診斷虛擬機器路由問題Diagnose a virtual machine routing problem

在本文中,您將了解如何藉由檢視對虛擬機器 (VM) 中的網路介面而言有效的路由,對來診斷路由問題。In this article, you learn how to diagnose a routing problem by viewing the routes that are effective for a network interface in a virtual machine (VM). Azure 會為每個虛擬網路子網路建立數個預設路由。Azure creates several default routes for each virtual network subnet. 您可以在路由表中定義路由,並建立該路由表與子網路的關聯,以覆寫 Azure 的預設路由。You can override Azure's default routes by defining routes in a route table, and then associating the route table to a subnet. 您所建立的路由、Azure 的預設路由和任何路由的組合若透過邊界閘道協定 (BGP) 經由 Azure VPN 閘道 (如果您的虛擬網路連線至內部部署網路) 從您的內部部署網路進行傳播,對子網路中的所有網路介面而言都將是有效路由。The combination of routes you create, Azure's default routes, and any routes propagated from your on-premises network through an Azure VPN gateway (if your virtual network is connected to your on-premises network) via the border gateway protocol (BGP), are the effective routes for all network interfaces in a subnet. 如果您不熟悉虛擬網路、網路介面或路由概念,請參閱虛擬網路概觀網路介面路由概觀If you're not familiar with virtual network, network interface, or routing concepts, see Virtual network overview, Network interface, and Routing overview.

案例Scenario

您嘗試連線至 VM,但連線失敗。You attempt to connect to a VM, but the connection fails. 若要判斷為何無法連線至 VM,您可以使用 Azure 入口網站PowerShellAzure CLI 來檢視網路介面的有效路由。To determine why you can't connect to the VM, you can view the effective routes for a network interface using the Azure portal, PowerShell, or the Azure CLI.

下列步驟假設您具有可檢視有效路由的現有 VM。The steps that follow assume you have an existing VM to view the effective routes for. 如果您沒有現有的 VM,請先部署 LinuxWindows VM,用以完成本文中的工作。If you don't have an existing VM, first deploy a Linux or Windows VM to complete the tasks in this article with. 本文中的範例適用于名為 myVM 且名為 myVMNic1的網路介面的 VM。The examples in this article are for a VM named myVM with a network interface named myVMNic1. VM 和網路介面皆位於名為 myResourceGroup 的資源群組,且位於「美國東部」** 區域。The VM and network interface are in a resource group named myResourceGroup, and are in the East US region. 請針對您要診斷問題的 VM,適當地變更步驟中的值。Change the values in the steps, as appropriate, for the VM you are diagnosing the problem for.

使用 Azure 入口網站進行診斷Diagnose using Azure portal

  1. 使用具有必要權限的 Azure 帳戶登入 Azure 入口網站Log into the Azure portal with an Azure account that has the necessary permissions.

  2. 在 Azure 入口網站頂端的搜尋方塊中,輸入執行中 VM 的名稱。At the top of the Azure portal, enter the name of a VM that is in the running state, in the search box. 當 VM 的名稱出現在搜尋結果中時,請加以選取。When the name of the VM appears in the search results, select it.

  3. 在左側的 [ 設定 ] 底下,選取 [ 網路功能],然後選取其名稱以流覽至網路介面資源。Under Settings on the left, select Networking, and navigate to the network interface resource by selecting its name. 查看網路介面View network interfaces

  4. 選取左側的 [ 有效路由]。On the left, select Effective routes. 系統會顯示名為 myVMNic1 之網路介面的有效路由,如下圖所示:  查看有效路由The effective routes for a network interface named myVMNic1 are shown, in the following picture: View effective routes

    如果有多個網路介面連結至 VM,您可以選取任何網路介面以檢視其有效路由。If there are multiple network interfaces attached to the VM, you can view the effective routes for any network interface by selecting it. 由於每個網路介面可能位於不同的子網路中,因此每個網路介面可能會有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes.

    在上圖顯示的範例中,列出的路由是 Azure 為每個子網路建立的預設路由。In the example shown in the previous picture, the listed routes are default routes that Azure creates for each subnet. 您的清單至少會有這些路由,但也可能會有其他路由,視您為虛擬網路啟用的功能而定,例如,您讓虛擬網路可與其他虛擬網路對等互連,或可透過 Azure VPN 閘道連線至您的內部部署網路。Your list has at least these routes, but may have additional routes, depending on capabilities you may have enabled for your virtual network such as it being peered with another virtual network or connected to your on-premises network through an Azure VPN gateway. 若要深入了解每個路由,以及您可檢視的其他網路介面路由,請參閱虛擬網路流量路由To learn more about each of the routes, and other routes you may see for your network interface, see Virtual network traffic routing. 如果您的清單中有大量路由,您可以選取 [下載]**** 來下載含有路由清單的 .csv 檔案,試著簡化作業。If your list has a large number of routes, you may find it easier to select Download, to download a .csv file with the list of routes.

