使用網路 Virtual 設備 Virtual 網路Use Network Virtual Appliances on a Virtual Network

適用於:Windows Server(以每年次管道)、Windows Server 2016Applies To: Windows Server (Semi-Annual Channel), Windows Server 2016

您可以使用本主題以了解如何部署承租人 Virtual 網路上的網路 virtual 裝置。You can use this topic to learn how to deploy network virtual appliances on tenant Virtual Networks.

您可以新增網路 virtual 裝置執行使用者定義路由並連接埠鏡像函式的網路。You can add network virtual appliances to networks that perform user defined routing and port mirroring functions.

本主題包含下列各節。This topic contains the following sections.

網路 Virtual 裝置的類型Types of Network Virtual Appliances

有兩種類型的 virtual,您可以使用 virtual 網路上的裝置:There are two types of virtual appliances that you can use on virtual networks:

  1. 使用者定義路由User defined routing. 使用者定義路由分散式的路由器 virtual 取代路由 virtual 應用裝置的功能。User defined routing replaces distributed routers on the virtual network with the routing capabilities of the virtual appliance. 使用使用者定義路由 virtual 應用裝置做為路由器之間 virtual 網路上的 virtual 子網路。With user defined routing, the virtual appliance is used as a router between the virtual subnets on the virtual network.
  2. 連接埠鏡像Port mirroring. 鏡像連接埠,輸入或離開受監視的連接埠所有網路流量是重複與傳送到分析 virtual 應用裝置。With port mirroring, all network traffic that is entering or leaving the monitored port is duplicated and sent to a virtual appliance for analysis. ## 部署的網路 Virtual 應用裝置Deploying a Network Virtual Appliance

若要部署的 virtual 應用裝置,您必須先建立一樣 (VM) 包含應用裝置,,,然後將 VM 連接到適當的 virtual 網路子網路。To deploy a virtual appliance, you must first create a virtual machine (VM) that contains the appliance, and then connect the VM to the appropriate virtual network subnets.

某些裝置需要多重 virtual 網路介面卡。Some appliances require multiple virtual network adapters. 通常是一個網路介面卡專用應用裝置管理時處理流量使用其他的顯示卡。Usually one network adapter is dedicated to the appliance management while additional adapters are used for processing traffic.

如果應用程式裝置需要多個網路介面卡,您必須建立每個網路介面 Network Controller 中。If your appliance requires multiple network adapters, you must create each network interface in Network Controller.

您也必須指派介面 ID 每個其他的顯示卡不同 virtual 子網路上的每個主機上。You must also assign an interface ID on each host for each of the additional adapters that are on different virtual subnets.

您已完成網路 virtual 應用裝置部署之後,您可以使用應用裝置的使用者定義路由、 連接埠鏡像或兩者。After you have completed network virtual appliance deployment, you can use the appliance for user defined routing, port mirroring, or both.

範例: 使用者定義路由Example: User Defined Routing

針對大部分的環境,您將只需要已經所定義之 virtual 網路分散式路由器系統路徑。For most environments you will only need the system routes already defined by the virtual network's distributed router. 不過,您可能需要建立之前的路徑表並將一或多個路徑新增特定萬一,例如:However, you might need to create a route table and add one or more routes in specific cases, such as:

  • 推動網際網路透過在場所網路的通道。Force tunneling to the Internet via your on-premises network.
  • 在您的環境中 virtual 裝置使用。Use of virtual appliances in your environment.

這些案例中,您必須建立之前的路徑表,並加入表格中的使用者定義路徑。For these scenarios, you must create a route table and add user defined routes to the table. 您有多個之前的路徑表格,相同路由表可以相關聯的一或多個子網路。You can have multiple route tables, and the same route table can be associated to one or more subnets.

每個子網路只能相關單一路由資料表。Each subnet can only be associated to a single route table. 子網路中的所有 Vm 都使用子網路相關聯的之前的路徑資料表。All VMs in a subnet use the route table that is associated to that subnet.

子網路依賴之前的路徑表格子網路中相關系統路徑。Subnets rely on system routes until a route table is associated to the subnet. 關聯存在之後,路由完成根據上最長前置詞相符項目 (LPM) 之間使用者定義路徑和系統路徑。After an association exists, routing is done based on Longest Prefix Match (LPM) among both user defined routes and system routes.

如果有多個路由相同 LPM 相符項目,然後使用者定義的路由是第一次-前選取系統之前的路徑。If there is more than one route with the same LPM match, then the user defined route is selected first - before the system route.

步驟 1: 建立路由表格屬性Step 1: Create the route table properties

本表路由會包含所有的使用者定義路徑。This route table will contain all of the user defined routes. 系統路徑仍會套用根據定義上方的規則。System routes will still apply according to the rules defined above.

您可以使用下列命令範例建立之前的路徑表格屬性。You can use the following example commands to create route table properties.

