![\"azure-vpn-34\"](\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2017\/09\/azure-vpn-34.png\" "\\"azure-vpn-34\\"")
<\/a><\/p>\n<\/p>\n
1.\u8a2d\u5b9aazure \u865b\u64ec\u7db2\u8def<\/p>\n
\u65b0\u589e > \u641c\u5c0b\u00a0 > virtual network<\/p>\n
\u6703\u641c\u5c0b\u5230 [\u865b\u64ec\u7db2\u8def] \u76f4\u63a5\u9ede\u9078\u5b83<\/p>\n \u9ede\u9078\u5f8c\uff0c\u5728\u865b\u64ec\u7db2\u8def\u90e8\u5206 => \u9078\u64c7 \u4f48\u7f72\u985e\u578b [Resource Manager] \u5f8c\u9ede[\u5efa\u7acb]<\/p>\n \u63a5\u8457\u5c31\u662f\u5efa\u7acb\u865b\u64ec\u7db2\u8def\u76f8\u95dc\u8cc7\u8a0a\uff0c\u8acb\u53c3\u8003\u4e0b\u5716\u7bc4\u4f8b<\/p>\n \u4e3b\u8981\u6211\u5283\u5206\u7684\u865b\u64ec\u7db2\u8def10.10.0.0\/16<\/p>\n \u6240\u4ee5\u6211\u53ef\u4ee5\u7528\u7684\u7bc4\u570d\u6703\u662f 10.10.0.0 – 10.10.255.255<\/p>\n \u7b2c\u4e00\u6bb5\u5b50\u7db2\u8def\u6211\u8a2d\u5b9a 10.10.0.0\/24<\/p>\n 2.\u6307\u5b9aMicrosoft Azure DNS server<\/p>\n \u7576\u865b\u64ec\u7db2\u8def\u4f48\u7f72\u5b8c\u6210\u5f8c\uff0c\u5728azure \u4e0a [\u6240\u6709\u8cc7\u6e90] \u5c31\u6703\u51fa\u73fe\u524d\u9762\u6b65\u9a5f\u5275\u5efa\u7684<\/p>\n \u865b\u64ec\u7db2\u8def[Roy-VPN]\uff0c\u9ede\u9078\u5f8c \u53f3\u5074\u5c31\u53ef\u4ee5\u8a2d\u5b9a [DNS Server]<\/p>\n \u9ede\u9078\u3000Custom => \u8a2d\u5b9aDNS\u3000\uff188.8.8.8 (\u4e0d\u4e00\u5b9a\u8981\u8a2d\u5b9agoogle\u7684)<\/p>\n \uff2f\uff2b\u5f8c\u9edesave<\/p>\n 3.\u8a2d\u5b9a\u3000virtual network gateway<\/p>\n \u548c\u5efa\u7acb\u865b\u64ec\u7db2\u8def\u4e00\u6a23\u5148\u641c\u5c0b\u3000\u3000virtual network gateway<\/p>\n \u6703\u627e\u5230[\u865b\u64ec\u7db2\u8def\u9598\u9053] \u9ede\uff3b\u5efa\u7acb\uff3d<\/p>\n \u540d\u7a31\u81ea\u8a02<\/p>\n VPN Type => Routr-Based<\/p>\n SKU => Standard<\/p>\n Virtual Network => \u5c31\u9078\u64c7\u524d\u4e0d\u6b65\u9a5f\u5efa\u7acb\u7684\u865b\u64ec\u7db2\u8def Roy-VPN<\/p>\n Gateway subnet address range\u00a0 \u4f7f\u7528\u7cfb\u7d71\u9810\u8a2d\u5e36\u51fa\u4f86\u7684\u4f4d\u7f6e\u5c31\u53ef\u4ee5<\/p>\n VPN \u6703\u9700\u8981\u4e00\u500bpublic ip<\/p>\n \u9ede\u9078 public ip address\u00a0 => create new<\/p>\n \u8a2d\u5b9a\u540d\u7a31\u5f8c \u9ede [\u78ba\u5b9a]<\/p>\n \u6700\u5f8c \u9ede[\u5efa\u7acb]\uff0c\u5c31\u6703\u958b\u59cb\u5efa\u7acb\u865b\u64ec\u7db2\u8def\u9598\u9053\uff0c\u4e26\u53d6\u5f97\u4e00\u500bpublic ip (\u9019\u500b\u6b65\u9a5f\u6703\u6bd4\u8f03\u4e45)<\/p>\n 4. Create Microsoft Azure local network gateway<\/p>\n \u63a5\u4e0b\u4f86\u6b65\u9a5f\u5c31\u662f\u5efa\u7acblocal network gateway (\u9593\u55ae\u4f86\u8aaa\u5c31\u662fazure \u9019\u908a\u8981\u8207fortigate \u5efa\u7acb\u7684\u7db2\u8def)<\/p>\n \u641c\u5c0b local