雖然您在前幾個步驟中是透過 VM 來檢視有效路由,但您也可以透過下列途徑來檢視有效路由:Though effective routes were viewed through the VM in the previous steps, you can also view effective routes through an:

使用 PowerShell 進行診斷Diagnose using PowerShell

注意

本文已更新為使用新的 Azure PowerShell Az 模組。This article has been updated to use the new Azure PowerShell Az module. AzureRM 模組在至少 2020 年 12 月之前都還會持續收到錯誤 (Bug) 修正,因此您仍然可以持續使用。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要深入了解新的 Az 模組和 AzureRM 的相容性,請參閱新的 Azure PowerShell Az 模組簡介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 如需 Az 模組安裝指示,請參閱安裝 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

您可以執行 Azure Cloud Shell 中採用的命令,或從您的電腦執行 PowerShell。You can run the commands that follow in the Azure Cloud Shell, or by running PowerShell from your computer. Azure Cloud Shell 是免費的互動式殼層。The Azure Cloud Shell is a free interactive shell. 它具有預先安裝和設定的共用 Azure 工具,可與您的帳戶搭配使用。It has common Azure tools preinstalled and configured to use with your account. 如果您從電腦執行 PowerShell,則需要 Azure PowerShell 模組1.0.0 版或更新版本。If you run PowerShell from your computer, you need the Azure PowerShell module, version 1.0.0 or later. 請在您的電腦上執行 Get-Module -ListAvailable Az,以尋找已安裝的版本。Run Get-Module -ListAvailable Az on your computer, to find the installed version. 如果您需要升級,請參閱安裝 Azure PowerShell 模組If you need to upgrade, see Install Azure PowerShell module. 如果您是在本機執行 PowerShell,您也必須 Connect-AzAccount 使用具有 必要許可權的帳戶來執行以登入 Azure。If you are running PowerShell locally, you also need to run Connect-AzAccount to log into Azure with an account that has the necessary permissions.

取得具有 AzEffectiveRouteTable之網路介面的有效路由。Get the effective routes for a network interface with Get-AzEffectiveRouteTable. 下列範例會取得名為 myVMNic1的網路介面的有效路由,該介面位於名為 myResourceGroup的資源群組中:The following example gets the effective routes for a network interface named myVMNic1, that is in a resource group named myResourceGroup:

Get-AzEffectiveRouteTable `
  -NetworkInterfaceName myVMNic1 `
  -ResourceGroupName myResourceGroup `
  | Format-Table

若要了解輸出中傳回的資訊,請參閱路由概觀To understand the information returned in the output, see Routing overview. 只有在 VM 處於執行狀態時,才會傳回輸出。Output is only returned if the VM is in the running state. 如果有多個網路介面連結至 VM,您可以檢閱每個網路介面的有效路由。If there are multiple network interfaces attached to the VM, you can review the effective routes for each network interface. 由於每個網路介面可能位於不同的子網路中,因此每個網路介面可能會有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes. 如果仍有通訊問題,請參閱其他診斷考量If you're still having a communication problem, see additional diagnosis and considerations.

如果您不知道網路介面的名稱,但知道該網路介面所附加至的 VM 名稱,則下列命令會針對所有附加至 VM 的網路介面,傳回其識別碼:If you don't know the name of a network interface, but do know the name of the VM the network interface is attached to, the following commands return the IDs of all network interfaces attached to a VM:

$VM = Get-AzVM -Name myVM `
  -ResourceGroupName myResourceGroup
$VM.NetworkProfile

您會收到類似於下列範例的輸出:You receive output similar to the following example:

NetworkInterfaces
-----------------
{/subscriptions/<ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myVMNic1

在先前的輸出中,網路介面名稱是 myVMNic1In the previous output, the network interface name is myVMNic1.