$routetableproperties = new-object Microsoft.Windows.NetworkController.RouteTableProperties

步驟 2: 新增路由之前的路徑表格屬性Step 2: Add a route to the route table properties

這顯示,取得傳送任何流量 12.0.0.0/8 子網路,在 192.168.1.10 路由傳送 virtual 應用裝置。This route says that any traffic that is destined for the 12.0.0.0/8 subnet should get sent the the virtual appliance at 192.168.1.10 to be routed. 請務必應用裝置已連接到 virtual 網路的 ip 指派給網路介面 virtual 網路介面卡。It is important that the appliance has a virtual network adapter attached to the virtual network with that IP assigned to a network interface.

您可以使用下列命令範例路由加入之前的路徑表格屬性。You can use the following example commands to add a route to the route table properties.

$route = new-object Microsoft.Windows.NetworkController.Route
$route.ResourceID = "0_0_0_0_0"
$route.properties = new-object Microsoft.Windows.NetworkController.RouteProperties
$route.properties.AddressPrefix = "0.0.0.0/0"
$route.properties.nextHopType = "VirtualAppliance"
$route.properties.nextHopIpAddress = "192.168.1.10"
$routetableproperties.routes += $route

針對每個您想要定義的路徑重複此步驟,您可以新增額外的路徑。You can add additional routes by repeating this step for each route you want to define. ss

步驟 3: 新增 Network Controller 路由表Step 3: Add the route table to Network Controller

您可以使用下列命令範例加入 Network Controller 路由表。You can use the following example commands to add the route table to Network Controller.

$routetable = New-NetworkControllerRouteTable -ConnectionUri $uri -ResourceId "Route1" -Properties $routetableproperties

步驟 4: 適用於路由表 virtual 子網路Step 4: Apply the route table to the virtual subnet

當您將路由表套用到 virtual 子網路時,Tenant1_Vnet1 網路中的第一個 virtual 子網路使用路由表。When you apply the route table to the virtual subnet, the first virtual subnet in the Tenant1_Vnet1 network uses the route table. 您可以指定路由表最多的子網路中 virtual 網路您想要。You can assign the route table to as many of the subnets in the virtual network as you want.

將之前的路徑表套用到 virtual 子網路,您可以使用下列命令範例。You can use the following example commands to apply the route table to the virtual subnet.

$vnet = Get-NetworkControllerVirtualNetwork -ConnectionUri $uri -ResourceId "Tenant1_VNet1"
$vnet.properties.subnets[0].properties.RouteTable = $routetable
new-networkcontrollervirtualnetwork -connectionuri $uri -properties $vnet.properties -resourceId $vnet.resourceid

在您之前的路徑表套用到 virtual 網路,資料傳輸轉寄給 virtual 應用裝置。As soon as you apply the route table to the virtual network, traffic is forwarded to the virtual appliance. 您必須設定路由表 virtual 應用裝置轉送流量,方式是適用於您的環境中。You must configure the routing table in the virtual appliance to forward the traffic, in a manner that is appropriate for your environment.

範例: 連接埠鏡像Example: Port Mirroring

此範例中,可讓您設定 MyVM_Ethernet1 的資料傳輸到 Appliance_Ethernet1 鏡像流量。This example allows you to configure MyVM_Ethernet1's traffic so that the traffic is mirrored to Appliance_Ethernet1.

假設您已經已經部署兩個 Vm 一個為應用裝置,使用鏡像監視 VM 為一個。This example assumes that you've already deployed two VMs, one as the appliance and one as the VM to monitor with mirroring.

請務必應用裝置,鏡像可以為上 Appliance_Ethernet1 目的地之後,它不會收到流量 IP 介面有的設定,因為有第二個網路介面管理。It is important that the appliance has a second network interface for management because after mirroring is enabled as a destination on Appliance_Ethernet1, it will no longer receive traffic that is destined for the IP interface configured there.

步驟 1: 取得您的 Vm 位於 virtual 網路Step 1: Get the virtual network on which your VMs are located

若要取得 virtual 網路,您可以使用下列命令的範例。You can use the following example command to get the virtual network.

$vnet = Get-NetworkControllerVirtualNetwork -ConnectionUri $uri -ResourceId "Tenant1_VNet1"

步驟 2: 鏡像來源和目的地取得 Network Controller 的網路介面Step 2: Get the Network Controller network interfaces for the mirroring source and destination

您可以使用下列命令範例取得 Network Controller 的網路介面鏡像來源和目的地資訊。You can use the following example commands to obtain the Network Controller network interfaces for the mirroring source and destination.