network gateway \u627e\u5230 \u5340\u57df\u7db2\u8def\u9598\u9053 => \u9ede\u9078 [\u5efa\u7acb]<\/p>\n \u540d\u7a31\u81ea\u8a02<\/p>\n ip address : \u9019\u88e1\u5c31\u662f\u8981\u548cazure \u5efa\u7acb\u9023\u7dda\u7684public ip\u00a0 (\u4e5f\u5c31\u662ffortinet public)<\/p>\n Address space : \u9019\u88e1\u7684\u7db2\u6bb5\u5c31\u662f fortinet \u4e0b\u7684\u7db2\u6bb5<\/p>\n \u90fd\u8a2d\u5b9aOK\u5f8c\u5c31\u9ede\u9078\u5efa\u7acb<\/p>\n 5.\u8a2d\u5b9aFortigate VPN<\/p>\n VPN =>\u00a0 IPsec Wizard<\/p>\n \u7528\u6236\u540d\u81ea\u8a02 : Azure-VPN \uff0c\u00a0 \u4e26\u9ede\u9078 [\u81ea\u5b9a\u7fa9]<\/p>\n IP\u4f4d\u5740:\u9019\u88e1\u662f\u8f38\u5165\u524d\u9762\u6b65\u9a5f azure \u53d6\u5f97\u7684public\u00a0 ip<\/p>\n \u8a2d\u5b9a\u4e00\u7d44\u5171\u4eab\u5bc6\u78bc<\/p>\n IKE :\u00a0 \u9078\u64c7\u7248\u672c2<\/p>\n Phase 1 Proposal \u8a2d\u5b9a <\/strong>Encryption <\/strong>AES 128<\/strong><\/p>\n \u8a8d\u8b49 <\/strong> SHA256<\/strong>.<\/p>\n Diffie-Hellman : 2<\/strong><\/p>\n \u5bc6\u9470\u9031\u671f : 28800<\/p>\n Phase 2 Selectors<\/strong><\/strong><\/p>\n Encryption <\/strong><\/p>\n <\/p>\n \u5c07 <\/strong>Perfect Forward Secrecy<\/p>\n \u5bc6\u9470\u9031\u671f: \u9078\u64c7 \u79d2<\/p>\n \u79d2: 27000<\/strong>.<\/p>\n \u8a2d\u5b9aFortigate 60E \u7269\u4ef6<\/p>\n \u4e3b\u8981\u793e\u65b9\u9762\u5f8c\u9762\u8a2d\u5b9apolicy \u65b9\u4fbf<\/p>\n \u8a2d\u5b9a AzureNetwork \u7db2\u6bb5 10.10.0.0\/16<\/p>\n \u8a2d\u5b9apolicy1<\/p>\n \u5167\u90e8\u7db2\u6bb5 to Azure-VPN\u00a0 \u539f\u5247<\/p>\n \u8a2d\u5b9apolicy2<\/p>\n Azure-VPN to \u5167\u90e8\u7db2\u6bb5\u00a0\u00a0 \u539f\u5247<\/p>\n <\/p>\n \u8a2d\u5b9a\u5b8c\u7562<\/p>\n \u7db210.10.0.0\/16 \u8d70\u524d\u9762\u8a2d\u5b9a\u7684Azure-VPN<\/p>\n \u5728Virtual network gateway \u4e2d\u9ede\u9078 Connections<\/p>\n \u9ede Add<\/p>\n \u8f38\u5165 per share key \uff0c\u540d\u7a31\u81ea\u8a02\uff0c\u4e26\u9078\u64c7 \u524d\u9762\u5efa\u7acb\u7684Local network gateway<\/p>\n \u4ee5\u4e0a\u5c31\u5b8c\u6210fortinet\u00a0 azure site to site vpn \u8a2d\u5b9a<\/p>\n \u6700\u5f8c\u53ef\u4ee5\u770b\u5230azure \u53ca fortinet vpn \u72c0\u614b\u90fd\u662f\u806f\u7dda\u7684(\u5982\u4e0b\u5716)<\/p>\n \u984d\u5916\u6e2c\u8a66:<\/p>\n \u6211\u5728Azure VPN \u65b0\u589e\u4e00\u500b\u5b50\u7db2\u6bb5 10.10.2.0\/24<\/p>\n \u518dAzure \u65b0\u589e\u4e00\u53f0VM\uff0c\u4e14\u7528\u9019\u500b\u500b\u7db2\u6bb5 (\u9019\u53f0VM\u662fDC)<\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nFortiGate \u8a2d\u5b9a\u8def\u7531<\/h4>\n
<\/a><\/p>\n<\/h4>\n
7.\u8a2d\u5b9a Microsoft Azure Site-to-Site VPN connection<\/h4>\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n