【发布时间】：2017-03-08 00:06:04
【问题描述】：
我正在尝试通过 PowerShell 和 ARM 模板配置应用服务 Web 应用，并通过虚拟网络网关将 Web 应用连接到虚拟网络（两者都通过 ARM 配置）。
模板相当简单。我有一个网络安全组来切断 vnet 与公共 Internet 的连接。
{
"comments": "NSG - DENY Internet",
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[parameters('private_nsg')]",
"apiVersion": "2016-03-30",
"location": "[parameters('location')]",
"properties": {
"securityRules": [
{
"name": "allow-ssh",
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "22",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 100,
"direction": "Inbound"
}
},
{
"name": "deny-internet",
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 200,
"direction": "Inbound"
}
}
]
},
"resources": [],
"dependsOn": []
},
然后是虚拟网络本身，它具有属于上述 nsg 的子网和网关子网。
{
"comments": "VNet 1",
"type": "Microsoft.Network/virtualNetworks",
"name": "[parameters('vnet1')]",
"apiVersion": "2016-03-30",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "private1",
"properties": {
"addressPrefix": "10.0.1.0/24",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('private_nsg'))]"
}
}
},
{
"name": "GatewaySubnet",
"properties": {
"addressPrefix": "10.0.100.0/24"
}
}
]
},
"resources": [],
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityGroups', parameters('private_nsg'))]"
]
},
然后我为虚拟网络网关创建一个 IP 地址
{
"comments": "Gateway 1 IP",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[parameters('gateway1_ip')]",
"apiVersion": "2016-03-30",
"location": "[parameters('location')]",
"properties": {
"publicIPAllocationMethod": "Dynamic",
"idleTimeoutInMinutes": 4
},
"resources": [],
"dependsOn": []
},
还有网关本身
{
"comments": "VNet1 Gateway",
"apiVersion": "2015-05-01-preview",
"type": "Microsoft.Network/virtualNetworkGateways",
"name": "[parameters('gateway1')]",
"location": "[parameters('location')]",
"properties": {
"ipConfigurations": [
{
"properties": {
"privateIPAllocationMethod": "Dynamic",
"subnet": {
"id": ""[concat(variables('vnet1_ref'),'/subnets/','GatewaySubnet')]""
},
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses',parameters('gateway1_ip'))]"
}
},
"name": "vnetGatewayConfig"
}
],
"gatewayType": "Vpn",
"vpnType": "RouteBased",
"vpnClientConfiguration": {
"vpnClientAddressPool": {
"addressPrefixes": [ "192.168.2.0/24"]
}
},
"enableBgp": false
},
"dependsOn": [
"[concat('Microsoft.Network/publicIPAddresses/', parameters('gateway1_ip'))]",
"[concat('Microsoft.Network/virtualNetworks/', parameters('vnet1'))]"
]
},
我还创建了一个 Linux VM 并将其放在私有子网中，然后创建一个知道如何针对 Linux VM 的私有 (10.) 执行 GET 请求的应用服务 Web 应用程序（和计划）。 em>.*) IP。
模板部署后，我会运行一些 PowerShell based on this other Stack Overflow answer。
$app1 = Get-AzureRmWebApp -ResourceGroupName $ResourceGroupName -Name $parameters["appsvc1_name"]
$app1Config = Get-AzureRmResource -ResourceName "$($app1.Name)/web" -ResourceType "Microsoft.Web/sites/config" -ResourceGroupName $resourceGroupName -ApiVersion 2015-08-01
$vnet = Get-AzureRmVirtualNetwork -ResourceGroupName $resourceGroupName -Name "$resourceGroupName-Net"
$gateway = (Get-AzureRmVirtualNetworkGateway -ResourceGroupName $ResourceGroupName)[0]
$networkProperties = @{ "vnetResourceId" = $vnet.Id }
$networkConnection = New-AzureRmResource -ResourceGroupName $resourceGroupName -Location $resourceGroupLocation -Properties $networkProperties -ResourceName "$($app1.Name)/$($vnet.Name)" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections" -ApiVersion 2015-08-01 -Force
$null = Add-AzureRmVpnClientRootCertificate -ResourceGroupName $resourceGroupName -VpnClientRootCertificateName "AppServiceCertificate.cer" -PublicCertData $networkConnection.Properties.CertBlob -VirtualNetworkGatewayName $gateway.Name
此时，如果我在门户中查看我的应用程序，它看起来好像已连接到网关（门户以绿色显示“已连接”，“证书状态”为“证书已同步”）。但是，我的应用无法连接到私有 VM。
如果我在门户中删除网络连接，然后在门户中重新连接，我的应用可以连接到 VM。这让我相信网关配置正确，只是连接出错了。
上一个 StackOverflow 答案中我唯一缺少的是：
$vpnPackageUri = Get-AzureRmVpnClientPackage -ResourceGroupName $resourceGroupName -VirtualNetworkGatewayName $gateway.Name -ProcessorArchitecture Amd64
$vpnPackageUri = $vpnPackageUri.Replace('"', "")
$vpnPackageProperties = @{ "vnetName" = $vnet.Name; "vpnPackageUri" = $vpnPackageUri }
$networkConnectionVPN = New-AzureRmResource -ResourceGroupName $resourceGroupName -Location $resourceGroupLocation -ResourceName "$($app1.Name)/$($vnet.Name)/primary" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections/gateways" -ApiVersion 2015-08-01 -Force
不幸的是，最后一条命令出错并显示一般错误消息：
New-AzureRmResource : {"Message":"An error has occurred."}
At line:1 char:25
+ $networkConnectionVPN = New-AzureRmResource -ResourceGroupName $resourceGroupNam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzureRmResource], ErrorResponseMessageException
+ FullyQualifiedErrorId : InternalServerError,Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceCmdlet
所以我不知道到底出了什么问题。运行此命令也不允许我的应用程序连接；我必须手动删除连接并将其重新添加到门户中。
我错过了什么？
【问题讨论】：
-
尝试使用 -debug 或 -verbose 运行 cmdlet 以查看详细异常
-
如果我在门户中删除网络连接，然后在门户中重新连接，我的应用程序可以连接到 VM。 - 这让我相信你在你的 powershell 中遗漏了一些东西。
-
看看this question。这可能会有所帮助。
-
@itaysk 感谢您的建议；不幸的是，它显示的只是该命令返回一个 500 Internal Server Error 正文为 { "message": "An error has occurred." }
标签： azure azure-web-app-service azure-resource-manager azure-virtual-network azure-vpn