使用 Azure CLI 進行診斷Diagnose using Azure CLI

您可以執行 Azure Cloud Shell 中採用的命令,或從您的電腦執行 CLI。You can run the commands that follow in the Azure Cloud Shell, or by running the CLI from your computer. 本文需要 Azure CLI 2.0.32 版或更新的版本。This article requires the Azure CLI version 2.0.32 or later. 執行 az --version 來了解安裝的版本。Run az --version to find the installed version. 如果您需要安裝或升級,請參閱安裝 Azure CLIIf you need to install or upgrade, see Install Azure CLI. 如果您在本機執行 Azure CLI,還需要執行 az login 並使用具有必要權限的帳戶登入 Azure。If you are running the Azure CLI locally, you also need to run az login and log into Azure with an account that has the necessary permissions.

使用 az network nic show-effective-route-table 取得網路介面的有效路由。Get the effective routes for a network interface with az network nic show-effective-route-table. 下列範例會取得名為 myVMNic1 的網路介面的有效路由,該介面位於名為 myResourceGroup的資源群組中:The following example gets the effective routes for a network interface named myVMNic1 that is in a resource group named myResourceGroup:

az network nic show-effective-route-table \
  --name myVMNic1 \
  --resource-group myResourceGroup

若要了解輸出中傳回的資訊,請參閱路由概觀To understand the information returned in the output, see Routing overview. 只有在 VM 處於執行狀態時,才會傳回輸出。Output is only returned if the VM is in the running state. 如果有多個網路介面連結至 VM,您可以檢閱每個網路介面的有效路由。If there are multiple network interfaces attached to the VM, you can review the effective routes for each network interface. 由於每個網路介面可能位於不同的子網路中,因此每個網路介面可能會有不同的有效路由。Since each network interface can be in a different subnet, each network interface can have different effective routes. 如果仍有通訊問題,請參閱其他診斷考量If you're still having a communication problem, see additional diagnosis and considerations.

如果您不知道網路介面的名稱,但知道該網路介面所附加至的 VM 名稱,則下列命令會針對所有附加至 VM 的網路介面,傳回其識別碼:If you don't know the name of a network interface, but do know the name of the VM the network interface is attached to, the following commands return the IDs of all network interfaces attached to a VM:

az vm show \
  --name myVM \
  --resource-group myResourceGroup

解決問題Resolve a problem

要解決路由問題通常需要:Resolving routing problems typically consists of:

  • 新增自訂路由以覆寫 Azure 的其中一個預設路由。Adding a custom route to override one of Azure's default routes. 了解如何新增自訂路由Learn how to add a custom route.
  • 變更或移除可能導致路由至不當位置的自訂路由。Change or remove a custom route that may cause routing to an undesired location. 了解如何變更刪除自訂路由。Learn how to change or delete a custom route.
  • 確定您已定義的任何自訂路由所屬的路由表已與網路介面所在的子網路相關聯。Ensuring that the route table that contains any custom routes you've defined is associated to the subnet the network interface is in. 了解如何建立路由表與子網路的關聯Learn how to associate a route table to a subnet.
  • 確定您已部署的裝置 (例如 Azure VPN 閘道或網路虛擬設備) 是可執行的。Ensuring that devices such as Azure VPN gateway or network virtual appliances you've deployed are operable. 使用網路監看員的 VPN 診斷功能判斷 Azure VPN 閘道是否有任何問題。Use the VPN diagnostics capability of Network Watcher to determine any problems with an Azure VPN gateway.

如果您仍有通訊問題,請參閱 考慮 和其他診斷。If you're still having communication problems, see Considerations and Additional diagnosis.

考量Considerations

對通訊問題進行疑難排解時,請考量以下幾點︰Consider the following points when troubleshooting communication problems:

