線」,它需要︰To support the Hybrid Connections it is configured with, HCM requires:

  • 對 Azure 的 TCP 存取權 (透過連接埠 443)。TCP access to Azure over port 443.
  • 對「混合式連線」端點的 TCP 存取權。TCP access to the Hybrid Connection endpoint.
  • 能夠對端點主機和「服務匯流排」命名空間執行 DNS 查閱。The ability to do DNS look-ups on the endpoint host and the Service Bus namespace.

注意

「Azure 轉送」需倚賴「Web 通訊端」來取得連線能力。Azure Relay relies on Web Sockets for connectivity. 此功能只有在 Windows Server 2012 或更新版本上才有提供。This capability is only available on Windows Server 2012 or later. 因此,Windows Server 2012 以前的所有版本皆不支援 HCM。Because of that, HCM is not supported on anything earlier than Windows Server 2012.

備援性Redundancy

每個 HCM 都可以支援多個「混合式連線」。Each HCM can support multiple Hybrid Connections. 此外,任何指定的「混合式連線」也都可以受到多個 HCM 支援。Also, any given Hybrid Connection can be supported by multiple HCMs. 預設行為是在任何給定端點所設定的 HCM 之間路由傳送流量。The default behavior is to route traffic across the configured HCMs for any given endpoint. 如果您想要讓來自您網路的「混合式連線」具有高可用性,請在不同電腦上執行多個 HCM。If you want high availability on your Hybrid Connections from your network, run multiple HCMs on separate machines. 轉送服務用來將流量散發至 HCM 的負載分配演算法會隨機指派。The load distribution algorithm used by the Relay service to distribute traffic to the HCMs is random assignment.

手動新增混合式連線Manually add a Hybrid Connection

若要想讓訂用帳戶外的人員裝載指定「混合式連線」的 HCM 執行個體,您可以與他們共用「混合式連線」的閘道連接字串。To enable someone outside your subscription to host an HCM instance for a given Hybrid Connection, share the gateway connection string for the Hybrid Connection with them. 您可以在 Azure 入口網站中的混合式連線屬性中看到閘道連接字串。You can see the gateway connection string in the Hybrid Connection properties in the Azure portal. 若要使用該字串,請在 HCM 中選取 [手動輸入],然後貼上閘道連接字串。To use that string, select Enter Manually in the HCM, and paste in the gateway connection string.

手動新增混合式連線

升級Upgrade

混合式連線管理員會定期更新,以修正問題或改善效能。There are periodic updates to the Hybrid Connection Manager to fix issues or provide improvements. 當升級程式發行時,HCM UI 中會出現快顯視窗。When upgrades are released, a popup will show up in the HCM UI. 套用升級後,HCM 會發生變更並重新啟動。Applying the upgrade will apply the changes and restart the HCM.

以程式設計方式將混合式連線新增至應用程式Adding a Hybrid Connection to your app programmatically

混合式連線有 Azure CLI 支援。There is Azure CLI support for Hybrid Connections. 提供的命令會在應用程式和 App Service 計畫層級運作。The commands provided operate at both the app and the App Service plan level. 應用層級命令為:The app level commands are:

az webapp hybrid-connection

Group
    az webapp hybrid-connection : Methods that list, add and remove hybrid-connections from webapps.
        This command group is in preview. It may be changed/removed in a future release.
Commands:
    add    : Add a hybrid-connection to a webapp.
    list   : List the hybrid-connections on a webapp.
    remove : Remove a hybrid-connection from a webapp.

App Service plan 命令可讓您設定指定的混合式連接將使用的金鑰。The App Service plan commands enable you to set which key a given hybrid-connection will use. 每個混合式連線(主要和次要)都會設定兩個索引鍵。There are two keys set on each Hybrid Connection, a primary and a secondary. 您可以選擇使用主要或次要金鑰搭配下列命令。You can choose to use the primary or secondary key with the below commands. 當您想要定期重新產生金鑰時,這可讓您切換的金鑰。This enables you to switch keys for when you want to periodically regenerate your keys.

az appservice hybrid-connection --help

Group
    az appservice hybrid-connection : A method that sets the key a hybrid-connection uses.
        This command group is in preview. It may be changed/removed in a future release.
Commands:
    set-key : Set the key that all apps in an appservice plan use to connect to the hybrid-
                connections in that appservice plan.