$dstNic = get-networkcontrollernetworkinterface -ConnectionUri $uri -ResourceId "Appliance_Ethernet1"
$srcNic = get-networkcontrollernetworkinterface -ConnectionUri $uri -ResourceId "MyVM_Ethernet1"

步驟 3: 建立包含連接埠規則及的項目,表示介面目的地鏡像 serviceinsertionproperties 物件Step 3: Create a serviceinsertionproperties object to contain the port mirroring rules and the element which represents the destination interface

您可以使用下列命令範例建立目的地 serviceinsertionproperties 物件。You can use the following example commands to create a destination serviceinsertionproperties object.

$portmirror = [Microsoft.Windows.NetworkController.ServiceInsertionProperties]::new()
$portMirror.Priority = 1

步驟 4: 建立包含必須符合傳送到應用裝置流量順序規則 serviceinsertionrules 物件Step 4: Create a serviceinsertionrules object to contain the rules that must be matched in order for the traffic to be sent to the appliance

下列符合所有流量,同時輸入 / 輸出,表示傳統鏡像都定義規則。The rules defined below match all traffic, both inbound and outbound, which represents a traditional mirror. 如果您感興趣鏡像特定的連接埠或特定的來源目的地,您可以調整本規則。You can adjust these rules if you are interested in mirroring a specific port, or specific source/destinations.

您可以使用下列命令範例建立 serviceinsertionproperties 物件。You can use the following example commands to create a serviceinsertionproperties object.

$portmirror.ServiceInsertionRules = [Microsoft.Windows.NetworkController.ServiceInsertionRule[]]::new(1)

$portmirror.ServiceInsertionRules[0] = [Microsoft.Windows.NetworkController.ServiceInsertionRule]::new()
$portmirror.ServiceInsertionRules[0].ResourceId = "Rule1"
$portmirror.ServiceInsertionRules[0].Properties = [Microsoft.Windows.NetworkController.ServiceInsertionRuleProperties]::new()

$portmirror.ServiceInsertionRules[0].Properties.Description = "Port Mirror Rule"
$portmirror.ServiceInsertionRules[0].Properties.Protocol = "All"
$portmirror.ServiceInsertionRules[0].Properties.SourcePortRangeStart = "0"
$portmirror.ServiceInsertionRules[0].Properties.SourcePortRangeEnd = "65535"
$portmirror.ServiceInsertionRules[0].Properties.DestinationPortRangeStart = "0"
$portmirror.ServiceInsertionRules[0].Properties.DestinationPortRangeEnd = "65535"
$portmirror.ServiceInsertionRules[0].Properties.SourceSubnets = "*"
$portmirror.ServiceInsertionRules[0].Properties.DestinationSubnets = "*"

步驟 5: 建立 serviceinsertionelements 物件包含您要的鏡像應用裝置的網路介面Step 5: Create a serviceinsertionelements object to contain the network interface of the appliance you are mirroring to

您可以使用下列命令範例建立網路介面 serviceinsertionelements 物件。You can use the following example commands to create a network interface serviceinsertionelements object.

$portmirror.ServiceInsertionElements = [Microsoft.Windows.NetworkController.ServiceInsertionElement[]]::new(1)

$portmirror.ServiceInsertionElements[0] = [Microsoft.Windows.NetworkController.ServiceInsertionElement]::new()
$portmirror.ServiceInsertionElements[0].ResourceId = "Element1"
$portmirror.ServiceInsertionElements[0].Properties = [Microsoft.Windows.NetworkController.ServiceInsertionElementProperties]::new()

$portmirror.ServiceInsertionElements[0].Properties.Description = "Port Mirror Element"
$portmirror.ServiceInsertionElements[0].Properties.NetworkInterface = $dstNic
$portmirror.ServiceInsertionElements[0].Properties.Order = 1

步驟 6: Network Controller 中新增服務插入物件Step 6: Add the service insertion object in Network Controller

當您發出這個命令時,將會停止所有的資料傳輸到上一個步驟中所指定應用裝置網路介面。When you issue this command, all traffic to the appliance network interface specified in the previous step will stop.

您可以使用下列命令範例 Network Controller 中新增服務插入物件。You can use the following example commands to add the service insertion object in Network Controller.

$portMirror = New-NetworkControllerServiceInsertion -ConnectionUri $uri -Properties $portmirror -ResourceId "MirrorAll"

步驟 7: 更新的來源鏡像的網路介面Step 7: Update the network interface of the source to be mirrored

更新網路介面,您可以使用下列命令範例。You can use the following example commands to update the network interface.

$srcNic.Properties.IpConfigurations[0].Properties.ServiceInsertion = $portMirror
$srcNic = New-NetworkControllerNetworkInterface -ConnectionUri $uri  -Properties $srcNic.Properties -ResourceId $srcNic.ResourceId

當您完成下列步驟執行時,從 MyVM_Ethernet1 介面流量被鏡像 Appliance_Ethernet1 介面。When you have completed these steps, the traffic from the MyVM_Ethernet1 interface is mirrored by the Appliance_Ethernet1 interface.