  • 路由所依據的是您所定義的路由、邊界閘道協定 (BGP) 和系統路由之間的最長首碼比對 (LPM)。Routing is based on longest prefix match (LPM) among routes that you've defined, border gateway protocol (BGP), and system routes. 如果有多個路由有相同的 LPM 相符項,則會根據路由來源,以路由概觀中所列的順序選取路由。If there is more than one route with the same LPM match, then a route is selected based on its origin in the order listed in Routing overview. 有有效路由時,您將只會看到所有可用的路由中符合 LPM 的有效路由。With effective routes, you can only see effective routes that are an LPM match, based on all the available routes. 了解如何評估網路介面的路由,有助於對可能會影響 VM 通訊的特定路由進行疑難排解。Seeing how the routes are evaluated for a network interface makes it a lot easier to troubleshoot specific routes that may be impacting communication from your VM.
  • 如果您已定義網路虛擬設備 (NVA) 的自訂路由,並以 VirtualAppliance 作為下一個躍點類型,請確定接收流量的 NVA 已啟用 IP 轉送,否則封包會被捨棄。If you've defined custom routes to a network virtual appliance (NVA), with Virtual Appliance as the next hop type, ensure that IP forwarding is enabled on the NVA receiving the traffic, or packets are dropped. 深入了解如何啟用網路介面的 IP 轉送Learn more about enabling IP forwarding for a network interface. 此外,作業系統或 NVA 內的應用程式也必須能夠轉送網路流量,而進行相關設定。Additionally, the operating system, or application within the NVA must also be able to forward network traffic and be configured to do so.
  • 如果您已建立 0.0.0.0/0 的路由,則所有輸出網際網路流量都會路由至您所指定的下一個躍點,例如 NVA 或 VPN 閘道。If you've created a route to 0.0.0.0/0, all outbound internet traffic is routed to the next hop you specified, such as to an NVA or VPN gateway. 我們通常將建立此類路由的作業稱為強制通道。Creating such a route is often referred to as forced tunneling. 使用 RDP 或 SSH 通訊協定從網際網路連至 VM 的遠端連線可能無法以此路由執行,這取決於下一個躍點處理流量的方式。Remote connections using the RDP or SSH protocols from the internet to your VM may not work with this route, depending on how the next hop handles the traffic. 符合下列其中一個條件時,可以啟用強制通道︰Forced-tunneling can be enabled:
    • 透過下一個躍點類型的 VPN 閘道建立路由,而使用站對站 VPN 時。When using site-to-site VPN, by creating a route with a next hop type of VPN Gateway. 深入了解如何設定強制通道Learn more about configuring forced tunneling.
    • 如果在使用站對站 VPN 或 ExpressRoute 線路時透過 BGP 經由虛擬網路閘道通告了 0.0.0.0/0 (預設路由)。If a 0.0.0.0/0 (default route) is advertised over BGP through a virtual network gateway when using a site-to-site VPN, or ExpressRoute circuit. 深入了解如何搭配使用 BGP 與站對站 VPNExpressRouteLearn more about using BGP with a site-to-site VPN or ExpressRoute.
  • 若要讓虛擬網路對等互連流量正常運作,對等互連虛擬網路的首碼範圍必須要有下一個躍點類型為 VNet 對等互連的系統路由。For virtual network peering traffic to work correctly, a system route with a next hop type of VNet Peering must exist for the peered virtual network's prefix range. 如果不存在這類路由,且虛擬網路對等互連連結已 連線If such a route doesn't exist, and the virtual network peering link is Connected:
  • 雖然 Azure 會為每個 Azure 網路介面指派預設路由,但如果您有多個網路介面連結至 VM,則在 VM 的作業系統內只會為主要網路介面指派預設路由 (0.0.0.0/0) 或閘道。Though Azure assigns default routes to each Azure network interface, if you have multiple network interfaces attached to the VM, only the primary network interface is assigned a default route (0.0.0.0/0), or gateway, within the VM's operating system. 了解如何為連結至 WindowsLinux VM 的次要網路介面建立預設路由。Learn how to create a default route for secondary network interfaces attached to a Windows or Linux VM. 深入了解主要和次要網路介面Learn more about primary and secondary network interfaces.

其他診斷Additional diagnosis

  • 若要執行快速測試,針對以某位置為目標的流量判斷其下一個躍點類型,請使用 Azure 網路監看員的下一個躍點功能。To run a quick test to determine the next hop type for traffic destined to a location, use the Next hop capability of Azure Network Watcher. 下一個躍點會指出以指定位置為目標的流量所使用的下一個躍點類型。Next hop tells you what the next hop type is for traffic destined to a specified location.
  • 如果沒有任何會造成 VM 網路通訊失敗的路由,則問題可能是由執行於 VM 作業系統內的防火牆軟體所致If there are no routes causing a VM's network communication to fail, the problem may be due to firewall software running within the VM's operating system
  • 如果您要使用強制通道透過 VPN 閘道或 NVA 將流量傳至內部部署裝置,您可能無法從網際網路連線至 VM,視您為裝置設定路由的方式而定。If you are force tunneling traffic to an on-premises device through a VPN gateway, or NVA, you may not be able to connect to a VM from the internet, depending on how you've configured routing for the devices. 請確認您為裝置設定的路由會將流量路由至 VM 的公用或私人 IP 位址。Confirm that the routing you have configured for the device routes traffic to either a public or private IP address for the VM.
  • 使用網路監看員的連線疑難排解功能,判斷輸出通訊問題的路由、篩選和 OS 內部原因。Use the connection troubleshoot capability of Network Watcher to determine routing, filtering, and in-OS causes of outbound communication problems.

接下來的步驟Next steps