保護混合式連接Secure your Hybrid Connections

您可以將現有的混合式連線新增至具有基礎 Azure 服務匯流排轉送的足夠許可權之任何使用者的其他 App Service Web Apps。An existing Hybrid Connection can be added to other App Service Web Apps by any user who has sufficient permissions on the underlying Azure Service Bus Relay. 這表示,如果您必須防止其他人重複使用相同的混合式連線 (例如,當目標資源是沒有任何額外安全性措施可防止未經授權存取) 的服務時,您必須鎖定 Azure 服務匯流排轉送的存取權。This means that if you must prevent others from reusing that same Hybrid Connection (for example when the target resource is a service that does not have any additional security measures in place to prevent unauthorized access), you must lock down access to the Azure Service Bus Relay.

擁有轉送存取權的任何人都可以在 Reader 嘗試將其新增至 Azure 入口網站中的 Web 應用程式時, 看到 混合式連線,但因為缺少取得用來建立轉送連線之連接字串的許可權,所以將無法 新增 該連接。Anyone with Reader access to the Relay will be able to see the Hybrid Connection when attempting to add it to their Web App in the Azure portal, but they will not be able to add it as they lack the permissions to retrieve the connection string which is used to establish the relay connection. 為了成功新增混合式連線,它們必須具有 listKeys () 的許可權 Microsoft.Relay/namespaces/hybridConnections/authorizationRules/listKeys/actionIn order to successfully add the Hybrid Connection, they must have the listKeys permission (Microsoft.Relay/namespaces/hybridConnections/authorizationRules/listKeys/action). Contributor 轉送上包含此許可權的角色或任何其他角色,可讓使用者使用混合式連線,並將其新增至自己的 Web Apps。The Contributor role or any other role which includes this permission on the Relay will allow users to use the Hybrid Connection and add it to their own Web Apps.

疑難排解Troubleshooting

「已連線」狀態意謂著該「混合式連線」至少有一個已設定的 HCM,並且能夠連線至 Azure。The status of "Connected" means that at least one HCM is configured with that Hybrid Connection, and is able to reach Azure. 如果「混合式連線」的狀態並未顯示「已連線」,則表示在所有可存取 Azure 的 HCM 上皆未設定該「混合式連線」。If the status for your Hybrid Connection does not say Connected, your Hybrid Connection is not configured on any HCM that has access to Azure.

用戶端無法連線至其端點的主要原因是,端點在指定時所使用的是 IP 位址而非 DNS 名稱。The primary reason that clients cannot connect to their endpoint is because the endpoint was specified by using an IP address instead of a DNS name. 如果您的應用程式無法連線到所要的端點,且您使用的是 IP 位址,請改為使用對 HCM 執行所在之主機有效的 DNS 名稱。If your app cannot reach the desired endpoint and you used an IP address, switch to using a DNS name that is valid on the host where the HCM is running. 也請檢查 HCM 執行所在的主機已正確解析 DNS 名稱。Also check that the DNS name resolves properly on the host where the HCM is running. 請確認 HCM 執行所在的主機可連線到「混合式連線」端點。Confirm that there is connectivity from the host where the HCM is running to the Hybrid Connection endpoint.

在 App Service 中,您可以從 [Advanced Tools (Kudu]) 主控台叫用 tcpping 命令列工具。In App Service, the tcpping command line tool can be invoked from the Advanced Tools (Kudu) console. 這個工具可以指出您是否能夠存取 TCP 端點,但不會指出您是否能夠存取「混合式連線」端點。This tool can tell you if you have access to a TCP endpoint, but it does not tell you if you have access to a Hybrid Connection endpoint. 當您在主控台中對「混合式連線」端點使用此工具時,您只能確認該端點使用「主機:連接埠」組合。When you use the tool in the console against a Hybrid Connection endpoint, you are only confirming that it uses a host:port combination.

如果您的端點有命令列用戶端,您可以從應用程式主控台測試連線能力。If you have a command line client for your endpoint, you can test connectivity from the app console. 例如,您可以使用捲曲測試對 web 伺服器端點的存取。For example, you can test access to web server endpoints by using curl.